In Cisco Secure Access Investigate, an analyst reviews a domain contacted by one workstation. The domain was registered three days ago and carries a high risk score, but it has no security category assigned yet. What is the most appropriate interpretation?
Select an answer to reveal the explanation.
Short Explanation
A brand-new domain with a bad risk score is like a stranger who showed up yesterday and already has a rap sheet. You don't wait for an official label before locking the door. The trap is thinking "no category yet" means "nothing known yet"; the score is the warning.
Full Explanation
The Investigate risk score is a predictive measure that combines many signals about a domain, such as lexical features, registration data, DNS behavior and its relationships to known threats. A high score means the domain looks like infrastructure that attackers use, and it is often available before a security category has been assigned, because categories are applied once there is enough evidence or confirmation. A domain registered only days ago that already scores high is a strong combination, since attackers routinely stand up fresh domains for short campaigns. The sensible response is to block it and examine the workstation that resolved it for signs of infection. Dismissing the score because no category exists ignores the reason a predictive score exists. Claiming that new domains always score high is false; many new domains are low risk, and youth is only one input. Allow-listing a suspicious domain to wait for a content category confuses what a site is about with whether it is safe. Exam caveat: Investigate scores support decisions; confirm with other indicators such as co-occurrences, WHOIS and DNS history rather than treating any single value as proof. Operational check: add the domain to a block destination list, then review that workstation's DNS and endpoint activity for related indicators.