SCAZT Threat Response — Timed 20 Questions

Question 1

You are configuring Cisco SecureX orchestration to automate threat containment. You need to trigger a playbook when a high-severity alert is ingested from Cisco Secure Endpoint. Which component must be defined to map the alert fields to the playbook input variables?

20 minute time limit — choose an answer to begin.

Accepted Answer

Workflow Input Schema. In Cisco SecureX orchestration, the Workflow Input Schema defines the expected input variables for a playbook and maps incoming event fields (such as alert severity, endpoint GUID, or file hash) to those variables. Without this schema, the playbook cannot receive or interpret the alert data from Cisco Secure Endpoint. It is the binding layer between the trigger event and the workflow's execution context.

Answer

Event Mapping Table

Answer

Webhook Data Parser

Answer

Alert Transformation Rule

Question 2

In an automated threat response scenario, you want to block a malicious domain globally across your environment using Cisco Umbrella. Which API endpoint is utilized by the SecureX orchestrator?

Accepted Answer

Umbrella Enforcement API. The Umbrella Investigate and Enforcement APIs allow for programmatic blocking of domains within the Umbrella dashboard.

Answer

Umbrella Management API

Answer

Umbrella Threat API

Answer

Umbrella Query API

Question 3

You are designing a SOAR playbook in Cisco SecureX to isolate a compromised endpoint. To ensure the isolation is verified before proceeding to the next step, which specific activity node should be utilized?

Accepted Answer

Query Endpoint Status. The 'Wait for Condition' or 'Query' activities are used to pause execution until the status change is reflected in the source tool, such as Secure Endpoint.

Answer

Loop Control

Answer

Execute Command

Answer

Notification Node

Question 4

You have integrated Cisco Secure Firewall with SecureX. You want to automate the addition of a suspicious IP address to a dynamic object group. Which component in the FMC API architecture is primarily used for this?

Accepted Answer

Network Object API. FMC allows management of network objects via the REST API, enabling dynamic updates to object groups used in access control policies.

Answer

Policy API

Answer

System API

Answer

Event API

Question 5

You need to ensure that an orchestration workflow is only triggered during business hours. Which logical component allows you to restrict execution?

Accepted Answer

Decision Node. A Decision Node in an orchestration workflow evaluates a condition and branches execution based on the result. To restrict a workflow to business hours, you place a Decision Node that checks the current time/day and only continues down the 'true' path during business hours, effectively gating execution.

Answer

Filter Node

Answer

Loop Node

Answer

Wait Node

Question 6

You are configuring an email notification step in a SOAR playbook. You want the email to include the results of a previous 'Search IP' activity. How do you reference the IP address in the email body?

Accepted Answer

${previous_node.output_key}. In SecureX orchestration, output variables from previous nodes are referenced using the syntax ${node_name.output_key}.

Answer

[previous_node.output_key]

Answer

%previous_node.output_key%

Answer

Question 7

You are integrating a third-party SIEM with SecureX. If the SIEM does not have a native integration, how can you ingest its alerts into SecureX?

Accepted Answer

Configure a Webhook Trigger. When a third-party SIEM lacks a native SecureX integration, you can configure a Webhook Trigger in SecureX orchestration to receive alerts pushed from the SIEM via HTTP POST. The SIEM sends its alert payload to the webhook URL, which then triggers a SecureX workflow to process and enrich the alert. This is the standard pattern for ingesting alerts from arbitrary sources that can make outbound HTTP calls.

Answer

Map via SQL Query

Answer

Use an API Connector

Answer

Enable Syslog Forwarding

Question 8

You are designing a playbook that isolates a host based on its IP. What is the standard practice for handling the dynamic IP address of an endpoint using DHCP?

Accepted Answer

Use GUID or Hostname. Instead of IP addresses, use persistent identifiers like Hostname, MAC address, or Secure Endpoint GUID to ensure the correct device is targeted.

Answer

Map IPs via DNS

Answer

Query the DHCP server first

Answer

Use the IP only if it is static

Question 9

Which Cisco technology provides the 'Visibility' aspect of SecureX, allowing you to see traffic patterns across cloud and hybrid environments?

Accepted Answer

Secure Cloud Analytics. Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) is the component of the SecureX platform that provides visibility into traffic patterns across cloud, hybrid, and on-premises environments. It ingests flow logs from AWS, Azure, GCP, and on-prem networks to build a behavioral model of normal traffic and surface anomalies. That cloud-and-hybrid traffic visibility is exactly the 'Visibility' pillar the question describes.

