300-215 Question 104
Select 4You are investigating a potential data breach and need to analyze DNS logs from Cisco Umbrella and endpoint logs from Cisco Secure Endpoint. You have been tasked with writing a Python script to identify instances where a suspicious domain (e.g., 'malicious-domain.com') has been accessed by endpoints within the last 24 hours. Which of the following script components are critical for achieving this task?
- A
Use the Cisco Umbrella API to fetch DNS logs and parse them for 'malicious-domain.com'.
- B
Write a function to authenticate and query Cisco Secure Endpoint for endpoint activity logs.
- C
Implement a loop to cross-reference DNS logs with endpoint activity timestamps.
- D
Manually download and inspect log files from both Cisco Umbrella and Cisco Secure Endpoint.
- E
Use a regular expression to search for 'malicious-domain.com' in the fetched logs.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To effectively identify suspicious activity related to 'malicious-domain.com', you need to automate the retrieval and analysis of logs using the APIs provided by Cisco Umbrella and Cisco Secure Endpoint. Additionally, using techniques like cross-referencing logs and searching with regular expressions ensures the investigation is thorough and precise. Manual inspection of logs is not practical for professional incident response workflows.
- A. Correct.
This is correct because utilizing the Cisco Umbrella API allows automated retrieval of DNS logs, which is crucial for analyzing access to 'malicious-domain.com'.
- B. Correct.
This is correct because querying Cisco Secure Endpoint for endpoint activity logs ensures that the investigation covers endpoint behavior in addition to DNS activity.
- C. Correct.
This is correct because cross-referencing logs is necessary to correlate DNS activity with specific endpoint actions, helping to identify which endpoints accessed the domain.
- D. Incorrect.
This is incorrect because manually downloading and inspecting log files is inefficient and not scalable for real-time analysis or large datasets.
- E. Correct.
This is correct because a regular expression can efficiently search for the specific domain ('malicious-domain.com') within the fetched logs.