Integration (15%)

SNCF · 45 questions

• A hospital turns on Secure Malware Defense in the Management Center and attaches a file policy to its outbound internet rule. A brand-new executable arrives that no signature set has recorded, and the team expects it blocked once Cisco's cloud marks it malicious. Which component supplies the file disposition that the sensor enforces?
• A university must inspect files arriving over SMB and HTTP before delivery. Its rule says the Management Center must query the cloud for every file's disposition and cut the connection when the verdict is malicious. Which file policy configuration meets both conditions?
• A regional bank must keep its firewall event history for one year with every record stored inside its own data center, and investigators need the analytics dashboards that correlate events across devices. The team is deciding between on-premises and cloud logging in Security Analytics and Logging. Which Security Analytics and Logging option meets the residency and analytics requirements?
• The SOC at a regional healthcare provider wants Splunk to become the long-term home for FTD events. Analysts must search the previous 30 days of connection and intrusion records immediately after go-live, and new events must keep flowing automatically with no manual export step. Which Splunk integration design should the security lead implement for history and live events?
• A compliance team wants near-real-time firewall events in Splunk for its dashboards. The Management Center sits in a segment that allows only outbound connections, platform policy limits it to Cisco-supported components, and the feed must run continuously. Which Splunk integration method satisfies all three conditions?
• A European bank must keep a searchable archive of traffic and intrusion events inside the country, and its analysts already query an on-premises Splunk cluster located in the country every day. The Management Center local event store serves live triage, but the archive has to outlive it. Which event-logging design satisfies both requirements?
• A software reseller runs a two-week pilot that must record the malware disposition of every installer customers download over clear-text HTTP. Every transfer must finish, and every disposition must come from the cloud. Which file rule action meets the pilot requirements?
• A SOC lead wants the Secure Firewall Management Center to show that a file allowed last week turned malicious later, alongside that file's movement across network hosts and managed endpoints, all tied to firewall events. Which integration delivers those two views inside the Management Center?
• A file that passed inspection last week was identified as malicious by Secure Endpoint on Friday. The SOC wants the FMC to flag the original connection as malicious now and to list every host that already received the file, but the receiving laptops are unmanaged and cannot install any agent. Which Secure Endpoint integration should you configure in the FMC?
• A regional bank must label each eligible file inspected by its Secure Firewall as malicious, good, or unknown, and it wants each available verdict to come from Cisco's threat intelligence rather than a local guess. The sensor has an Internet-allowed management path but very little spare local disk. Which file policy configuration in Secure Firewall Management Center should the engineer enable?
• A global retailer wants its security operations team to watch Secure Firewall Management Center connection events, discovery events, and intrusion alerts in an existing Splunk index, with every event encrypted in transit and delivered as a single feed that AI-driven threat intelligence can triage. Which forwarding design should the team configure on the Management Center?
• Your on-premises Secure Firewall Management Center must feed a Splunk instance where analysts run dashboards from the Cisco Security Cloud app. Compliance requires encrypted transport end to end, the management center's own correlation alerts must be searchable, and dashboards must show parsed fields as soon as data lands. Which Splunk collection design meets all three requirements?
• A financial services SOC subscribes to a TAXII feed from its intelligence vendor and wants malicious infrastructure blocked on Secure Firewall Threat Defense within minutes of each feed update, with no access or intrusion policy edits after refreshes. Last quarter several IPS rules drifted out of date. Which Threat Defense configuration enforces blocked observables from the feed automatically?
• A health insurer found that a PDF allowed by its Secure Firewall policy was later judged malicious by Secure Endpoint. Some branch PCs run without a Secure Endpoint agent, and the incident lead needs every host that received the file plus when its verdict changed. Which file-analysis view in FMC should the analyst open to trace the spread?
• A logistics firm enables Secure Malware Defense in the Management Center to protect employee web and email traffic. Files must be checked against the cloud for a verdict, only files reported malicious may be blocked, and both HTTP downloads and SMTP attachments are in scope. Which file policy configuration should the engineer apply?
• A financial services SOC receives its industry group's threat intelligence feed every hour, but analysts still paste indicators into the FMC block list by hand. Security leadership wants traffic matching observables in that feed blocked automatically when those observables are encountered. Which Threat Intelligence Director configuration delivers that automation?
