Which type of SIEM report is most useful for communicating security posture to executive management?

A high-level summary of key security metrics and trends

A detailed packet capture of all network traffic

A raw dump of all firewall logs for the past month

A list of all user passwords and hashes

Why is ongoing tuning of SIEM correlation rules important?

To increase the storage capacity of the SIEM

To reduce false positives and improve detection accuracy

To change the vendor of the SIEM

What is the primary purpose of a SIEM dashboard?

To store raw logs for long-term retention

To automatically remediate security incidents

To provide a visual summary of security events and trends for monitoring and communication

To normalize log formats from multiple sources

What is the primary purpose of a correlation rule in a SIEM?

To automatically patch vulnerabilities on affected systems

To normalize logs from different sources

To detect security incidents by combining events that match a defined pattern

To store logs in a compressed format

A SIEM integrates a free threat intelligence feed that lists known malicious IPs. The SOC notices that the feed is updated only once a day, and a recent attack used an IP that was added to the feed hours after the initial compromise. Which improvement would most effectively reduce the detection gap?

Manually review all alerts daily

Increase the correlation rule time window

Use a real-time threat intelligence feed with lower latency

Store more logs for longer periods

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 17

2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 8)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

8concepts

30%of the exam

Questions 36–40

36foundation · easy
Which type of SIEM report is most useful for communicating security posture to executive management?
Select an answer first
37foundation · easy
Why is ongoing tuning of SIEM correlation rules important?
Select an answer first
38foundation · easy
What is the primary purpose of a SIEM dashboard?
Select an answer first
39foundation · easy
What is the primary purpose of a correlation rule in a SIEM?
Select an answer first
40expert · hard
A SIEM integrates a free threat intelligence feed that lists known malicious IPs. The SOC notices that the feed is updated only once a day, and a recent attack used an IP that was added to the feed hours after the initial compromise. Which improvement would most effectively reduce the detection gap?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.