6.6 Describe Network Visibility and Enforcement Using Telemetry and Native AI/ML Capabilities with XDR and SIEM/SOAR Platforms Such as Splunk and Cisco XDR 350-701 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which feature is a key characteristic of Splunk as a SIEM platform?

   • AIt is primarily a network firewall with logging capabilities
   • BIt requires all data to be stored in a cloud environment
   • CIt uses a proprietary query language called SPL to search and analyze machine data
   • DIt only supports data from Cisco devices
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization wants to improve its detection of multi-stage attacks that span endpoints, email, and network traffic. They currently use separate tools for each domain and manually correlate alerts. Which approach best aligns with the XDR concept?

   • AAdd more network sensors to increase visibility into traffic patterns.
   • BDeploy a SIEM that collects logs from all sources and requires analysts to create correlation rules.
   • CUse a SOAR platform to orchestrate manual responses across the separate tools.
   • DImplement an XDR platform that ingests telemetry from endpoints, email, and network sensors and correlates them automatically.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's XDR platform has been generating a high volume of alerts from endpoint and network sensors. The security analysts are overwhelmed and missing critical threats. Which native AI/ML capability should the platform use to reduce alert fatigue while maintaining detection coverage?

   • ARoute all alerts to a SOAR playbook that automatically quarantines affected endpoints.
   • BEnable automated alert triage that uses ML models to prioritize alerts based on risk scoring.
   • CIncrease the sensitivity of all detection rules to catch more low-level anomalies.
   • DDisable all detection rules for low-prevalence malware families to reduce noise.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating an alert from an XDR platform that flagged a process on an endpoint as malicious. The process is a legitimate administrative tool that is widely used in the organization. The analyst wants to prevent future alerts for this tool while still allowing the XDR to detect if the tool is used maliciously. What is the best approach?

   • AIncrease the severity threshold for all alerts.
   • BAdd the process hash to the allowlist in the XDR platform.
   • CDisable the ML model that flagged the process.
   • DCreate a custom detection rule that only alerts when the tool is used in conjunction with other suspicious behavior.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   How does telemetry directly enable enforcement in a network security architecture?

   • ABy providing the data needed to make informed policy decisions and trigger automated responses
   • BBy authenticating users before they can access network resources
   • CBy encrypting all network traffic to prevent unauthorized access
   • DBy physically segmenting the network into isolated zones
   Reveal Solution Discussion Select an answer first