6.6 Describe Network Visibility and Enforcement Using Telemetry and Native AI/ML Capabilities with XDR and SIEM/SOAR Platforms Such as Splunk and Cisco XDR 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does XDR enhance network visibility compared to traditional siloed security tools?

   • ABy increasing the volume of raw logs that need to be manually reviewed
   • BBy focusing only on network traffic and ignoring endpoint data
   • CBy isolating each security tool so that data is not shared between them
   • DBy providing a single pane of glass that correlates data from multiple sources to reveal the full attack chain
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to automatically block a compromised endpoint's network access as soon as the XDR platform detects malicious behavior. Which enforcement mechanism should they integrate with the XDR platform?

   • ASOAR playbook that triggers a network access control (NAC) policy change to quarantine the endpoint.
   • BSIEM alerting that sends an email to the SOC for manual action.
   • CEndpoint agent that only logs the malicious behavior without taking action.
   • DFirewall rule that blocks all traffic from the endpoint's IP address, configured manually.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How do native AI/ML capabilities improve incident response in a security platform?

   • ABy encrypting all sensitive data in transit
   • BBy providing prioritized alerts and recommended actions based on analysis of telemetry
   • CBy automatically generating and executing incident response playbooks without any human input
   • DBy replacing the need for SIEM platforms entirely
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) receives thousands of alerts daily from various security tools. The team wants to automate the initial investigation and response for common alerts while still allowing human review for complex incidents. Which platform capability should they implement?

   • ASOAR playbooks that trigger automated enrichment and containment actions for defined alert types.
   • BSIEM correlation rules that automatically close low-severity alerts.
   • CXDR platform that automatically blocks all suspicious endpoints without human review.
   • DManual runbooks that guide analysts through each alert type.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC uses Splunk as its SIEM and has a SOAR platform for automation. They want to reduce the time to respond to phishing emails that contain malicious links. The SOAR platform can automatically quarantine the email and block the URL, but the SOC wants to ensure that false positives are minimized. Which approach best balances automation and accuracy?

   • AManually review every email before any action is taken.
   • BAutomatically quarantine all emails that contain any URL, without human review.
   • CUse Splunk to enrich the email with threat intelligence and only trigger the SOAR playbook if the URL is confirmed malicious.
   • DBlock all URLs that are not on an internal allowlist.
   Reveal Solution Discussion Select an answer first