The scenario describes a classic indicator of a pass-the-hash (PtH) attack. The attacker likely captured the NTLM hash of the administrator’s credentials when they logged in, then used that hash to authenticate from a different machine (the internal IP showing failed then successful attempts). Isolating the server isn’t the first priority if the attacker is already using hashes to move laterally. The correct immediate response is to break the attacker’s ability to use the stolen hashes by forcing password changes (which generates new hashes) and actively hunting for signs of lateral movement from the compromised credentials.

The question specifically addresses phishing emails with malicious links. URL Filtering leverages threat intelligence (like Talos) to rewrite and check URLs in emails in real-time against a database of known malicious sites. Outbreak Filtering acts as a ‘zero-hour’ defense, using global threat sensors to identify and block new, emerging phishing campaigns before traditional signatures are updated. The combination of these two features directly targets the stated threat. The other options are either too generic (anti-spam threshold), target different problems (SPF for spoofing, antivirus for attachments), or are ineffective (blocking based on a single word).

The ‘Investigate’ function in Cisco Threat Response is designed precisely for this purpose. It allows an analyst to take an observable (like an IP, domain, or hash) and instantly search for all instances of it across all integrated products (like ESA, WSA, AMP). This provides a unified view of where and how that threat indicator has appeared in your environment, which is essential for understanding the scope of an attack. Enrichment (option A) is about adding context to an observable (e.g., tagging it as malicious), not searching for its occurrences. Options C and D refer to specific devices or data sharing, not the cross-product investigation capability.

This approach balances business needs with security. A custom URL category allows for precise policy targeting. By allowing access but still applying Data Loss Prevention (DLP) and malware scanning, you enable the business function while maintaining critical security controls that prevent exfiltration of sensitive data or download of malware. Disabling HTTPS decryption (B) or bypassing all filters (C) removes security visibility and control, creating significant risk. Allowing unfiltered access for an IP range (D) is a major security violation and should never be done.

The filename ‘report.pdf.exe’ is a classic masquerading technique where a malicious executable tries to appear as a harmless document. AMP’s detection is likely correct. The immediate next step is not to punish the user or assume a false positive, but to investigate using AMP’s ‘trajectory’ feature. This will show where the file came from, what it did or tried to do on the system, and what other systems it may have communicated with, providing crucial context for containment and eradication. Option A is dangerous as it assumes the detection is wrong without investigation. Options B and D are potential later actions but are not the correct *next* step based on the alert.

While all options contribute to security, spear-phishing emails often contain unique, previously unseen malware or zero-day exploits that bypass traditional signature-based filters. The integration with Cisco Threat Grid (sandboxing) is specifically designed for this. It allows the ESA to send suspicious attachments and URLs to a dynamic analysis sandbox. The sandbox executes the file in a safe, instrumented environment to observe its behavior, detecting malicious intent that static analysis would miss. This is a critical defense against targeted, sophisticated attacks. IronPort Anti-Spam (A) and SenderBase (C) are more effective against bulk threats. AMP (B) is for known malware signatures.

This tests practical knowledge of SMA reporting tools. The Delivery Status report is an overview tool that answers ‘what happened to my mail?’ in aggregate or for a specific time range. The Tracking (or Message Tracking) report is an investigative tool that allows an administrator to search for a specific message (by sender, recipient, subject, etc.), see its detailed processing steps through the ESA, and take actions like releasing it from quarantine. Option A confuses the purpose, Option B incorrectly states Tracking is *used* to release (it’s used to *find* messages to release), and Option D is factually incorrect.

The Umbrella Roaming Client has specific enforcement modes to handle this exact threat. The ‘Locked’ or ‘Forced’ mode (terminology can vary) uses mechanisms at the operating system level to ensure that all DNS queries from the device are sent *only* to Umbrella’s resolvers, preventing local DNS configuration changes. This is a client-side enforcement. Option A is impractical to manage at scale. Option B (Always-on VPN) is a different architecture that adds complexity and may not be necessary solely for DNS security. Option C (Virtual Appliance) is for protecting fixed networks and resources, not roaming clients outside the corporate network.

This tests understanding of the CTIM data model, which is fundamental to Threat Response. A ‘Sighting’ is a core concept that links an observable (option D) to your environment. It provides the crucial evidence that a known-bad indicator (e.g., a malicious IP from a threat intelligence feed) was actually seen on your network at a specific time on a specific device. Without sightings, intelligence remains theoretical. Sightings are what make threat intelligence actionable for your organization. Option A describes a ‘Judgement’ or ‘Verdict’, option C describes a ‘Course of Action’, and option D describes an ‘Observable’.

The scenario describes a classic indicator of a pass-the-hash (PtH) attack. The attacker likely captured the NTLM hash of the administrator’s credentials when they logged in, then used that hash to authenticate from a different machine (the internal IP showing failed then successful attempts). Isolating the server isn’t the first priority if the attacker is already using hashes to move laterally. The correct immediate response is to break the attacker’s ability to use the stolen hashes by forcing password changes (which generates new hashes) and actively hunting for signs of lateral movement from the compromised credentials.0