Authentic Cisco Certification Exam 350-701 Questions Answers

The event explicitly reports Audit mode and states that the malicious file was not quarantined, making B correct and C false. Audit mode records detections without applying the normal blocking or quarantine action. The telemetry also records the file as created and executed, identifies winword.exe as its parent, and shows outbound TCP and DNS activity to external infrastructure; therefore, D accurately summarizes the observed execution chain. Cisco explains that Secure Endpoint malware events can include information captured at execution time, including the file path and invoking application, in its file and malware event guidance. The retrospective verdict means a previously unknown file was later classified as malicious, not that signature updates were infrequent. Nothing in the exhibit indicates that winword.exe was allow-listed. Thus, B and D are supported directly by the evidence.

================

Explanation

Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also

known as posture, of all the endpoints that are connecting to a network for compliance with corporate security

policies.

A posture policy is a collection of posture requirements that are associated with one or more identity groups and

operating systems.

Posture-policy requirements can be set to mandatory, optional, or audit types in posture policies.

+ If a mandatory requirement fails, the user will be moved to Non-Compliant state

+ If an optional requirement fails, the user is allowed to skip the specified optional requirements and the user

is moved to Compliant state

This Qdid not clearly specify the type of posture policy requirement (mandatory or optional) is not met so the

user can be in Non-compliant or compliant state. But “noncompliant” is the best answer here.