Discuss Cisco 350-201 Exam Topic 10 Question 111

Refer to the exhibit.

An engineer configured this SOAR solution workflow to identify account theft threats and privilege escalation, evaluate risk, and respond by resolving the threat. This solution is handling more threats than Security analysts have time to analyze. Without this analysis, the team cannot be proactive and anticipate attacks. Which action will accomplish this goal?

AExclude the step ''BAN malicious IP'' to allow analysts to conduct and track the remediation

BInclude a step ''Take a Snapshot'' to capture the endpoint state to contain the threat for analysis

CExclude the step ''Check for GeoIP location'' to allow analysts to analyze the location and the associated risk based on asset criticality

DInclude a step ''Reporting'' to alert the security department of threats identified by the SOAR reporting engine

Suggested Answer: A

Get Premium 350-201 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Arthur 10 months ago

Wow, I didn't realize how many threats they were handling!

Lasandra 10 months ago

I think "Take a Snapshot" is a smart move!

Shonda 11 months ago

"Reporting" is definitely needed for better visibility.

Carma 11 months ago

Not sure if "Check for GeoIP location" should be excluded.

Elly 11 months ago

Excluding "BAN malicious IP" seems risky.

Hana 11 months ago

I studied that excluding steps can sometimes lead to missing important context, so maybe "Check for GeoIP location" shouldn't be excluded.

Avery 11 months ago

I feel like "Reporting" could be crucial for alerting the team, but I'm not confident if it's the best choice here.

Colene 12 months ago

I remember a practice question where we had to prioritize threat analysis, and I think excluding certain steps might actually hinder that process.

Joesph 12 months ago

I'm not entirely sure, but I think including a "Take a Snapshot" step could help with analyzing the threat later on.

Afton 1 year ago

I'm feeling pretty confident about this one. The key is to remove any steps that are automating the threat response, so that the analysts can actually analyze the threats and anticipate future attacks. I think the "Exclude the step 'BAN malicious IP'" option is the best choice here.

Myra 1 year ago

Okay, I think I've got it. The goal is to make the security analysts more proactive, so we need to find a way to give them more visibility and control over the threat analysis process. I'm leaning towards the "Take a Snapshot" option, as that could help them better understand the threats.

Merlyn 1 year ago

Hmm, I'm a bit confused by the different options. I think I need to re-read the question and the exhibit carefully to make sure I understand the goal and the potential actions.

Melissa 1 year ago

This looks like a tricky question. I'm not sure if I fully understand the SOAR solution workflow, but I think the key is to find a way to allow the security analysts to analyze the threats more effectively.

Cisco 350-201 Exam - Topic 10 Question 111 Discussion