A security analyst notices that an intrusion detection system is generating an excessive number of alerts for a legitimate application that uses non-standard ports. Which action best aligns with the concept of tuning device rules?

Adjust the rule set to whitelist the application's known traffic patterns

Increase the alert severity for all rules matching the application

Disable the application's traffic from being inspected

Change the application to use standard ports

Why is it important to periodically review and retire outdated security rules?

To ensure the device has the latest firmware

To comply with vendor licensing agreements

To reduce the attack surface and improve rule effectiveness

To increase the number of alerts generated by the system

A security analyst is reviewing the firewall rule base and finds that a rule allowing inbound RDP from the internet to a specific server has not been hit in 90 days. The server is still in use but is accessed only via a jump host. The analyst wants to maintain a clean and effective rule base. What should the analyst do?

Modify the rule to allow RDP from a broader IP range to increase flexibility.

Delete the rule immediately to reduce the attack surface.

Disable the rule and monitor for any legitimate traffic that might be blocked.

Keep the rule because it might be needed in the future.

A healthcare organization is updating its security policies to comply with new data protection regulations. The new policy requires that all access to patient records be logged and monitored. The current network access control (NAC) solution does not log access to specific applications. What should the security team do to meet the new policy requirement?

Create a new firewall rule to log all traffic to the patient record server's IP address.

Deploy an application-level logging solution that captures access to patient record systems.

Rely on the existing NAC logs, even though they do not capture application-level access.

Update the NAC policy to block all access to patient records.

Which source of feedback is most relevant for adjusting security rules and filters?

Monitoring alerts and incident reports

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 15

2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 1)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

30%of the exam

Questions 1–5

1foundation · easy
A security analyst notices that an intrusion detection system is generating an excessive number of alerts for a legitimate application that uses non-standard ports. Which action best aligns with the concept of tuning device rules?
Select an answer first
2foundation · easy
Why is it important to periodically review and retire outdated security rules?
Select an answer first
3application · medium
A security analyst is reviewing the firewall rule base and finds that a rule allowing inbound RDP from the internet to a specific server has not been hit in 90 days. The server is still in use but is accessed only via a jump host. The analyst wants to maintain a clean and effective rule base. What should the analyst do?
Select an answer first
4application · medium
A healthcare organization is updating its security policies to comply with new data protection regulations. The new policy requires that all access to patient records be logged and monitored. The current network access control (NAC) solution does not log access to specific applications. What should the security team do to meet the new policy requirement?
Select an answer first
5foundation · easy
Which source of feedback is most relevant for adjusting security rules and filters?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 1)

Questions 1–5

A security analyst notices that an intrusion detection system is generating an excessive number of alerts for a legitimate application that uses non-standard ports. Which action best aligns with the concept of tuning device rules?

Why is it important to periodically review and retire outdated security rules?

Which source of feedback is most relevant for adjusting security rules and filters?

Keep studying — Techniques