300-215 Question 35
Single answerDuring an incident response investigation, several Cisco cybersecurity tools are being utilized. What is the role of Cisco Secure Network Analytics (Stealthwatch) in this process?
- A
Detecting and analyzing anomalies in network traffic to identify potential threats
- B
Blocking malicious traffic at the network perimeter
- C
Providing endpoint visibility and malware detection
- D
Managing and orchestrating incident response workflows across multiple tools
Show answer and explanation
Correct answer: A
Explanation
Cisco Secure Network Analytics (Stealthwatch) plays a critical role in incident response by analyzing network traffic patterns and detecting anomalies that could indicate security incidents. It provides visibility into possible threats such as insider attacks, lateral movement, or data exfiltration, which are not easily detected through other means.
- A. Correct.
Cisco Secure Network Analytics (Stealthwatch) is designed to detect and analyze anomalies in network traffic, making it an essential tool for identifying threats such as lateral movement or reconnaissance within the network.
- B. Incorrect.
Blocking malicious traffic at the network perimeter is typically the role of a firewall or intrusion prevention system (e.g., Cisco Firepower), not Cisco Secure Network Analytics.
- C. Incorrect.
Providing endpoint visibility and malware detection is the role of Cisco Secure Endpoint (formerly AMP for Endpoints), not Secure Network Analytics.
- D. Incorrect.
Managing and orchestrating incident response workflows is a function of Cisco SecureX, which integrates various Cisco security tools to streamline incident response.