A security team is investigating a suspected data exfiltration where an internal host is sending large amounts of data to an external IP. They need to see the actual payload contents to determine if sensitive data is being transmitted. Which telemetry source should they use?

NetFlow records from the router

Full packet capture via SPAN or TAP

Syslog messages from the firewall

What is the purpose of an SNMP trap?

To store historical performance data

To encrypt all SNMP communication

To allow the device to proactively notify the manager of an event

To replace the need for polling

A large enterprise is deploying a SIEM to collect logs from 5,000 devices. They expect high log volume and need to retain logs for 12 months for compliance. They also want to ensure the SIEM remains responsive during peak traffic. Which deployment consideration is most critical to address?

Scalable log ingestion and storage architecture

Deploying a single SIEM instance without redundancy

Using SNMP for all log collection

Disabling syslog on all devices to reduce noise

A SOC uses a SIEM with a threat intelligence feed that includes IP addresses, domains, and file hashes. They are experiencing a high number of false positives because the feed includes many IPs that are shared hosting or CDN addresses. The SOC wants to reduce false positives while still detecting real threats. Which approach should they take?

Increase the SIEM correlation time window

Disable the threat intelligence feed and rely on signature-based IDS

Correlate threat intelligence matches with additional context, such as NetFlow data and endpoint alerts

Remove all IP-based indicators from the feed

CiscoCertified Network Professional Security

Domain 2Objective 2

2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 7)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

25%of the exam

Questions 31–35

31application · medium
A security team is investigating a suspected data exfiltration where an internal host is sending large amounts of data to an external IP. They need to see the actual payload contents to determine if sensitive data is being transmitted. Which telemetry source should they use?
Select an answer first
32foundation · medium
What is the purpose of an SNMP trap?
Select an answer first
33expert · hard
A large enterprise is deploying a SIEM to collect logs from 5,000 devices. They expect high log volume and need to retain logs for 12 months for compliance. They also want to ensure the SIEM remains responsive during peak traffic. Which deployment consideration is most critical to address?
Select an answer first
34expert · hard
A SOC uses a SIEM with a threat intelligence feed that includes IP addresses, domains, and file hashes. They are experiencing a high number of false positives because the feed includes many IPs that are shared hosting or CDN addresses. The SOC wants to reduce false positives while still detecting real threats. Which approach should they take?
Select an answer first
35foundation · medium
Which syslog component identifies the type of message being sent, such as authentication or kernel events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 7)

Questions 31–35

A security team is investigating a suspected data exfiltration where an internal host is sending large amounts of data to an external IP. They need to see the actual payload contents to determine if sensitive data is being transmitted. Which telemetry source should they use?

What is the purpose of an SNMP trap?

A large enterprise is deploying a SIEM to collect logs from 5,000 devices. They expect high log volume and need to retain logs for 12 months for compliance. They also want to ensure the SIEM remains responsive during peak traffic. Which deployment consideration is most critical to address?

Which syslog component identifies the type of message being sent, such as authentication or kernel events?

Keep studying — Network Security