6.6 Describe Network Visibility and Enforcement Using Telemetry and Native AI/ML Capabilities with XDR and SIEM/SOAR Platforms Such as Splunk and Cisco XDR 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does Cisco XDR use telemetry to enhance threat detection?

   • ABy relying solely on signature-based detection to identify known malware
   • BBy requiring all traffic to be routed through a central proxy for inspection
   • CBy collecting and correlating data from Cisco and third-party security products to provide a unified view of threats
   • DBy providing a manual process for analysts to review logs
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC uses Splunk as its SIEM and wants to automate the response to a specific type of alert: a user account being locked out multiple times. The SOC wants to automatically unlock the account if the lockouts are due to a known application issue, but escalate to a human if the lockouts appear malicious. Which approach best achieves this?

   • ACreate a SOAR playbook that checks the lockout source against a list of known application IPs and unlocks the account if it matches, otherwise escalates.
   • BAutomatically unlock all locked accounts without any analysis.
   • CManually review every lockout event and decide on a case-by-case basis.
   • DUse Splunk to create a dashboard that shows all lockout events for the SOC to review.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is evaluating security platforms and wants to ensure that when a threat is detected on an endpoint, the platform can automatically isolate the endpoint and also notify the SOC with context. Which platform capability is most aligned with this requirement?

   • AFirewall that blocks all traffic to and from the endpoint's IP.
   • BXDR platform that integrates with endpoint protection and SOAR for automated response.
   • CEndpoint agent that only records the threat and sends a log to the SIEM.
   • DSIEM that collects and indexes logs from the endpoint.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is planning to deploy a new SIEM. They have a mix of on-premises and cloud infrastructure, and they need to ensure that the SIEM can collect telemetry from all sources. They are considering using a combination of syslog, NetFlow, and API-based collectors. What is the primary advantage of this approach?

   • AIt simplifies the SIEM's data processing pipeline.
   • BIt ensures that all telemetry is collected in a consistent format.
   • CIt reduces the need for specialized security expertise.
   • DIt allows for comprehensive coverage of diverse telemetry sources.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses Cisco XDR and wants to enforce a policy that automatically blocks a user's access to a specific cloud application if the XDR detects a compromised credential. Which Cisco XDR integration would enable this enforcement?

   • AIntegration with the email gateway to block the user's email.
   • BIntegration with the firewall to block all traffic from the user's IP.
   • CIntegration with the cloud access security broker (CASB) to revoke the user's session.
   • DIntegration with the SIEM to log the detection event.
   Reveal Solution Discussion Select an answer first