SCAZT Threat Response Practice Test 4 — 15 Questions

Question 1

When designing a SOAR playbook for cloud security incidents, which TWO factors are critical for ensuring successful execution?

Accepted Answer

Input validation logic. Input validation logic (A) is critical because SOAR playbooks consume data from alerts, tickets, and external feeds; validating and normalizing that input prevents malformed or malicious values from breaking conditional branches, causing failed API calls, or triggering unintended automated actions. Correct API permissions for integrated tools (D) is equally critical because each playbook action (e.g., isolating an EC2 instance, disabling an IAM key, posting to Slack) executes under a service account or integration credential, and least-privilege scopes must be granted for those specific APIs or the steps will fail with 401/403 errors. Full administrative privileges (B) is not required and violates least privilege, increasing blast radius if the playbook or credential is compromised. Manual intervention steps (C) are optional and can even reduce automation value, so they are not a critical success factor. Frequent database reindexing (E) is unrelated to playbook execution and addresses search performance, not SOAR workflow reliability.

Answer

Full administrative privileges

Answer

Manual intervention steps

Answer

Frequent database reindexing

Question 2

Which THREE types of activities are commonly used in SecureX orchestration playbooks for threat containment?

Accepted Answer

Update firewall access policy. In SecureX orchestration playbooks, threat containment typically involves taking direct, automated actions against the affected assets or access paths. Option A (Update firewall access policy) is correct because modifying firewall rules to block malicious IPs, domains, or ports is a standard containment action that limits an attacker's ability to communicate with command-and-control infrastructure or move laterally. Option C (Isolate endpoint) is correct because isolating a compromised endpoint via EDR or network quarantine cuts off the host from the network while preserving it for forensic investigation, which is a core containment technique. Option E (Disable user account) is correct because disabling a compromised or suspicious user account prevents further unauthorized access and stops the attacker from using those credentials to pivot or persist. Option B (Clear browser cache) is not a containment activity — it is a remediation or hygiene step that does not stop an active threat. Option D (Restart the operating system) is not containment either; rebooting may disrupt volatile evidence and does not reliably prevent an adversary from continuing their activity.

Answer

Clear browser cache

Answer

Restart the operating system

Question 3

When investigating a file hash in SecureX Threat Response, which TWO sources can provide intelligence?

Accepted Answer

Cisco Talos. Cisco Talos (B) is correct because SecureX Threat Response aggregates threat intelligence from Cisco Talos, which provides reputation, signature, and behavioral data for file hashes (for example, via AMP and ClamAV verdicts). Third-party threat feeds (E) are also correct because SecureX Threat Response enriches observables such as file hashes with intelligence from integrated external providers, not just Cisco sources. Windows Update history (A) is not a threat-intelligence source; it only records installed OS patches. Local DNS logs (C) show name-resolution activity and do not provide file-hash reputation. System uptime logs (D) record host availability and are unrelated to hash intelligence.

Answer

Windows Update history

Answer

Local DNS logs

Answer

System uptime logs

Question 4

Which THREE steps are involved in the standard SecureX orchestration lifecycle for a new workflow?

Accepted Answer

Configure credentials. In the SecureX orchestration lifecycle, configuring credentials (A) is a required step because workflows must authenticate to external systems such as Cisco SecureX, threat intelligence APIs, or on-premises tools using stored credential objects before any action can run. Defining workflow logic (D) is also essential, since the workflow's activities, triggers, conditions, and data mappings must be authored in the visual workflow editor to implement the intended automation. Executing and testing (E) is the third correct step, as the workflow must be run manually or via a trigger to validate behavior, inspect execution logs, and confirm outputs before production use. The remaining options do not belong: physical appliance installation (B) is not part of the standard SecureX orchestration workflow lifecycle because orchestration is a cloud-delivered capability, and manual firmware patching (C) is not a workflow lifecycle step since SecureX orchestration is a SaaS service updated by Cisco, not a customer-patched appliance.

Answer

Physical appliance installation

Answer

Manual firmware patching

Question 5

What are TWO primary ways to trigger an orchestration workflow in SecureX?

Accepted Answer

Manual triggering. Option C (Manual triggering) is correct because SecureX orchestration workflows can be started on demand by an analyst from the SecureX orchestration interface, which is a primary trigger method for ad-hoc response actions. Option D (Webhook ingestion) is correct because SecureX orchestration supports webhook triggers, allowing external systems to initiate a workflow by sending an HTTP request to a unique webhook URL, which is a core event-driven trigger mechanism. Option A (Scheduled reboot) is not a workflow trigger in SecureX; it describes a system action, not an orchestration initiation method. Option B (Console-based typing) is not a supported trigger; workflows are not launched by typing commands into a console. Option E (Direct database injection) is not a valid or supported way to trigger SecureX orchestration workflows and would bypass the intended API/webhook/UI mechanisms.

