300-215 Question 166
Select 3During an investigation of a suspected malware infection in your network, you need to identify the domain associated with malicious activity, track command-and-control (C2) communications, and determine the level of endpoint compromise. Which combination of Cisco security solutions would best help you achieve these objectives?
- A
Cisco Umbrella for domain reputation and blocking malicious domains
- B
Cisco Firepower for analyzing network traffic and detecting intrusion attempts
- C
Cisco Secure Endpoint for monitoring endpoint behavior and identifying malware
- D
Cisco Secure Network Analytics for monitoring network traffic flows and detecting anomalies
Show answer and explanation
Correct answers: A, C, D
Explanation
To investigate a suspected malware infection and its associated C2 communication, multiple Cisco security solutions can be leveraged. Cisco Umbrella provides domain reputation and C2 blocking capabilities, Cisco Secure Endpoint offers detailed endpoint monitoring and malware detection, and Cisco Secure Network Analytics enables network traffic monitoring to detect anomalies. Together, these tools provide comprehensive visibility and response capabilities for effective forensic analysis and incident response.
- A. Correct.
Cisco Umbrella provides threat intelligence on domain reputation and can block access to malicious domains, helping to identify and mitigate C2 communications.
- B. Incorrect.
While Cisco Firepower can analyze network traffic and detect intrusion attempts, it is not primarily focused on endpoint behavior or domain reputation, making it less relevant for this scenario.
- C. Correct.
Cisco Secure Endpoint excels in monitoring endpoint behavior, detecting malware, and providing forensic details about endpoint compromise.
- D. Correct.
Cisco Secure Network Analytics offers visibility into network traffic flows and helps detect anomalies, such as C2 communications, which is crucial for tracking malicious activity.