A security analyst receives a suspicious URL from a user. The URL is not on any blocklist, but the analyst suspects it may host malware. The analyst wants to analyze the URL safely without exposing the corporate network. Which action should the analyst take?

Submit the URL to a cloud-based sandbox that detonates it in a controlled environment.

Perform a whois lookup on the domain.

Open the URL in a browser on a non-critical workstation.

Check the URL against a local signature database.

During an incident, a security team identifies multiple hosts infected with the same malware. The malware communicates with a specific IP address and uses a unique registry key. The team wants to determine if this is a known malware family and gather IOCs for future detection. What should the team do?

Search threat intelligence platforms for the IP address and registry key to identify the malware family.

Document the incident and close it.

Create a new signature based on the registry key.

Isolate the hosts and reimage them immediately.

After containing a malware outbreak, the incident response team is preparing a post-incident report. The report must include lessons learned and recommendations to prevent recurrence. Which element is most critical to include in the report?

The names of the employees involved.

A detailed timeline of the incident and actions taken.

The root cause analysis and specific mitigation recommendations.

The cost of the incident to the company.

A security team is evaluating a new endpoint detection and response (EDR) solution. The solution must detect unknown malware that does not have a signature. Which detection technique is most suitable?

Behavioral analysis that monitors process actions and network connections.

Signature-based detection using a large database of hashes.

Static analysis of file strings and imports.

Sandboxing every file before execution.

CCIE Security

Domain 5Objective 2

5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 11)

Part of the 5.0 Advanced Threat Protection and Content Security domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

20%of the exam

Questions 51–54

51application · easy
A security analyst receives a suspicious URL from a user. The URL is not on any blocklist, but the analyst suspects it may host malware. The analyst wants to analyze the URL safely without exposing the corporate network. Which action should the analyst take?
Select an answer first
52application · medium
During an incident, a security team identifies multiple hosts infected with the same malware. The malware communicates with a specific IP address and uses a unique registry key. The team wants to determine if this is a known malware family and gather IOCs for future detection. What should the team do?
Select an answer first
53application · medium
After containing a malware outbreak, the incident response team is preparing a post-incident report. The report must include lessons learned and recommendations to prevent recurrence. Which element is most critical to include in the report?
Select an answer first
54application · medium
A security team is evaluating a new endpoint detection and response (EDR) solution. The solution must detect unknown malware that does not have a signature. Which detection technique is most suitable?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.

5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 11)

Questions 51–54

A security analyst receives a suspicious URL from a user. The URL is not on any blocklist, but the analyst suspects it may host malware. The analyst wants to analyze the URL safely without exposing the corporate network. Which action should the analyst take?

After containing a malware outbreak, the incident response team is preparing a post-incident report. The report must include lessons learned and recommendations to prevent recurrence. Which element is most critical to include in the report?

A security team is evaluating a new endpoint detection and response (EDR) solution. The solution must detect unknown malware that does not have a signature. Which detection technique is most suitable?

Keep studying — 5.0 Advanced Threat Protection and Content Security