Answer

Secure Email

Answer

Secure Network Analytics

Answer

Secure Malware Analytics

Question 10

Which THREE components are required to successfully deploy a webhook-based trigger for SecureX orchestration?

Accepted Answer

Authentication token. The three required components for a webhook-based trigger in SecureX orchestration are the authentication token (B), the JSON payload structure (D), and the endpoint URL (E). The authentication token (B) is necessary because the webhook must validate incoming requests, typically via a shared secret or bearer token, to ensure only authorized callers can invoke the workflow. The JSON payload structure (D) is required because the webhook expects the incoming HTTP POST body to be formatted as JSON so that SecureX orchestration can parse and map the data into the workflow's variables. The endpoint URL (E) is the publicly reachable HTTPS address generated by SecureX orchestration that external systems call to fire the trigger. Options A and C are not required: DNS zone configuration (A) is handled by Cisco's cloud infrastructure rather than the orchestration user, and a public IP address for the trigger (C) is unnecessary because SecureX orchestration exposes the webhook through a managed cloud endpoint rather than a dedicated public IP owned by the customer.

Answer

DNS zone configuration

Answer

Public IP address for the trigger

Question 11

Which THREE actions can be automated via the Cisco Secure Firewall integration in SecureX?

Accepted Answer

Update network objects. The Cisco Secure Firewall integration in SecureX exposes response and enrichment actions that operate on the firewall's configuration and operational data through its API. Option A (Update network objects) is correct because the integration can push changes to existing network object definitions, such as hosts, ranges, and subnets, without requiring manual GUI work. Option C (Clear connection logs) is correct because the integration supports clearing or purging connection event data on the managed firewall as a response action. Option D (Modify access control policies) is correct because the integration can adjust access control policy settings, such as enabling, disabling, or editing rules, through the firewall management API. Option B (Physical interface configuration) is not included because physical interface setup is a low-level device provisioning task typically done in the firewall management interface, not through the SecureX integration's response actions. Option E (Reset appliance to factory) is not included because factory reset is a destructive maintenance operation performed locally or through dedicated recovery procedures, not an automated SecureX integration action.

Answer

Physical interface configuration

Answer

Reset appliance to factory

Question 12

When managing a large-scale incident in SecureX, which THREE features assist in collaborative investigation?

Accepted Answer

Casebook sharing. Casebook sharing (A) is correct because SecureX Casebooks let analysts share investigation artifacts, notes, and evidence with other team members, enabling collaborative incident response across the organization. The incident timeline (B) is correct because it provides a chronological, shared view of events and actions taken during an incident, allowing multiple responders to correlate activity and coordinate their efforts. Snapshot capture (E) is correct because capturing a point-in-time snapshot of the investigation state preserves evidence and context that can be shared with other analysts for joint review. Global password reset (C) is not a SecureX collaborative investigation feature; it is a remediation action typically performed in identity management systems. Automated host re-imaging (D) is also a remediation/recovery action, not a SecureX capability for collaborative investigation.

Answer

Global password reset

Answer

Automated host re-imaging

Question 13

When defining a 'Decision' node in SecureX orchestration, which THREE types of comparison operators are commonly available?

Accepted Answer

Equals. In SecureX orchestration, a Decision node evaluates conditions using standard comparison operators, and the three commonly available types include Equals (A), which tests whether two values are identical, Not equals (B), which tests whether two values differ, and Greater than (E), which performs a numeric/ordered comparison to check if one value exceeds another. These operators map directly to the typical conditional logic used to branch workflows based on equality, inequality, and magnitude. Binary conversion (C) is not a comparison operator; it is a data-transformation operation, so it cannot be used to evaluate a Decision condition. Regex match (D) is a pattern-matching operation and, while useful in some automation contexts, is not one of the three commonly available comparison operator types in this SecureX Decision node context.

Answer

Binary conversion

Answer

Regex match

Question 14

A security engineer is designing a SOAR playbook in Cisco SecureX Orchestration to isolate a compromised virtual machine in AWS. The playbook must query Cisco Secure Endpoint (AMP for Endpoints) for file trajectory data before performing the isolation. Which activity node should be placed first to ensure the endpoint is correctly identified in the cloud environment?

Accepted Answer

Query the 'Get Computer' API endpoint using the hostname provided by the alert.. To isolate a compromised VM, the playbook must first identify the endpoint in Cisco Secure Endpoint by querying the 'Get Computer' API using the hostname from the alert. This retrieves the computer's unique identifier (connector GUID) needed for subsequent actions like file trajectory or isolation.

Answer

Fetch 'File Trajectory' data using the file hash.

Answer

Trigger a 'Snapshot' of the EBS volume.