• A company's Secure Firewall Management Center must inspect PDF and PE files arriving on the web proxy segment and decide their disposition. Files larger than 20 MB are already rejected upstream, and the team needs candidates with no usable signature checked against cloud reputation rather than passed through silently. Which file policy configuration submits each candidate for cloud lookup and blocks files returned with a Malware disposition?
• A healthcare firm runs FTD at the perimeter and Secure Endpoint on 800 Windows laptops. Analysts need to see, from the Management Center, when a file the firewall judged malicious later shows up on a laptop, and to follow that file's journey across the network. Which integration provides both?
• A partner security team publishes command-and-control indicators as a STIX/TAXII feed that refreshes hourly, and every observable in it is an IPv4 address. Three FTD devices behind one Management Center must drop matching perimeter traffic with no manual list upkeep as the feed changes. Which Threat Intelligence Director setup meets the feed requirement?
• A manufacturer's Secure Firewall Management Center is integrated with Cisco Secure Endpoint. A signed installer passed the file policy on Monday, and on Wednesday Secure Endpoint flagged the same file as malicious on one workstation. The SOC lead wants every host that already received that file. Which capability in FMC answers that request?
• Three weeks after the gateway allowed a document, Secure Endpoint reports its hash as malicious on one workstation. With the Management Center integration in place, the responder must list every host the firewall has seen receive that same file this month. Which FMC capability should the responder open?
• Your SOC wants one place where a firewall connection event, a Snort alert, a Secure Endpoint detection and an Umbrella DNS request can appear on a single incident timeline for triage, while access-control policies stay under Management Center management. Which XDR integration design meets those needs?
• A SOC analyst is following a workstation that triggered a Command and Control alert in the Secure Firewall Management Center. The same workstation also produced a malware detection on Secure Endpoint and repeated suspicious lookups through Umbrella within the same hour, but each console shows only its own piece. Which Cisco capability should bring these three detections into one investigation?
• A security architect is documenting how pxGrid behaves when Secure Firewall Management Center consumes user and endpoint context from Cisco ISE. The notes must reflect that a controller coordinates topic access, that identity data originates in ISE, and that the Management Center must authenticate to the controller before it can subscribe. Which description of the pxGrid publisher and subscriber roles is accurate?
• A fintech team ingests two vendor intelligence feeds into the Secure Firewall Management Center using Threat Intelligence Director. The high-confidence feed arrives as a TAXII collection and its traffic must be blocked, the lower-confidence feed should only raise events, and nobody may retype the indicators by hand. Which Threat Intelligence Director action plan applies Monitor and Block correctly?
• A payment processor subscribes to a commercial threat feed delivering command-and-control indicators as STIX objects over TAXII, mostly IPv4 addresses. They want matching inbound connections dropped by Threat Defense each time the feed refreshes, without waiting for a signature update. Which Threat Intelligence Director setup blocks those connections automatically?
• A SOC monitors FTD devices at two sites and also collects alerts from the email gateway and endpoint agents, yet each tool shows only part of the attack. They want one investigation that links firewall events to endpoint, identity, and email data through shared indicators. Which platform provides that cross-domain correlation?
• A retail SOC keeps separate consoles for Secure Firewall Management Center alerts, endpoint detections and network flow records, so analysts stitch timelines by hand during incidents. Leadership wants firewall intrusion and file events joined with endpoint and flow telemetry into risk-ranked incidents that one analyst can triage. Which Cisco capability should the team enable to correlate firewall events with the other telemetry sources?
• A retail chain wants its access control rules on the Secure Firewall Management Center to allow people by name using live context from Cisco ISE, including Security Group Tags. ISE already owns the session directory, and the integration runs over pxGrid. Which publisher and subscriber roles should each product take so the Management Center receives that live identity context?
• A security team runs Secure Firewall Threat Defense at the edge, endpoint protection on servers, and a mail gateway, each on its own console, with no spare data engineers to build and maintain custom log parsers. They need a single incident that ties supported firewall alerts to endpoint and email findings, with response actions across all three domains. Which platform should the team use to correlate the firewall events with that other telemetry?
