5.6 Interpret Cisco Secure Endpoint Malware Detection Events 350-701 Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   Which type of information is typically provided by a threat intelligence feed to enrich a malware event?

   • AThe network's bandwidth usage
   • BThe user's login time
   • CThe endpoint's operating system version
   • DGlobal prevalence of the malware
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A Cisco Secure Endpoint event shows a file named 'legit_tool.exe' detected as a PUA with severity 3. The file is used by the marketing department for a legitimate business purpose. The analyst needs to prevent future alerts while allowing the file to run. What is the appropriate action?

   • AQuarantine the file on all endpoints
   • BIgnore the event and take no action
   • CIncrease the severity of the detection to trigger a more aggressive response
   • DAdd the file to the allow list for the marketing department's endpoints
   Reveal Solution Discussion Select an answer first