300-215 Question 219
Single answerAn organization has detected suspicious activity on one of its endpoints. The security team has already collected the relevant forensic artifacts from the endpoint. What is the next recommended step in the process of evaluating files and performing ad-hoc scans using Cisco Secure Endpoint?
- A
Upload the suspicious files to Threat Grid for behavioral analysis.
- B
Immediately quarantine all endpoints in the network.
- C
Delete the suspicious files to prevent further damage.
- D
Run a retrospective analysis using Secure Endpoint to identify related incidents.
Show answer and explanation
Correct answer: A
Explanation
The next step in evaluating files from endpoints and performing ad-hoc scans involves leveraging tools like Cisco Threat Grid to conduct in-depth behavioral analysis of suspicious files. This provides actionable insights into whether the file is malicious and informs the next steps in the incident response process. Quarantining, deleting files, or running retrospective analysis are not immediate priorities at this stage of investigation.
- A. Correct.
Uploading the suspicious files to Threat Grid allows you to analyze the file's behavior in a sandboxed environment, generating a detailed report on its malicious or benign nature. This is a key step in evaluating suspicious files.
- B. Incorrect.
Quarantining all endpoints without further analysis could disrupt the organization's operations unnecessarily. This step should only be taken if there is confirmed widespread compromise.
- C. Incorrect.
Deleting the suspicious files prematurely can destroy evidence needed for further investigation and forensic analysis, making it an incorrect action at this stage.
- D. Incorrect.
While retrospective analysis is important, it is not the next immediate step in evaluating a specific suspicious file. It is typically performed after initial analysis to understand the wider impact of the incident.