• A company runs 802.1X access with Cisco ISE, and a managed laptop in an open-plan office has just tripped an intrusion rule the security team judges as a real compromise. They want automatic containment at the access layer so the laptop loses useful network reach even if the user unplugs it and moves it to another desk jack, with a clean way to reverse the action later. Which Rapid Threat Containment response should the FMC issue?
• A customer with Cisco ISE deployed wants logged-in Active Directory user names to appear in FMC connection events and to work as conditions in access-control rules. The ISE pxGrid service is already enabled, and the team argues about which device takes which pxGrid role. Which statement correctly assigns the publisher, subscriber and controller roles in this design?
• A security operations team adds a STIX TAXII feed of command-and-control infrastructure to the Management Center. They want IP observables blocked on the managed devices, domain observables from the same feed monitored only, and one internal server address that appears in the feed treated as a false positive. Which Threat Intelligence Director configuration delivers those three behaviors?
• A bank's ISE deployment already maps users to identity groups, and the team wants Secure Firewall Management Center access rules to match on that identity instead of IP addresses. ISE already runs pxGrid with its controller enabled. Which pxGrid role assignment delivers the identity context to the Management Center?
• A regulated bank must keep firewall events inside its own data centers for many years, well past what the FMC database holds, and it wants Cisco's own analytics rather than another third-party platform. Which Security Analytics and Logging option meets those requirements?
• A retail SOC keeps seeing blocked outbound connections on its Secure Firewall Threat Defense and needs to know whether any workstation reached the command server before the block. Endpoint and identity alerts also arrive every day in separate consoles. Which Cisco XDR capability gives analysts one cross-telemetry investigation view?
• The security team wants access control rules in Secure Firewall Management Center to match on live Cisco ISE session context — the authenticated user, the device type, and the Security Group Tag — instead of static address objects. ISE 3.x is already in production. Which pxGrid publisher/subscriber design lets FMC consume that context as ISE publishes it?
• A hospital security team sees a correlation event showing a lab workstation talking to a known command-and-control address. The workstation holds a valid 802.1X session through Cisco ISE, and policy requires it to land in a quarantine VLAN where it can still reach the patch server. The response must fire from the event itself rather than from a timer. Which Rapid Threat Containment action should the team configure?
• Your campus SOC detects command-and-control traffic from a wireless endpoint in a residence hall, and your Secure Firewall Management Center (FMC) is ready for Rapid Threat Containment. The segment never crosses the Threat Defense appliance, containment must start automatically when the event is processed, and the endpoint's live network access must be cut. Which Rapid Threat Containment action meets all three requirements for this host?
• In a campus rollout, Cisco ISE holds live user sessions and security group tags while the Secure Firewall Management Center needs that context for its access rules. pxGrid brokers the exchange through a trusted controller. Which role does the Management Center take in this pxGrid exchange?
• A financial-services SOC sees a Snort event on an FTD sensor showing malware callbacks from a Windows laptop on an 802.1X-enabled floor network. Company policy says the laptop must be cut off at the access layer within seconds, wherever it is plugged in, and the site already runs Cisco ISE with pxGrid connected to the Secure Firewall Management Center. Which Rapid Threat Containment action isolates the endpoint?
• A security engineer needs Secure Firewall Management Center alerts and connection events to reach Splunk near real time, with decoded source, destination, application and user fields preserved for AI-driven correlation. Which Management Center output method best meets these needs?
• A workstation in the finance VLAN trips a Snort rule and the SOC wants its network access reduced within seconds. The team already runs Cisco ISE with authorization profiles for restricted access, and this workstation authenticates through 802.1X and MAB. Which Rapid Threat Containment action should the Management Center take to restrict the endpoint?
• A retail chain runs three Threat Defense devices in separate regions, and auditors must be able to search a full year of connection events even though each Management Center database is near capacity. Management has frozen spending on any new on-premises log servers. Which Security Analytics and Logging design keeps the full audit year searchable without new on-premises servers?
• A security lead must tell auditors where firewall event data physically sits for each Security Analytics and Logging flavor, the on-premises option or the SaaS option. Which statement about storage and analysis for these two options is correct?