ECSS modul 2

You work as analyst in a SOC that uses integrated SIEM, SOAR, and XDR for security operations. Which statement is correct?

    SOAR can receive alerts from both SIEM and XDR. X

    SOAR can receive alerts from SIEM only.

    SOAR can receive alerts from XDR only.

    SOAR cannot receive alerts from the SIEM or XDR.

Which statement is correct regarding XDR?

    XDR correlates but does not contextualize the ingested data from the sources.

    XDR can reduce false positives and deliver prioritized incidents based on potential risk and impact. X

    XDR displays only current attacks, without the history of past attacks and patterns

    XDR can directly execute SOAR playbooks for TDIR.

What does the "X" in XDR stand for?

    an extended automated response to threats

    an extended manual response to threats

    an extended orchestration capability of various security solutions

    an extended reach that covers all relevant control points including endpoints and networks X

/You work as a SOC analyst and you want to employ SOAR for phishing investigation and response in your organization after a user reported this type of attack. What is the most effective action you can take?

    Use a predefined playbook to triage, investigate, and respond to phishing email threats. X

    Create your own playbook to triage, investigate, and respond to phishing email threats.

    Manually inspect alerts and initiate actions, since automated action cannot be effective for this type of attack.

    Send the alerts to the SIEM, where you can perform more effective actions.


Which two options are key functions of SOAR? (Choose two.)

Gather and store events and logs from various sources.

Provide comprehensive endpoint protection.

Automate repetitive and time-consuming tasks. X

Orchestrate workflows to coordinate various security solutions. X

Microsegment the network to enhance security and optimize performance.


Which two security actions can you perform using SIEM? (Choose two.)

Display wireless users with failed login attempts for the last 6 hours from your branch offices. X

Execute a playbook to contain an endpoint with malicious software.

Query all endpoints in your environment to perform advanced threat hunting.

Detect spikes of traffic that are the result of a DDoS attack against your company's website. X

Block an attachment with malicious software in an email.


You are explaining the evolution of key SOC solutions to a younger colleague, which emerged in different periods to address specific challenges in the cybersecurity landscape. Which solution appeared the latest?

    EDR

    XDR X

    SIEM

    SOAR

    NDR

What are the behaviors and methods employed by adversaries during a cyberattack described as in the MITRE ATT&CK framework?

    User Behavior Analytics (UBA)

    User and Entity Behavior Analytics (UEBA)

    Tools, Technologies, and Procedures (TTPs)

    Tactics, Techniques, and Procedures (TTPs) X


You work as a SOC analyst and you regularly check the Security Posture dashboard in Splunk Enterprise Security to gain high-level insights into notable events and findings across all domains of your environment. Which three key indicators are present by default on the dashboard? (Choose three.)

Endpoint notables X

Identity notables X

Virus notables

Firewall notables

User notables

UBA notables X


Match each Cisco XDR response option with its description.

Pivot menus	Facilitate automation to investigate events, respond, and eliminate repetitive tasks
Playbooks	Provide immediate response actions via out-of-the-box automation in incident management
Workflows	Available from drop-down icons next to observables in various places in Cisco XDR

You work as a SOC analyst and you plan to refine your playbooks in Splunk SOAR based on the post-incident analysis to improve the coverage, response times, and overall effectiveness of your automation actions. You are not familiar with Python scripting, so how can you easily accomplish this task?

    Use Visual Basic to edit and refine the playbooks.

    Use Visual Studio Code (VS Code) to edit and refine the playbooks.

    Use the Visual Playbook editor to edit and refine the playbooks. X

    Use Notepad++ to edit and refine the playbooks.


You are working as a SOC manager and explaining the incident management process in Cisco XDR to a new colleague, who is a SOC analyst. While showing the Cisco XDR incidents page, you emphasize that new incidents are assigned a priority score and automatically enriched. How is the incident Priority score calculated in Cisco XDR?

    Detection Risk times MITRE TTP Financial Risk

    MITRE TTP Financial Risk times Asset Value

    Detection Risk times Source Severity

    Detection Risk times Asset Value X


You have recently installed Cisco XDR and you plan to integrate the solution with Cisco and third-party products in your environment. Which two licenses enable you to employ telemetry and response integrations with Cisco and third-party products? (Choose two.)

