A SOC has implemented a rule that flags any user who accesses more than five file shares in a single hour. The rule generates many alerts, but most are false positives from legitimate users. The SOC wants to reduce false positives while still detecting potential lateral movement. Which adjustment is most effective?

Keep the rule as is and manually review all alerts

Disable the rule and rely on IOC matching

Increase the threshold to 20 file shares per hour

Refine the rule to require an additional anomaly, such as access from a new device or off-hours

A security analyst is reviewing a recent intrusion where the attacker used a previously unknown malware variant. The analyst checks the organization's IOC database but finds no matches. What is the primary limitation of IOCs that this situation illustrates?

IOCs are reactive and may not cover new or modified threats

IOCs generate too many false positives

IOCs require too much storage capacity

IOCs are too complex for most security teams to use

How are Indicators of Compromise (IOCs) typically used in threat detection?

By matching known malicious artifacts against system data

By correlating multiple unrelated events to find anomalies

By analyzing behavioral patterns to identify ongoing attacks

By predicting future attack paths based on attacker intent

A SOC manager is evaluating a new behavioral analytics tool that flags potential lateral movement. The tool generates a high number of alerts, and the team is overwhelmed. The manager wants to reduce alert volume without missing real attacks. Which approach best addresses this challenge?

Tune the tool's thresholds and correlate alerts with IOC matches

Add more analysts to review all alerts

Increase the alert thresholds to the maximum to reduce alerts

Disable the behavioral analytics tool and rely on IOC matching

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 6

3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 6)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

11concepts

30%of the exam

Questions 26–30

26expert · hard
A SOC has implemented a rule that flags any user who accesses more than five file shares in a single hour. The rule generates many alerts, but most are false positives from legitimate users. The SOC wants to reduce false positives while still detecting potential lateral movement. Which adjustment is most effective?
Select an answer first
27application · medium
A security analyst is reviewing a recent intrusion where the attacker used a previously unknown malware variant. The analyst checks the organization's IOC database but finds no matches. What is the primary limitation of IOCs that this situation illustrates?
Select an answer first
28foundation · easy
How are Indicators of Compromise (IOCs) typically used in threat detection?
Select an answer first
29expert · hard
A SOC manager is evaluating a new behavioral analytics tool that flags potential lateral movement. The tool generates a high number of alerts, and the team is overwhelmed. The manager wants to reduce alert volume without missing real attacks. Which approach best addresses this challenge?
Select an answer first
30foundation · easy
A detection system raises an alert when it observes a user account making multiple failed login attempts followed by a successful login and then an attempt to access a sensitive share. What type of detection is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 6)

Questions 26–30

A security analyst is reviewing a recent intrusion where the attacker used a previously unknown malware variant. The analyst checks the organization's IOC database but finds no matches. What is the primary limitation of IOCs that this situation illustrates?

How are Indicators of Compromise (IOCs) typically used in threat detection?

A SOC manager is evaluating a new behavioral analytics tool that flags potential lateral movement. The tool generates a high number of alerts, and the team is overwhelmed. The manager wants to reduce alert volume without missing real attacks. Which approach best addresses this challenge?

A detection system raises an alert when it observes a user account making multiple failed login attempts followed by a successful login and then an attempt to access a sensitive share. What type of detection is this?

Keep studying — Processes