What is the primary advantage of using a network TAP over SPAN for packet capture?

A TAP can capture traffic from multiple VLANs simultaneously

A TAP provides a direct copy of the traffic without introducing switch CPU load

A TAP does not require a monitoring device

A TAP automatically encrypts the captured traffic

A company suspects that a malware infection on a laptop is executing malicious scripts and making unusual registry changes. The security team needs visibility into host-based activities to confirm the infection and understand the attack. Which technology should they use?

SPAN port on the laptop's switch port

Endpoint Detection and Response (EDR)

A security team is centralizing logs from multiple devices into a SIEM. They notice that some devices are sending logs with incorrect timestamps due to time zone misconfiguration. This is causing correlation errors in the SIEM. What should they do to ensure accurate correlation?

Manually adjust the timestamps in the SIEM for each device

Disable correlation rules that depend on timestamps

Use SNMP to collect timestamps from devices

Configure all devices to use NTP and set the correct time zone

Which type of threat is an NTA tool particularly well-suited to detect compared to traditional signature-based systems?

Zero-day attacks that exhibit anomalous behavior

Known malware with a published signature

What is the primary technique used by Network Traffic Analysis (NTA) tools to detect threats?

Blocking all traffic that does not match a predefined allowlist

Signature-based matching of known malware

Behavioral analytics and machine learning to identify anomalies

Manual review of all packets by security analysts

CiscoCertified Network Professional Security

Domain 2Objective 2

2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 6)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

25%of the exam

Questions 26–30

26foundation · medium
What is the primary advantage of using a network TAP over SPAN for packet capture?
Select an answer first
27application · medium
A company suspects that a malware infection on a laptop is executing malicious scripts and making unusual registry changes. The security team needs visibility into host-based activities to confirm the infection and understand the attack. Which technology should they use?
Select an answer first
28expert · hard
A security team is centralizing logs from multiple devices into a SIEM. They notice that some devices are sending logs with incorrect timestamps due to time zone misconfiguration. This is causing correlation errors in the SIEM. What should they do to ensure accurate correlation?
Select an answer first
29foundation · medium
Which type of threat is an NTA tool particularly well-suited to detect compared to traditional signature-based systems?
Select an answer first
30foundation · medium
What is the primary technique used by Network Traffic Analysis (NTA) tools to detect threats?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.