Cisco
350-201 · Question #7
A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must the
Sign in or unlock 350-201 to reveal the answer and full explanation for question #7. The question stem and answer options stay visible for context.
Security Monitoring
Question
A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?
Options
- ACreate a rule triggered by 3 failed VPN connection attempts in an 8-hour period
- BCreate a rule triggered by 1 successful VPN connection from any nondestination country
- CCreate a rule triggered by multiple successful VPN connections from the destination countries
- DAnalyze the logs from all countries related to this user during the traveling period
Unlock 350-201 to see the answer
You've previewed enough free 350-201 questions. Unlock 350-201 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#VPN anomaly detection#behavioral rules#SOC analysis#user behavior