A security team needs to collect logs from a cloud-based SaaS application that does not support syslog or agent installation. The team wants to ingest the logs into their on-premises SIEM. Which collection method should they use?

Configure the SaaS application to send SNMP traps.

Use the SaaS application's REST API to pull logs periodically.

Deploy a network TAP in front of the SaaS application.

Use NetFlow to collect flow data from the SaaS application.

A large enterprise needs to collect security data from cloud-based SaaS applications (e.g., Office 365, Salesforce) and on-premises servers. The cloud applications do not support syslog, and the on-premises servers are in a segmented network. The security team wants a unified collection method that works for both environments with minimal infrastructure changes. What should they do?

Configure syslog forwarding from the cloud applications and use packet capture on the on-premises network

Use the cloud applications' APIs to pull logs and deploy agents on the on-premises servers to forward logs to the SIEM

Set up a VPN to the cloud and use NetFlow to collect all traffic

Use SNMP traps from both cloud applications and on-premises servers

A security team needs to collect full packet captures for a critical application for 30 days to support forensic investigations. The application generates high traffic volumes. Which collection method is most appropriate?

Use NetFlow to collect flow records.

Deploy a network TAP and capture packets to a dedicated storage system.

Install an agent on the application servers to collect process logs.

Enable syslog on the application servers.

A security team is investigating a possible data breach. They need to determine if any sensitive data was transferred to an external destination. The team has access to firewall logs, proxy logs, and data loss prevention (DLP) alerts. Which combination of data sources would provide the most complete evidence?

Use only DLP alerts to identify the data that was transferred

Enable NetFlow on the firewall to capture flow data

Correlate proxy logs with DLP alerts to identify the external destination and the data that was transferred

Use only firewall logs to see all outbound connections

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 16

2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 9)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

30%of the exam

Questions 41–45

41foundation · easy
Which stage of the security data lifecycle involves removing data that is no longer needed?
Select an answer first
42expert · hard
A security team needs to collect logs from a cloud-based SaaS application that does not support syslog or agent installation. The team wants to ingest the logs into their on-premises SIEM. Which collection method should they use?
Select an answer first
43expert · hard
A large enterprise needs to collect security data from cloud-based SaaS applications (e.g., Office 365, Salesforce) and on-premises servers. The cloud applications do not support syslog, and the on-premises servers are in a segmented network. The security team wants a unified collection method that works for both environments with minimal infrastructure changes. What should they do?
Select an answer first
44application · medium
A security team needs to collect full packet captures for a critical application for 30 days to support forensic investigations. The application generates high traffic volumes. Which collection method is most appropriate?
Select an answer first
45expert · hard
A security team is investigating a possible data breach. They need to determine if any sensitive data was transferred to an external destination. The team has access to firewall logs, proxy logs, and data loss prevention (DLP) alerts. Which combination of data sources would provide the most complete evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 9)

Questions 41–45

Which stage of the security data lifecycle involves removing data that is no longer needed?

A security team needs to collect logs from a cloud-based SaaS application that does not support syslog or agent installation. The team wants to ingest the logs into their on-premises SIEM. Which collection method should they use?

A security team needs to collect full packet captures for a critical application for 30 days to support forensic investigations. The application generates high traffic volumes. Which collection method is most appropriate?

Keep studying — Techniques