You are configuring Cisco SecureX orchestration to automate threat containment. You need to trigger a playbook when a high-severity alert is ingested from Cisco Secure Endpoint. Which component must be defined to map the alert fields to the playbook input variables?
In an automated threat response scenario, you want to block a malicious domain globally across your environment using Cisco Umbrella. Which API endpoint is utilized by the SecureX orchestrator?
You are designing a SOAR playbook in Cisco SecureX to isolate a compromised endpoint. To ensure the isolation is verified before proceeding to the next step, which specific activity node should be utilized?
You have integrated Cisco Secure Firewall with SecureX. You want to automate the addition of a suspicious IP address to a dynamic object group. Which component in the FMC API architecture is primarily used for this?
You are configuring an email notification step in a SOAR playbook. You want the email to include the results of a previous 'Search IP' activity. How do you reference the IP address in the email body?
You are designing a playbook that isolates a host based on its IP. What is the standard practice for handling the dynamic IP address of an endpoint using DHCP?
A security engineer is designing a SOAR playbook in Cisco SecureX Orchestration to isolate a compromised virtual machine in AWS. The playbook must query Cisco Secure Endpoint (AMP for Endpoints) for file trajectory data before performing the isolation. Which activity node should be placed first to ensure the endpoint is correctly identified in the cloud environment?
You are configuring Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) to trigger an automated response when a suspicious S3 bucket access pattern is detected. Which integration method is best suited for executing a pre-defined playbook in response to this alert?
In Cisco SecureX, which dashboard component allows a security analyst to view the real-time status of triggered automated workflows and their execution history?
You are integrating Cisco Umbrella with your incident response process. When a domain is flagged as malicious, you want to automatically add the domain to a 'Blocked' destination list. Which API or service should the SecureX Orchestration workflow utilize to achieve this?
An analyst in Cisco SecureX Threat Response is investigating a suspicious file hash observed on an endpoint. The hash verdict shows as 'Unknown' and the analyst wants to pivot to a private, on-premises threat intelligence source that is already integrated via a Cisco Threat Intelligence API module. Which action should the analyst take in Threat Response to enrich the observable with that private source?
You need to ensure that an incident response playbook in Cisco SecureX automatically updates a case in the Casebook feature. Which action is required in the workflow design?
You are building a custom integration in SecureX orchestration to fetch identity data from an external IDP. If the IDP uses OAuth2, which field must be secured using the 'Credential' object type?
When integrating Cisco Secure Firewall Management Center (FMC) with SecureX, which protocol is primarily used for the exchange of threat intelligence and orchestration commands?
When automating threat response using SecureX, you want to verify if a file hash is malicious using Talos Intelligence. Which tool provides this lookup capability?
During the design of a SOAR playbook for cloud incident response, you need to ensure that evidence collection is preserved in a compliant manner. Which action is recommended when integrating with Cisco Secure Endpoint for forensic data collection?
When designing an automated threat response for cloud-native applications, why is it critical to include a 'Human-in-the-loop' (HITL) step in the orchestration workflow?
When designing incident response playbooks, which THREE of the following are considered best practices for maintaining security and operational continuity?
A security operations team is designing an automated response for its Cisco SecureX deployment. When a SecureX Threat Response investigation for a suspicious file hash returns an observable that matches a known-malicious verdict, the team wants to automatically add that hash to a private blocklist used by their endpoint protection and firewall enforcement points. The blocklist is exposed through a REST API that expects an HTTP POST with a JSON body containing the indicator value and a TTL. Which SecureX orchestration building block should the team use to construct and send that request as part of the automated workflow?
An analyst is triaging a phishing incident in Cisco SecureX Threat Response. The investigation shows that a user clicked a link, and the analyst wants to determine whether the destination domain has any known malicious associations before deciding whether to escalate. The analyst opens the domain observable and reviews the available intelligence modules. Which action best describes how Threat Response helps the analyst reach a verdict in this situation?
A security team is designing an automated response for cloud workload alerts. They want the playbook to quarantine a compromised Amazon EC2 instance by changing its security group to a restrictive one, but only after confirming the instance is not tagged as a production asset. Which approach best fits this requirement within Cisco SecureX orchestration?
A SOC manager wants to give analysts a single place in Cisco SecureX to review the status and results of automated response workflows that were triggered by incidents, including which ones succeeded and which failed. Which SecureX capability should the manager point analysts to?
A security architect is integrating a cloud workload protection platform with Cisco SecureX Threat Response so that detections automatically create investigations. The architect must choose TWO elements that are required for the integration to enrich observables and trigger response actions. (Choose two.)
During a cloud incident, an analyst needs to block a malicious domain across the organization's Secure Web Appliance and also record the block in the incident's casebook. The team wants a single automated action that performs both steps. Which SecureX orchestration design best achieves this?