5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the final disposition of a malware detection event when the file is determined to be benign and no action is taken?

   • AClean
   • BRemediated
   • CIsolated
   • DQuarantined
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of correlating multiple malware detection events in Cisco Secure Endpoint?

   • ATo identify patterns or broader attacks
   • BTo reduce the number of false positives
   • CTo automatically quarantine all affected endpoints
   • DTo increase the severity of each individual event
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How does threat intelligence integration enhance a malware detection event in Cisco Secure Endpoint?

   • AIt changes the severity level of the event.
   • BIt identifies the affected endpoint's IP address.
   • CIt provides additional context such as threat actor and campaign information.
   • DIt automatically remediates the threat without analyst action.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An analyst is investigating a Cisco Secure Endpoint event for a file named 'update.exe'. The event is enriched with threat intelligence showing it is associated with a known threat actor and has a global prevalence of 'High'. However, the severity is only 3. The file was detected on a single endpoint. What is the most appropriate interpretation?

   • AThe low severity means the file is not a threat and can be ignored
   • BThe high prevalence means the file is likely a false positive
   • CThe threat actor association is irrelevant because the severity is low
   • DThe high prevalence and threat actor association increase the risk, despite the low severity, so the analyst should investigate further
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst notices three separate Cisco Secure Endpoint events on different endpoints, all involving files with the same SHA-256 hash. The files have different names: 'invoice.pdf.exe', 'resume.pdf.exe', and 'photo.jpg.exe'. What does this pattern suggest?

   • AThe events are unrelated and should be investigated separately
   • BA single malware file is being distributed under different names across the organization
   • CThree different malware families are attacking the organization
   • DThe events are false positives because the file names are different
   Reveal Solution Discussion Select an answer first