A SOC is deploying a SIEM and must decide between a centralized architecture and a distributed architecture. The organization has offices in multiple countries with data residency requirements that mandate logs stay within each country. However, the SOC wants a single pane of glass for correlation. Which architecture best satisfies both constraints?

Deploy regional SIEM instances that retain data locally and forward only normalized, non-resident metadata to a central correlation engine

Deploy fully independent SIEMs in each country with no central correlation

Store all logs in the cloud and rely on the cloud provider's compliance certifications

Use a single centralized SIEM in one country and accept the data residency risk

A SIEM administrator is tuning the system to reduce false positives. The team has identified that a correlation rule fires on a pattern that also occurs during legitimate backup processes. Which action is the most appropriate tuning step?

Add a filter to exclude backup server IPs from the rule

Increase the rule's severity to force analyst review

Change the rule to only alert on weekends

A SOC uses a SIEM to detect command-and-control (C2) traffic. The team wants to reduce false positives by adding context about known malicious domains and IPs. Which SIEM feature should they enable?

Threat intelligence feed integration

A SIEM ingests logs from multiple vendors. Each vendor uses a different field name for the source IP address (e.g., src_ip, source_address, SRC). Correlation rules that reference a single field name are missing events. What is the most effective solution?

Use a dashboard that displays all field names side by side

Write separate correlation rules for each vendor's field name

Configure field aliasing or normalization mapping so all source IP fields map to a common field name

Ask vendors to standardize their log formats

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 17

2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 7)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

30%of the exam

Questions 31–35

31foundation · easy
Which data source provides information about network traffic flows and is commonly integrated with SIEM?
Select an answer first
32expert · hard
A SOC is deploying a SIEM and must decide between a centralized architecture and a distributed architecture. The organization has offices in multiple countries with data residency requirements that mandate logs stay within each country. However, the SOC wants a single pane of glass for correlation. Which architecture best satisfies both constraints?
Select an answer first
33expert · hard
A SIEM administrator is tuning the system to reduce false positives. The team has identified that a correlation rule fires on a pattern that also occurs during legitimate backup processes. Which action is the most appropriate tuning step?
Select an answer first
34application · medium
A SOC uses a SIEM to detect command-and-control (C2) traffic. The team wants to reduce false positives by adding context about known malicious domains and IPs. Which SIEM feature should they enable?
Select an answer first
35expert · hard
A SIEM ingests logs from multiple vendors. Each vendor uses a different field name for the source IP address (e.g., src_ip, source_address, SRC). Correlation rules that reference a single field name are missing events. What is the most effective solution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 7)

Questions 31–35

Which data source provides information about network traffic flows and is commonly integrated with SIEM?

A SIEM administrator is tuning the system to reduce false positives. The team has identified that a correlation rule fires on a pattern that also occurs during legitimate backup processes. Which action is the most appropriate tuning step?

A SOC uses a SIEM to detect command-and-control (C2) traffic. The team wants to reduce false positives by adding context about known malicious domains and IPs. Which SIEM feature should they enable?

A SIEM ingests logs from multiple vendors. Each vendor uses a different field name for the source IP address (e.g., src_ip, source_address, SRC). Correlation rules that reference a single field name are missing events. What is the most effective solution?

Keep studying — Techniques