A company is deploying a SIEM and must ingest logs from multiple cloud services, on-premises servers, and network devices. The compliance team requires that logs be searchable for at least one year. Which two considerations are most important when sizing the SIEM deployment?

Number of dashboards and report templates

Ingestion rate and storage capacity

Threat intelligence feed update frequency

During an incident, an analyst wants to understand the timeline of an attacker's actions across multiple systems. Which SIEM feature is most useful for reconstructing the sequence of events?

Threat intelligence feed lookup

Log normalization configuration

Time-based search and event timeline view

A SOC analyst is investigating an alert about a possible data exfiltration. The SIEM shows a large outbound transfer from an internal server to an external IP. The analyst needs to determine if the transfer was legitimate business activity or malicious. Which combination of SIEM features is most effective?

Increase the severity of the alert and move on to other tasks

Immediately block the external IP and close the investigation

Export the raw logs to a file and send them to management

Correlate the transfer with user activity logs, check threat intelligence for the external IP, and review the timeline of events

A security analyst is investigating a potential data exfiltration incident. Which data source would provide the most direct evidence of large data transfers leaving the network?

DNS logs showing domain resolutions

Windows Event Logs showing user logons

NetFlow records showing high-volume outbound connections

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 17

2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 2)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

30%of the exam

Questions 6–10

6application · medium
A company is deploying a SIEM and must ingest logs from multiple cloud services, on-premises servers, and network devices. The compliance team requires that logs be searchable for at least one year. Which two considerations are most important when sizing the SIEM deployment?
Select an answer first
7application · medium
A SOC manager wants to provide executives with a high-level view of security posture, including the number of critical alerts and their status over the last month. Which SIEM feature should be used?
Select an answer first
8application · medium
During an incident, an analyst wants to understand the timeline of an attacker's actions across multiple systems. Which SIEM feature is most useful for reconstructing the sequence of events?
Select an answer first
9expert · hard
A SOC analyst is investigating an alert about a possible data exfiltration. The SIEM shows a large outbound transfer from an internal server to an external IP. The analyst needs to determine if the transfer was legitimate business activity or malicious. Which combination of SIEM features is most effective?
Select an answer first
10application · medium
A security analyst is investigating a potential data exfiltration incident. Which data source would provide the most direct evidence of large data transfers leaving the network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 2)

Questions 6–10

A company is deploying a SIEM and must ingest logs from multiple cloud services, on-premises servers, and network devices. The compliance team requires that logs be searchable for at least one year. Which two considerations are most important when sizing the SIEM deployment?

A SOC manager wants to provide executives with a high-level view of security posture, including the number of critical alerts and their status over the last month. Which SIEM feature should be used?

During an incident, an analyst wants to understand the timeline of an attacker's actions across multiple systems. Which SIEM feature is most useful for reconstructing the sequence of events?

A security analyst is investigating a potential data exfiltration incident. Which data source would provide the most direct evidence of large data transfers leaving the network?

Keep studying — Techniques