A SIEM receives logs from a custom application that records timestamps in a non-standard format. The security team notices that correlation rules that depend on event time are not working correctly. What is the most likely cause?

The log source is not sending enough data

The SIEM's storage capacity is insufficient

The timestamp field is not being parsed and normalized into the SIEM's standard time format

The correlation rules are too complex and need to be simplified

A SIEM correlation rule is designed to detect a brute-force attack by counting failed logins from a single source IP. The rule is not firing even though the attack is occurring. Which of the following is the most likely cause?

The threat intelligence feed is outdated

The log retention period is too short

The log source is not sending authentication events to the SIEM

The dashboard is not configured to show the alerts

What is the purpose of log normalization in a SIEM?

To compress logs to reduce storage costs

To encrypt logs during transmission

To delete duplicate log entries

To convert disparate log formats into a common schema for consistent analysis

Which function is a core capability of a SIEM tool?

Encrypting data at rest on endpoint devices

Correlating events from multiple sources to identify potential security incidents

Managing user identities and access privileges

Blocking malicious traffic at the network perimeter

A SOC wants to prioritize alerts based on the reputation of external IPs involved. Which SIEM capability should be configured?

Log normalization for IP fields

Threat intelligence enrichment on IP fields

Dashboard creation for IP addresses

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 17

2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 5)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

30%of the exam

Questions 21–25

21application · medium
A SIEM receives logs from a custom application that records timestamps in a non-standard format. The security team notices that correlation rules that depend on event time are not working correctly. What is the most likely cause?
Select an answer first
22application · medium
A SIEM correlation rule is designed to detect a brute-force attack by counting failed logins from a single source IP. The rule is not firing even though the attack is occurring. Which of the following is the most likely cause?
Select an answer first
23foundation · easy
What is the purpose of log normalization in a SIEM?
Select an answer first
24foundation · easy
Which function is a core capability of a SIEM tool?
Select an answer first
25application · medium
A SOC wants to prioritize alerts based on the reputation of external IPs involved. Which SIEM capability should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.