Cisco XDR Essentials

Cisco XDR Advantage X

Cisco XDR Full

Cisco XDR Premier X

Cisco XDR Premium


You are planning to integrate Splunk SOAR with your Splunk Enterprise platform so you can import data from Splunk SOAR and send data from your Splunk Enterprise instance to Splunk SOAR. Which two apps do you need to install and on which solution? (Choose two.)

Splunk App for SOAR Export on Splunk SOAR

Splunk App for Splunk Enterprise on Splunk SOAR

Splunk App for SOAR on Splunk Enterprise

Splunk App for SOAR Import on Splunk Enterprise X

Splunk App for SOAR Export on Splunk Enterprise X


You want to use Splunk SOAR for threat investigation and response for a specific event that indicates a threat. Where can you find the Guidance tab where you can view recommended playbooks or actions that you can take to investigate and contain the threat more thoroughly?

    In the opened case for the event in the Investigation page. X

    On the page that provides a list of playbooks

    On the sources page that provides a list of events

    On the apps page that lists the integrated products


You are a SOC analyst and you opened the Mission Control > Analyst queue in Splunk Security Enterprise to detect attacks related to compromised user credentials. You are aware that Splunk Security Enterprise uses event-based and finding-based detection, but which two statements are correct regarding these detection types? (Choose two.)

Event-based detections create findings using correlation searches to detect patterns, anomalies, and threats across your data. X

Event-based detections create finding groups using correlation searches to detect patterns, anomalies, and threats across your data.

Event-based detections search through existing findings and/or intermediate findings.

Finding-based detections create high-confidence finding groups based on entity, threat object, risk threshold, tactics, and techniques to isolate security threats. X

Finding-based detections create findings using correlation searches to detect patterns, anomalies, and threats across your data.


How does Splunk SOAR automate the collection and enrichment of data from various integrated sources?

    Using batch jobs

    Using scripts

    Using worklogs

    Using playbooks X


You work as a SOC analyst using integrated Splunk SIEM and Cisco XDR solutions. While inspecting a specific notable promoted by Cisco XDR in the Splunk Enterprise Security user interface, you want to take swift action on a threat object. How can you trigger automated response through Cisco XDR?

    Using scripts in Splunk Enterprise Security.

    Using the Cisco XDR ribbon extension in the browser while working in Cisco XDR.

    Using the Cisco XDR ribbon extension in the browser while working in Splunk Enterprise Security. X

    You cannot trigger automated actions from Splunk Enterprise Security through Cisco XDR.


You have found a new threat for a specific file hash announced on the Talos blog as an IOC and initiated an investigation in Cisco XDR to see whether it is present in your environment. When reviewing the details in the investigation results, you want to see which computers and users have interacted with this file. Which panel should you look at?

    Indicators

    Usernames and Computers X

    Assets and Observables

    Events

A new type of ransomware attack is targeting organizations like yours. While no users have reported infections yet, you know attackers can infiltrate networks and act undetected before encrypting files and notifying users. You want to create event-based detections with correlation searches that can help you uncover ransomware attacks. How can you access the page for a new event-based detection in Splunk Enterprise Security to create these detections?

    Using the Create new event-based detection button on the Mission Control page.

    Using the Create new event-based detection button on the Content management page. X

    Using the Create new content button on the Content management page.

    Using the Create new content button on the Analyst queue page.

Which two statements are correct regarding the Cisco AI Assistant in Cisco XDR? (Choose two.)

Cisco AI Assistant can recommend a series of responses to move toward the resolution of an incident. X

Cisco AI Assistant offers an interactive text-based prompt, allowing you to converse similarly to a chatbot. X

Cisco AI Assistant offers a voice prompt, allowing you to perform tasks through voice commands.

Cisco AI Assistant can completely replace the SOC analyst and perform all activities independently in Cisco XDR.

Cisco AI Assistant provides a summary of the incident along with key data points.



Compare the roles and benefits of Cisco XDR, Splunk SIEM, Splunk SOAR to enhance the SOC operations
57%
Describe the functionality of Cisco XDR, Splunk SIEM, and Splunk SOAR
71%
Discuss the purpose and core functions of Extended Detection and Response (XDR), Security Information and Event Management (SIEM), and Security Orchestration, Automation, and Response (SOAR)
100%