Answer

Scheduled reboot

Answer

Console-based typing

Answer

Direct database injection

Question 6

What are TWO benefits of integrating Cisco Secure Email with SecureX orchestration?

Accepted Answer

Global threat purging. Option B (Global threat purging) is correct because SecureX orchestration can trigger Secure Email's message remediation capabilities across the organization, allowing an administrator to search for and delete malicious messages from all mailboxes at once rather than manually hunting them per-user. Option D (Automated threat extraction) is correct because orchestration workflows can automatically invoke Secure Email's threat extraction feature, which strips active content and attachments from messages and replaces them with safe renditions before delivery, removing the need for manual analyst intervention. The remaining options do not belong: real-time video monitoring (A) is not a Secure Email or SecureX orchestration function, manual email routing (C) contradicts the automation benefit that orchestration provides, and hardware load balancing (E) is an infrastructure/networking concern unrelated to email security integration.

Answer

Real-time video monitoring

Answer

Manual email routing

Answer

Hardware load balancing

Question 7

When building a custom API integration in SecureX, which TWO authentication protocols are commonly supported for secure access?

Accepted Answer

API Key. Option A (API Key) is correct because SecureX custom API integrations commonly authenticate requests by passing a static API key or token in the request header, which the platform validates to grant access to the API. Option D (OAuth2) is correct because SecureX supports OAuth2 authorization flows, allowing integrations to obtain bearer access tokens for secure, scoped, and revocable access to protected resources. Options B (Kerberos), C (NTLM), and E (LDAP) are not the commonly supported authentication protocols for SecureX custom API integrations; Kerberos and NTLM are Windows domain authentication mechanisms, and LDAP is a directory access protocol rather than an API authentication scheme used by SecureX for this purpose.

Answer

Kerberos

Answer

NTLM

Answer

LDAP

Question 8

In a SOAR playbook, which THREE types of data can be used to enrich an incident within a case?

Accepted Answer

File hash analysis. In a SOAR playbook, enrichment adds context to an incident by querying threat-intelligence and analysis services. Option A (File hash analysis) is correct because submitting an MD5/SHA-256 hash to services like VirusTotal or a sandbox returns detections, malware family, and prevalence data that directly enrich the case. Option D (Domain age and ownership) is correct because WHOIS/RDAP lookups return registrar, creation date, and registrant details, and newly registered or privacy-shielded domains are strong indicators of malicious infrastructure. Option E (IP Reputation) is correct because reputation feeds (e.g., AbuseIPDB, VirusTotal, Talos) return geolocation, ASN, and threat scores for an IP observed in the incident. Option B (Browser version history) is not a standard enrichment data type in SOAR playbooks; it is endpoint inventory/patch data, not threat context. Option C (User physical location) is not typically used for enrichment in this context; identity/asset context such as department or manager may be pulled from a CMDB or directory, but physical location is not a standard enrichment source.

Answer

Browser version history

Answer

User physical location

Question 9

Which TWO aspects of threat response are improved by using SecureX orchestration?

Accepted Answer

Reduced response time. SecureX orchestration improves threat response by reducing response time (Option A), because automated workflows (playbooks) trigger remediation actions such as isolating an endpoint or blocking a hash immediately upon alert ingestion, eliminating the delay of manual analyst intervention. It also improves consistent execution (Option B), since the same predefined workflow runs identically on every matching incident, removing human variability and ensuring repeatable, standardized response steps. The remaining options do not belong: increased manual oversight (C) is the opposite of what orchestration provides, as it reduces manual effort; hardware performance (D) is unrelated to an orchestration platform's function; and network latency (E) is a network characteristic that orchestration does not directly improve.

Answer

Increased manual oversight

Answer

Hardware performance

Answer

Network latency

Question 10

During the design of a SOAR playbook for cloud incident response, you need to ensure that evidence collection is preserved in a compliant manner. Which action is recommended when integrating with Cisco Secure Endpoint for forensic data collection?

Accepted Answer

Execute 'Get Forensic Snapshot' through the Secure Endpoint integration.. Executing 'Get Forensic Snapshot' through the Secure Endpoint integration is the recommended action because it captures a point-in-time snapshot of the endpoint's memory and disk state in a forensically sound manner, preserving evidence integrity. This method is automated, compliant, and minimizes disruption.

Answer

Manually SSH into the VM to copy /var/log files.

Answer

Copy files to a local public-facing FTP server for review.

Answer

Delete the VM and restore from a known good backup.

