A security team is evaluating an NTA tool that uses machine learning to detect anomalies. They have a mix of legacy protocols (e.g., SMBv1) and modern traffic. The NTA tool has been flagging normal SMBv1 traffic as anomalous because it is rare in the environment. The team wants to reduce false positives without losing detection of real threats. What should they do?

Tune the NTA tool to baseline the specific SMBv1 traffic patterns

Replace the NTA tool with a signature-based IDS

Increase the sensitivity of the NTA tool

Disable the NTA tool for SMBv1 traffic

A SOC wants to automate the response to phishing emails reported by users. The current process involves manually checking the email headers, querying threat intelligence, and blocking the sender if malicious. They want to reduce response time and ensure consistency. Which technology should they use?

NTA tool to detect the phishing email

SIEM correlation rule to block the sender

SOAR platform with a phishing response playbook

A company is deploying a SIEM and must comply with a regulation that requires retaining security logs for at least 12 months. They have limited storage budget and want to ensure that the SIEM can still query recent logs quickly. Which storage strategy should they implement?

Use tiered storage: fast storage for recent logs and cheaper cold storage for older logs

Store all logs in a single high-performance storage array

Use SNMP to collect logs instead of syslog

Reduce log retention to 6 months to save costs

A security analyst is investigating a slow data exfiltration that involves small amounts of data sent over long-lived connections. They have NetFlow data showing the flows, but they need to see the actual content to confirm if sensitive data is being leaked. They also need to minimize the performance impact on the production network. Which approach should they take?

Use NetFlow with increased sampling rate on all routers

Enable SPAN on the switch port of the suspected host and capture packets for analysis

Use SNMP to monitor interface traffic on the host's port

Deploy a TAP on the internet link and capture all traffic

A security team wants to detect insider threats and compromised accounts that exhibit unusual behavior, such as a user accessing servers at odd hours or transferring large amounts of data. They have flow data from NetFlow and want to use behavioral analytics to identify anomalies. Which technology should they deploy?

Network Traffic Analysis (NTA) tool

Traditional signature-based IDS

CiscoCertified Network Professional Security

Domain 2Objective 2

2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 4)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

25%of the exam

Questions 16–20

16expert · hard
A security team is evaluating an NTA tool that uses machine learning to detect anomalies. They have a mix of legacy protocols (e.g., SMBv1) and modern traffic. The NTA tool has been flagging normal SMBv1 traffic as anomalous because it is rare in the environment. The team wants to reduce false positives without losing detection of real threats. What should they do?
Select an answer first
17expert · hard
A SOC wants to automate the response to phishing emails reported by users. The current process involves manually checking the email headers, querying threat intelligence, and blocking the sender if malicious. They want to reduce response time and ensure consistency. Which technology should they use?
Select an answer first
18expert · hard
A company is deploying a SIEM and must comply with a regulation that requires retaining security logs for at least 12 months. They have limited storage budget and want to ensure that the SIEM can still query recent logs quickly. Which storage strategy should they implement?
Select an answer first
19expert · hard
A security analyst is investigating a slow data exfiltration that involves small amounts of data sent over long-lived connections. They have NetFlow data showing the flows, but they need to see the actual content to confirm if sensitive data is being leaked. They also need to minimize the performance impact on the production network. Which approach should they take?
Select an answer first
20application · medium
A security team wants to detect insider threats and compromised accounts that exhibit unusual behavior, such as a user accessing servers at odd hours or transferring large amounts of data. They have flow data from NetFlow and want to use behavioral analytics to identify anomalies. Which technology should they deploy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 4)

Questions 16–20

A company is deploying a SIEM and must comply with a regulation that requires retaining security logs for at least 12 months. They have limited storage budget and want to ensure that the SIEM can still query recent logs quickly. Which storage strategy should they implement?

Keep studying — Network Security