How does SNMP primarily collect performance metrics from network devices?

By capturing packets on the wire

By receiving flow records from the device

By polling the device's MIB variables at regular intervals

A network administrator is monitoring a critical router that occasionally experiences high CPU usage. They want to receive immediate notification when CPU usage exceeds 90% and also have a history of CPU usage for capacity planning. Which approach should they use?

Capture packets on the router's management interface

Configure SNMP polling for CPU metrics and set a threshold to trigger a trap

Use syslog to send CPU usage logs

Enable NetFlow on the router to monitor CPU usage

A SOC receives thousands of alerts daily from its SIEM, many of which are false positives. The team wants to automate the initial triage of alerts and automatically block malicious IPs on the firewall when a confirmed threat is detected. Which technology should they implement?

Security Orchestration, Automation, and Response (SOAR)

Network Traffic Analysis (NTA) tool

What type of telemetry does an Endpoint Detection and Response (EDR) solution primarily collect?

Syslog messages from routers and switches

Host-based activities such as process execution, file changes, and registry modifications

Flow records from network devices

What is the primary purpose of a threat intelligence feed in a security monitoring environment?

To automatically patch vulnerabilities in network devices

To provide a backup of network configuration files

To provide indicators of compromise (IOCs) and contextual information to enhance detection

To replace the need for a SIEM system

CiscoCertified Network Professional Security

Domain 2Objective 2

2.2 Describe Security Monitoring and Telemetry Technologies 350-701 Practice Questions (Page 8)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

12concepts

25%of the exam

Questions 36–40

36foundation · medium
How does SNMP primarily collect performance metrics from network devices?
Select an answer first
37expert · hard
A network administrator is monitoring a critical router that occasionally experiences high CPU usage. They want to receive immediate notification when CPU usage exceeds 90% and also have a history of CPU usage for capacity planning. Which approach should they use?
Select an answer first
38application · medium
A SOC receives thousands of alerts daily from its SIEM, many of which are false positives. The team wants to automate the initial triage of alerts and automatically block malicious IPs on the firewall when a confirmed threat is detected. Which technology should they implement?
Select an answer first
39foundation · medium
What type of telemetry does an Endpoint Detection and Response (EDR) solution primarily collect?
Select an answer first
40foundation · medium
What is the primary purpose of a threat intelligence feed in a security monitoring environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.