Answer

Trigger a full disk wipe of the instance.

Question 11

Which capability does the Cisco SecureX 'Response' feature provide to an incident responder when analyzing a file hash detected in the cloud?

Accepted Answer

The ability to search for the file across integrated product logs and take remediation actions.. SecureX Response (part of the SecureX platform, leveraging Cisco Threat Response) lets an incident responder pivot from an observable like a file hash to search across all integrated Cisco and third-party product telemetry (AMP, Umbrella, Firepower, Email Security, etc.) to see where else the hash appears. From there, the responder can trigger remediation actions such as blocking the hash, isolating an endpoint, or adding to a blocklist directly from the unified interface.

Answer

Automatic deletion of the file from all cloud storage buckets.

Answer

An automated way to reset user passwords in Azure AD.

Answer

A method to update cloud firewall rules via CLI.

Answer

The ability to generate a PDF report of cloud compliance.

Question 12

When designing an automated threat response for cloud-native applications, why is it critical to include a 'Human-in-the-loop' (HITL) step in the orchestration workflow?

Accepted Answer

To ensure that automated remediation actions are reviewed and approved before impacting production services.. HITL is critical in automated workflows to prevent false positives from causing business disruption, especially when the remediation involves blocking critical services or isolating production servers.

Answer

Because the Cisco SecureX platform requires a manual key-press to initiate any network-based isolation.

Answer

Because the SOAR platform cannot execute more than one API call without human confirmation.

Answer

To provide evidence for the automated audit log.

Answer

To comply with API rate-limiting requirements on cloud provider platforms.

Question 13

When setting up an automated response workflow in Cisco SecureX, which THREE of the following are valid trigger sources for initiating a playbook?

Accepted Answer

Webhooks from third-party security tools.. Option B is correct because SecureX playbooks can be initiated by webhooks, which allow third-party security tools to send HTTP POST requests to a SecureX API endpoint and trigger automated workflows. Option C is correct because SecureX provides a manual trigger capability directly from the SecureX dashboard, enabling analysts to launch a playbook on demand. Option E is correct because SecureX supports scheduled triggers, allowing playbooks to run automatically on a recurring cron-based schedule. Option A is not a valid trigger source, as SecureX does not use local workstation login notifications to initiate playbooks. Option D is also not valid, since a physical datacenter door sensor alarm is not an integrated trigger type within SecureX playbook automation.

Answer

An automated login notification from a local workstation.

Answer

A physical alarm triggered by a datacenter door sensor.

Question 14

When designing incident response playbooks, which THREE of the following are considered best practices for maintaining security and operational continuity?

Accepted Answer

Implement comprehensive logging for every workflow execution step.. Option B is correct because comprehensive logging of every workflow execution step provides the audit trail and forensic evidence needed to trace actions during an incident, verify playbook behavior, and support post-incident reviews and compliance requirements. Option D is correct because dedicated service accounts scoped with least privilege limit the blast radius if a playbook or its credentials are compromised, preventing lateral movement and unauthorized access to unrelated systems. Option E is correct because modular, reusable playbooks reduce duplication and maintenance overhead, allow consistent response procedures across different incident types, and enable faster adaptation when new threats emerge. Option A is not a best practice because running playbooks only in Production without staging validation risks untested automation causing outages or destructive actions. Option C is not a best practice because sharing administrative credentials in plaintext destroys accountability, violates least privilege and separation of duties, and exposes privileged access to anyone who sees the text.

Answer

Run all playbooks in 'Production' mode without testing in a staging environment.

Answer

Share administrative credentials with all team members in plaintext.

Question 15

Which TWO methods are natively supported within Cisco SecureX Orchestration for passing data between disparate security tools in a single workflow?

Accepted Answer

Passing data through JSON variables across workflow activities.. Option A is correct because Cisco SecureX Orchestration workflows natively use JSON-based variables (including global, workflow, and activity-level variables) to store and pass structured data between activities from disparate security tools. Option E is correct because the workflow editor natively supports binding the output schema of one activity directly to the input fields of a subsequent activity, enabling seamless data flow without manual transformation. Option B is incorrect because exporting to a shared CSV on a local drive is not a native orchestration data-passing mechanism and would require external file handling. Option C is incorrect because physical USB keys are not a supported or practical data transfer method within an automated orchestration workflow. Option D is incorrect because hardcoding credentials into activity blocks is a security anti-pattern and not a data-passing method; SecureX Orchestration uses credential and target objects instead.

Answer

Exporting data to a shared CSV file on a local drive.

Answer

Using physical USB keys to transfer data between servers.

Answer

Hardcoding credentials into each individual activity block.