6.6 Describe Network Visibility and Enforcement Using Telemetry and Native AI/ML Capabilities with XDR and SIEM/SOAR Platforms Such as Splunk and Cisco XDR 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the core concept of Extended Detection and Response (XDR)?

   • AA single security tool that replaces all other security products
   • BA type of firewall that provides deep packet inspection
   • CA protocol for securely transmitting logs between devices
   • DA platform that collects and correlates data from multiple security layers to detect and respond to threats across the entire environment
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices that the XDR platform is flagging a legitimate internal application as malicious because it exhibits behavior similar to a known threat. The analyst wants to reduce these false positives without weakening detection of actual threats. What should they do?

   • AIgnore the alert and continue monitoring.
   • BAdd the application's hash to the allowlist in the XDR platform.
   • CIncrease the severity threshold for all alerts to reduce noise.
   • DDisable the ML-based detection model that flagged the application.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC uses Splunk as its SIEM. They want to detect a known attack pattern that involves multiple events across different data sources, such as a failed login followed by a successful login from a different country. Which Splunk feature should they use to create this detection?

   • AConfigure a lookup table that maps IP addresses to countries and use it in a simple search.
   • BEnable Splunk's built-in machine learning toolkit to automatically find anomalies.
   • CCreate a dashboard that displays login events from all sources for manual review.
   • DWrite a correlation search using SPL that joins events from authentication logs and geo-location data.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is evaluating an XDR platform that uses ML models to detect anomalies. They have a highly dynamic environment with frequent legitimate changes (e.g., new software deployments, changing user behavior). The ML model is generating false positives because it is not adapting quickly to these changes. What is the most effective way to address this while maintaining detection quality?

   • ADisable the ML-based detection and rely solely on signature-based detection.
   • BRetrain the ML model more frequently with recent telemetry data to adapt to the changing environment.
   • CManually review and approve all alerts before they are acted upon.
   • DIncrease the anomaly threshold to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has deployed Cisco XDR and wants to leverage its AI/ML capabilities to detect unknown malware that evades signature-based detection. Which Cisco XDR feature is most relevant for this task?

   • AThe malware analytics engine that uses static and dynamic analysis with ML models.
   • BThe SIEM integration that forwards all logs to an external SIEM for analysis.
   • CThe orchestration playbooks that automate response actions.
   • DThe built-in firewall rules that block known malicious IP addresses.
   Reveal Solution Discussion Select an answer first