6.6 Describe Network Visibility and Enforcement Using Telemetry and Native AI/ML Capabilities with XDR and SIEM/SOAR Platforms Such as Splunk and Cisco XDR 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational company has deployed an XDR platform that collects telemetry from endpoints and network sensors. They also use a SIEM for compliance reporting and a SOAR for incident response. The XDR platform detects a potential data exfiltration from a server in a region with strict data residency laws. The company must ensure that any response actions do not violate these laws. What is the most appropriate action?

   • AUse the XDR platform to isolate the server and then manually review the incident with local legal counsel before any data transfer.
   • BAutomatically quarantine the server using the SOAR playbook, regardless of the data residency implications.
   • CCopy all relevant logs to the central SIEM in the US for analysis.
   • DDelete all telemetry from the server to avoid any data transfer.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary role of a SOAR platform in security operations?

   • ATo orchestrate and automate response actions based on security alerts
   • BTo provide a real-time map of network topology
   • CTo collect and store raw logs for compliance purposes
   • DTo replace the need for human security analysts
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What role does AI/ML play in Cisco XDR?

   • AIt encrypts all telemetry data in transit
   • BIt automates the correlation of telemetry to identify potential threats and reduce alert fatigue
   • CIt provides a graphical interface for configuring network devices
   • DIt replaces the need for security analysts entirely
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is an example of enforcement driven by AI/ML insights in a security platform?

   • AAutomatically blocking a user account that exhibits anomalous behavior consistent with a compromised credential
   • BProviding a dashboard for security analysts to review alerts
   • CGenerating a weekly report of all security events
   • DStoring logs in a centralized repository for forensic analysis
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations team needs to detect anomalous outbound data transfers from a critical application server. They have a SIEM that ingests NetFlow and firewall logs, but they lack visibility into the application-layer context. Which telemetry source should they add to best correlate the network traffic with the application behavior?

   • AUse SNMP polling on the server's interface counters to detect high traffic volumes.
   • BConfigure the SIEM to receive IPFIX records from the firewall, including application identification metadata.
   • CDeploy an agent on the server that sends process-level and file-system telemetry to the SIEM.
   • DEnable NetFlow v9 on the server's uplink switch to capture flow records with application tags.
   Reveal Solution Discussion Select an answer first