300-215 Question 100
Single answerYou are investigating a security incident where multiple devices show signs of unusual behavior. To streamline your forensic analysis, you decide to write a script that collects logs from Cisco Secure Endpoint and Cisco Umbrella, parses them for suspicious activities, and identifies connections to a known malicious domain. Which of the following code snippets would achieve this effectively?
- A
A Python script that uses Cisco Secure Endpoint API to fetch activity logs and filters for known malicious domains using a static list.
- B
A PowerShell script that retrieves data from Cisco Umbrella but does not parse it for malicious domain connections.
- C
A Bash script that integrates with Cisco Secure Endpoint and Cisco Umbrella APIs to fetch logs and checks for known malicious domains using a dynamically updated threat intelligence feed.
- D
A Python script that retrieves logs only from Cisco Secure Network Analytics and does not interact with Cisco Umbrella or other threat intelligence sources.
Show answer and explanation
Correct answer: C
Explanation
The correct answer is the Bash script because it integrates with both Cisco Secure Endpoint and Cisco Umbrella APIs, ensuring comprehensive log retrieval. It also dynamically checks for malicious domains using a threat intelligence feed, aligning with the requirements of the scenario. Other options either lack integration with all necessary tools or fail to parse and analyze the logs effectively.
- A. Incorrect.
This Python script partially fulfills the requirement of fetching logs and identifying malicious domains but is limited to Cisco Secure Endpoint and uses a static list, which is less efficient for dynamic threat analysis.
- B. Incorrect.
This PowerShell script retrieves data from Cisco Umbrella but lacks functionality for parsing the data or identifying malicious domain connections, failing to meet the scenario's requirements.
- C. Correct.
This Bash script effectively integrates with both Cisco Secure Endpoint and Cisco Umbrella APIs, fetches logs, and dynamically checks for malicious domains using an updated threat intelligence feed, making it the most suitable choice.
- D. Incorrect.
This Python script focuses solely on Cisco Secure Network Analytics and does not incorporate Cisco Umbrella or threat intelligence integration, which is a critical requirement in this scenario.