SCAZT Threat Response Practice Test 3 — 15 Questions

Question 1

Which type of file allows you to import and share a complete workflow design between different SecureX organizations?

Accepted Answer

JSON File. SecureX workflows are exported and imported as JSON files, which serialize the entire workflow definition including nodes, edges, variables, and configuration. This JSON format is what the SecureX orchestration interface uses when you click 'Export' or 'Import' on a workflow, enabling portability between SecureX organizations. The JSON structure preserves the workflow's logic and metadata so it can be reconstructed in the target tenant.

Answer

YAML File

Answer

CSV File

Answer

XML File

Question 2

Which interface in Cisco SecureX allows users to manually trigger an orchestration workflow?

Accepted Answer

Workflows Tab. The Workflows Tab in Cisco SecureX is the interface where orchestration workflows are listed, created, edited, and manually executed. From this tab, users can select a workflow and trigger it on demand, as well as view its run history and status.

Answer

Settings Tab

Answer

Reporting Tab

Answer

Help Tab

Question 3

When using SecureX to orchestrate response, which action is best suited for blocking a URL globally?

Accepted Answer

Umbrella Policy Update. Blocking a URL globally is best done by updating the Umbrella policy, since Umbrella enforces DNS-layer and web-layer blocking across all protected networks and roaming clients. An orchestration action that pushes a domain/URL into an Umbrella block list applies the block globally and immediately.

Answer

Endpoint Host File Modification

Answer

FMC Rule Update

Answer

Cloud Access Security Broker Rule

Question 4

You need to ensure that an orchestration workflow only runs if a specific threat intelligence score exceeds a threshold. Which node type do you use?

Accepted Answer

Decision Node. A 'Decision' node with a numeric comparison operator is used to evaluate threat scores and determine the execution path.

Answer

Data Mapping Node

Answer

Process Node

Answer

Wait Node

Question 5

What is the purpose of the 'Casebook' in Cisco SecureX?

Accepted Answer

Group observables for investigation. Casebook serves as an incident management workbench, allowing analysts to group observables and evidence for investigation.

Answer

Monitor network traffic

Answer

Configure firewall policies

Answer

Automate endpoint isolation

Question 6

You are integrating a cloud-native security tool with SecureX. Which authentication method is generally preferred for the API integration?

Accepted Answer

Credential Object. A Credential Object is generally preferred for API integration with SecureX because it securely stores credentials (such as API keys or tokens) in a centralized, encrypted manner and allows for easy rotation and access control. It abstracts the authentication details from the integration code.

Answer

Client-side certificates

Answer

Username/Password in headers

Answer

Hardcoded strings

Question 7

You need to handle a case where an endpoint device is not reachable during an isolation attempt. How should the workflow respond?

Accepted Answer

Notify administrator of failure. The workflow should use error handling to transition to a 'failed' state and alert an admin, as the device may be offline or the agent disconnected.

Answer

Delete the device object

Answer

Retry indefinitely

Answer

Ignore and continue

Question 8

Which menu in the SecureX dashboard allows you to manage the API clients for third-party integrations?

Accepted Answer

API Clients. The API Clients menu in the SecureX dashboard is where administrators create and manage API clients — credentials (client ID and secret) used by third-party integrations and external applications to authenticate to SecureX APIs. This is the correct location for managing programmatic access.

Answer

Global Settings

Answer

User Management

Answer

Integration Modules

Question 9

When designing a SOAR playbook, which mechanism ensures that the playbook does not trigger multiple times for the same alert?

Accepted Answer

Stateful deduplication check. Deduplication logic, often using a 'Case' status check or a stateful flag, prevents redundant executions.

Answer

Random delay node

Answer

Firewall rate limiting

Answer

Task sequencing

Question 10

You are using a 'Loop' node in a SecureX workflow to process a list of IPs. How do you access the current item within the loop iteration?

Accepted Answer

Reference the iterator variable. In a SecureX orchestration Loop node, the current item of each iteration is exposed as the iterator variable, which you reference in downstream nodes to access the value being processed. The Loop node automatically creates this variable and updates it on each pass through the list. Referencing the iterator variable is the correct way to use the current IP in the iteration.

Answer

Re-query the input node

Answer

Use a global pointer

Answer

Reference the original list index

Question 11

When a threat response workflow completes, what is the best practice for auditing the action?

Accepted Answer

Update Casebook with findings. Adding a note or updating the associated Casebook incident is the standard way to provide an audit trail of automated actions.

Answer

Send an email to all users

Answer

Take a backup of the database

Answer

Delete the workflow logs

Question 12

Which Cisco product provides the primary telemetry source for endpoint-based threat response?

Accepted Answer

Secure Endpoint. Cisco Secure Endpoint (formerly AMP for Endpoints) is the endpoint detection and response (EDR) product that continuously collects telemetry — process executions, file hashes, network connections, and behavioral events — from managed endpoints. That telemetry feeds Cisco's threat response and SecureX platforms, making Secure Endpoint the primary endpoint-based telemetry source. The other products listed provide network, DNS, or email telemetry, not endpoint-level data.

Answer

Umbrella

Answer

Firepower Management Center

Answer

Stealthwatch

Question 13

In SecureX orchestration, which object type is used to store sensitive API keys used by workflows?

Accepted Answer

Credential. Credential objects provide a secure way to store secrets, ensuring they are encrypted and not visible in plaintext within the workflow designer.

Answer

Variable

Answer

Vault Asset

Answer

Global Constant

Question 14

You are analyzing an incident in SecureX. You see an 'Observable' marked in red. What does this indicate?

Accepted Answer

High-severity malicious indicator. Red observables typically indicate a high-severity threat or a known malicious indicator based on intelligence feeds.

Answer

Suspicious but unverified

Answer

Clean/Benign

Answer

Unknown status

Question 15

When managing incidents in SecureX, which TWO actions can be performed directly from a Casebook?

Accepted Answer

Trigger a workflow. Casebook allows analysts to add observables for investigation and trigger pre-configured workflows to automate response.

Answer

Manage user passwords

Answer

Modify firewall firmware

Answer

Delete all historical logs