A SOC manager wants to reduce alert fatigue by prioritizing alerts that are more likely to be true positives. The SIEM currently generates hundreds of alerts daily. The manager has access to threat intelligence, asset criticality data, and historical alert resolution data. What approach would best improve alert prioritization?

Disable all alerts except those from critical assets

Increase the SIEM's correlation rules to generate more alerts for better coverage

Manually review all alerts and create a spreadsheet of true positives

Build a scoring model that combines threat intelligence, asset criticality, and historical false-positive rates to rank alerts

A SOC analyst is investigating an alert about a suspicious outbound connection from a workstation. The raw log only contains the destination IP address. The analyst wants to determine if the IP is associated with known malware. Which action best supports the investigation?

Enrich the IP address with threat intelligence feeds that provide reputation and malware associations.

Search the SIEM for other logs from the same workstation.

Correlate the destination IP with the workstation's user identity and asset inventory.

Normalize the log to a common format and store it in the SIEM.

An organization's SIEM receives alerts from the EDR, firewall, and DNS logs. An analyst wants to detect a potential command-and-control (C2) beacon by identifying a single internal host that repeatedly contacts the same external IP at regular intervals. Which data sources are essential for this correlation?

EDR alerts and firewall logs only

Firewall logs and DNS logs only

EDR alerts, firewall logs, and DNS logs

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 16

2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 3)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

30%of the exam

Questions 11–15

11expert · hard
A SOC manager wants to reduce alert fatigue by prioritizing alerts that are more likely to be true positives. The SIEM currently generates hundreds of alerts daily. The manager has access to threat intelligence, asset criticality data, and historical alert resolution data. What approach would best improve alert prioritization?
Select an answer first
12application · medium
A SOC analyst is investigating an alert about a suspicious outbound connection from a workstation. The raw log only contains the destination IP address. The analyst wants to determine if the IP is associated with known malware. Which action best supports the investigation?
Select an answer first
13application · medium
An organization's SIEM receives alerts from the EDR, firewall, and DNS logs. An analyst wants to detect a potential command-and-control (C2) beacon by identifying a single internal host that repeatedly contacts the same external IP at regular intervals. Which data sources are essential for this correlation?
Select an answer first
14foundation · easy
Which data collection method is best suited for capturing the full content of network traffic, including payloads, for a forensic investigation?
Select an answer first
15foundation · easy
A security team stores logs that contain personal data of EU citizens. Which regulation is most likely to impose requirements on how this data is stored and processed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 3)

Questions 11–15

A SOC analyst is investigating an alert about a suspicious outbound connection from a workstation. The raw log only contains the destination IP address. The analyst wants to determine if the IP is associated with known malware. Which action best supports the investigation?

Which data collection method is best suited for capturing the full content of network traffic, including payloads, for a forensic investigation?

A security team stores logs that contain personal data of EU citizens. Which regulation is most likely to impose requirements on how this data is stored and processed?

Keep studying — Techniques