300-710 practice questions 101–110

1. Question 101 · 338 in bank

   Select 2

   Upon detecting a flagrant threat on an endpoint, which two technologies instruct Cisco Identity Services Engine to contain the infected endpoint either manually or automatically? (Choose two.)

   • ACisco Stealthwatch
   • BCisco ASA 5500 Series
   • CCisco FMC
   • DCisco ASR 7200 Series
   • ECisco AMP

   Show answer

   Answer: CE

   Explanation

   RTC w/ FMC & ISE is the ability for the FMC to quarantine end points through ISE. So, when the FMC sees some indicators of compromise, certain Snort IPS signatures are fired, or malware is discovered through AMP, the FMC can trigger actions to occur through ISE. ISE, in turn, can determine what to do when that trigger occurs. ISE could kick the user off the network or change the context of the user and endpoint so that different actions are taken within the network infrastructure.

   Source: Adapted from community discussion — uedemdog

   References

   • cisco.com documentation

   Next question

2. Question 102 · 338 in bank

   A security engineer found a suspicious file from an employee email address and is trying to upload it for analysis, however the upload is failing. The last registration status is still active. What is the cause for this issue?

   • ACisco AMP for Networks is unable to contact Cisco Threat Grid on premise.
   • BThere is a host limit set.
   • CThe user agent status is set to monitor.
   • DCisco AMP for Networks is unable to contact Cisco Threat Grid Cloud.

   Show answer

   Answer: B

   Explanation

   The answer is probably B... What is very confusing is that Cisco always, always changes its product names so often. “Cisco Threat Grid” is now called ‘Secure Malware Analytics’. Cisco, please PLEASE DON'T use this name for your exams. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config -76/network-malware-protection.html?bookSearch=true#:~:text=Threat%20Grid

   Source: Adapted from community discussion — tinyJoe

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 103 · 338 in bank

   What is the role of the casebook feature in Cisco Threat Response?

   • Apulling data via the browser extension
   • Balert prioritization
   • Csharing threat analysis
   • Dtriage automation with alerting

   Show answer

   Answer: C

   Explanation

   I would say its C, since: "The casebook and pivot menu are widgets available in Cisco Threat Response. Casebook - It is used to record, organize, and share sets of observables of interest primarily during an investigation and threat analysis. You can use a casebook to get the current verdicts or dispositions on the observables."

   Source: Adapted from community discussion — Baumb

   Next question

4. Question 104 · 338 in bank

   An engineer is troubleshooting a file that is being blocked by a Cisco FTD device on the network. The user is reporting that the file is not malicious. Which action does the engineer take to identify the file and validate whether or not it is malicious?

   • AIdentify the file in the intrusion events and submit it to Threat Grid for analysis.
   • BUse FMC file analysis to look for the file and select Analyze to determine its disposition.
   • CUse the context explorer to find the file and download it to the local machine for investigation.
   • DRight click the connection event and send the file to AMP for Endpoints to see if the hash is malicious.

   Show answer

   Answer: B

   Next question

5. Question 105 · 338 in bank

   An engineer is configuring a second Cisco FMC as a standby device but is unable to register with the active unit. What is causing this issue?

   • AThe code versions running on the Cisco FMC devices are different.
   • BThe licensing purchased does not include high availability.
   • CThe primary FMC currently has devices connected to it.
   • DThere is only 10 Mbps of bandwidth between the two devices.

   Show answer

   Answer: A

   Explanation

   FMC High Availability. High Availability is available on physical Firepower Management Center appliances (and FMCv since 6.7. 0). Before configuring FMC HA make sure that… • Hardware is identical (no mix and match between virtual and/or physical form factors) • Software release is identical on both FMCs • There are no sensors registered to the secondary FMC

   Source: Adapted from community discussion — aadach

   Next question

6. Question 106 · 338 in bank

   Which protocol is needed to exchange threat details in rapid threat containment on Cisco FMC?

   • ASGT
   • BSNMP v3
   • CBFD
   • DpxGrid

   Show answer

   Answer: D

   Next question

7. Question 107 · 338 in bank

   The network administrator wants to enhance the network security posture by enabling machine learning for malware detection due to a concern with suspicious Microsoft executable file types that were seen while creating monthly security reports for the CIO. Which feature must be enabled to accomplish this goal?

   • AEthos
   • Bstatic analysis
   • CSpero
   • Ddynamic analysis

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

8. Question 108 · 338 in bank

   What is the RTC workflow when the infected endpoint is identified?

   • ACisco ISE instructs Cisco AMP to contain the infected endpoint.
   • BCisco ISE instructs Cisco FMC to contain the infected endpoint.
   • CCisco FMC instructs Cisco ISE to contain the infected endpoint.
   • DCisco AMP instructs Cisco FMC to contain the infected endpoint.

   Show answer

   Answer: C

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 109 · 338 in bank

   A network administrator is configuring a Cisco AMP public cloud instance and wants to capture infections and polymorphic variants of a threat to help detect families of malware. Which detection engine meets this requirement?

   • AEthos
   • BTetra
   • CRBAC
   • DSpero

   Show answer

   Answer: A

   References

   • cisco.com documentation

   Next question

10. Question 110 · 338 in bank

    Due to an increase in malicious events, a security engineer must generate a threat report to include intrusion events, malware events, and security intelligence events. How is this information collected in a single report?

    • ARun the default Firepower report.
    • BCreate a Custom report.
    • CGenerate a malware report.
    • DExport the Attacks Risk report.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-710 practice, question 101. 338 questions available.