2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   What is the primary function of a SIEM system?

   • ATo replace the need for endpoint detection and response tools
   • BTo block malicious traffic in real time at the firewall
   • CTo aggregate and correlate security telemetry from multiple sources to detect incidents
   • DTo provide a backup of all network traffic
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is troubleshooting a suspected brute-force attack on a VPN concentrator. The concentrator logs authentication failures locally, but the analyst wants to search across multiple devices and correlate with other events. The company has a centralized logging platform that accepts syslog. What should the analyst configure on the VPN concentrator?

   • AConfigure NetFlow export to the log collector
   • BSet up a SPAN port to mirror the VPN traffic
   • CEnable SNMP traps for authentication failures
   • DEnable syslog forwarding to the central log collector
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network team needs to identify which internal hosts are communicating with a known command-and-control server. They have access to the perimeter firewall logs and a SIEM, but the firewall does not log every connection attempt. They need a lightweight, scalable way to see flow-level conversations across the core network without capturing full packets. Which telemetry source should they enable on the core switches?

   • ASNMP polling of interface counters
   • BSyslog forwarding of interface up/down events
   • CNetFlow export to the SIEM
   • DFull packet capture on every core switch port
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   Why is data retention an important consideration in a monitoring deployment?

   • ATo eliminate the need for backups
   • BTo increase the speed of the network
   • CTo reduce the need for real-time monitoring
   • DTo ensure logs and telemetry are available for forensic analysis after an incident
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations center (SOC) wants to enhance its detection capabilities by incorporating known malicious IP addresses, domains, and file hashes from external sources into its monitoring tools. The goal is to automatically alert when any of these indicators are observed in network traffic or logs. What should the SOC implement?

   • ADeploy SNMP traps on all devices
   • BConfigure syslog to forward all logs to a file server
   • CEnable NetFlow on all routers
   • DIntegrate threat intelligence feeds into the SIEM
   Reveal Solution Discussion Select an answer first