Answer

Execute 'Isolate Host' from the AWS EC2 integration.

Answer

Invoke 'Update Security Group' to nullify all inbound traffic.

Question 15

You are configuring Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) to trigger an automated response when a suspicious S3 bucket access pattern is detected. Which integration method is best suited for executing a pre-defined playbook in response to this alert?

Accepted Answer

Utilize a Cisco SecureX Orchestration workflow triggered by a webhook from Secure Cloud Analytics.. Cisco SecureX Orchestration is the native SOAR component that can execute pre-defined playbooks and be triggered via webhook from Secure Cloud Analytics alerts. This integration allows automated response actions such as isolating endpoints, updating security groups, or enriching alerts, which is exactly what the question asks for.

Answer

Deploy a Cisco Firepower Management Center (FMC) to block the S3 IP range.

Answer

Enable the 'Auto-Block' checkbox in the Cloud Analytics Global Settings.

Answer

Directly configure the S3 bucket policy to deny all traffic.

Answer

Configure an AWS Lambda function directly in the Cloud Analytics console.

Question 16

In Cisco SecureX, which dashboard component allows a security analyst to view the real-time status of triggered automated workflows and their execution history?

Accepted Answer

The 'Orchestration' tab under the 'Orchestration' menu.. In Cisco SecureX, the Orchestration tab under the Orchestration menu is where analysts view workflow runs, their real-time execution status, and historical run logs. It shows each workflow's trigger, activity-by-activity progress, success/failure states, and output variables. This is the operational console for monitoring automated response playbooks, distinct from threat-intel or device-health views.

Answer

The 'Device Status' monitor.

Answer

The 'Threat Intelligence' summary view.

Answer

The 'Incident Manager' widget.

Answer

The 'Events' log in the Administration portal.

Question 17

You are integrating Cisco Umbrella with your incident response process. When a domain is flagged as malicious, you want to automatically add the domain to a 'Blocked' destination list. Which API or service should the SecureX Orchestration workflow utilize to achieve this?

Accepted Answer

Umbrella Enforcement API.. The Umbrella Enforcement API is used to add domains to a block list (destination list) for enforcement. It allows automated addition of malicious domains to block them. Thus, the SecureX Orchestration workflow should use the Umbrella Enforcement API.

Answer

Umbrella Management API.

Answer

Cisco Cloudlock API.

Answer

Umbrella Discovery API.

Answer

SecureX Threat Intelligence API.

Question 18

An analyst in Cisco SecureX Threat Response is investigating a suspicious file hash observed on an endpoint. The hash verdict shows as 'Unknown' and the analyst wants to pivot to a private, on-premises threat intelligence source that is already integrated via a Cisco Threat Intelligence API module. Which action should the analyst take in Threat Response to enrich the observable with that private source?

Accepted Answer

Open the observable's context menu and select 'Enrich with private sources' to query the integrated threat intelligence API module.. Threat Response enrichment is driven by the observable's context menu, where analysts can query integrated sources including private Threat Intelligence API modules. Because the hash is an observable within an investigation, invoking enrichment against the private source returns internal verdicts and sightings. Changing types, adding notes, or exporting manually all bypass the integration and fail to produce the desired intelligence.

Answer

Create a new investigation and add the hash manually as a text note, then wait for automatic enrichment.

Answer

Export the investigation as a PDF and submit it to the private source's support portal for manual lookup.

Answer

Edit the observable type from 'file hash' to 'domain' so the integrated module can parse it correctly.

Question 19

You need to ensure that an incident response playbook in Cisco SecureX automatically updates a case in the Casebook feature. Which action is required in the workflow design?

Accepted Answer

Add Observation to Casebook. In Cisco SecureX orchestration workflows, to have a playbook update a case in Casebook, the workflow must add an observation to the Casebook. Observations are the mechanism by which workflow outputs are attached to a Casebook case, enabling analysts to see enrichment results, IOCs, and notes within the case timeline. This is the specific action required for Casebook integration.

Answer

Post to Incident API

Answer

Update Evidence Store

Answer

Sync with Incident Management

Question 20

When designing a SOAR workflow, what is the best practice for handling errors in a network isolation script?

Accepted Answer

Implement an Error Catch block. The best practice for handling errors in a SOAR workflow script is to implement an Error Catch block, which gracefully handles exceptions, logs the failure, and allows the workflow to continue or take a remediation path. This prevents the entire workflow from failing silently and enables proper error reporting and recovery.

Answer

Set the workflow to loop on failure

Answer

Force terminate the workflow

Answer

Disable all notifications