CCNP Security 300-710 SNCF Practice Test 23

Correct Answer: Connection events
Explanation: Connection events record per-connection details including source/destination, application, and the matching rule, which is distinct from health events (device health), correlation events (aggregated policy-driven responses), audit log events (administrative actions), malware events alone, or discovery events alone.

Correct Answer: Discovery events
Explanation: Discovery events specifically record changes in discovered network data, such as new hosts or applications, unlike connection events, health events, audit log events, platform settings change events, or NAT translation events, none of which are discovery-specific.

Correct Answer: The matched access control rule (rule name/ID) field
Explanation: The matched access control rule field identifies which rule handled the connection, which is distinct from an administrator's login timestamp, device uptime, the interface color theme, browser tab count, or a building floor number field, none of which exist as meaningful connection event data.

Correct Answer: Identifying a newly discovered application on a host that was not previously observed, which could indicate unauthorized or unexpected software installation
Explanation: Reviewing discovery events for newly observed applications helps flag potential unauthorized software, which is unrelated to employee desk locations, stock price, cafeteria menus, elevator maintenance schedules, or parking garage occupancy.

Correct Answer: Filtering connection events by the specific source or destination IP address of the suspected host
Explanation: Filtering connection events by the suspected host's IP address is the relevant approach for a targeted investigation, which is unrelated to screen resolution, moon phase, HVAC operating mode, guest Wi-Fi password, or a cafeteria menu item.

Correct Answer: The connection event typically references or correlates with the associated intrusion event that triggered the block, providing a fuller picture of why the connection was denied
Explanation: A connection blocked by an intrusion rule typically correlates with its associated intrusion event for fuller context, unlike the false claims that the two are stored on unrelated devices with no cross-reference, that intrusion events fully replace connection events, that connection events are deleted when an intrusion event fires, that the two can never be viewed together, or that connection events don't exist for blocked traffic.

Correct Answer: Comparing the newly discovered host's attributes (such as OS fingerprint, MAC vendor, and observed applications) against expected inventory and change records
Explanation: Comparing discovered host attributes against expected inventory and change records helps assess legitimacy, unlike assuming automatic authorization or automatic maliciousness with no review, or checking unrelated sources like a cafeteria menu, fire evacuation map, or parking occupancy.

Correct Answer: Trends in application usage, top talkers, and traffic volume over time can inform capacity planning and highlight emerging usage patterns
Explanation: Aggregated connection event trends inform capacity planning and reveal emerging usage patterns, unlike the false claims that aggregation guarantees no future incidents, automatically resizes links, eliminates the need for further monitoring, is only useful for auditing lunch breaks, or has no relevance to capacity planning at all.

Correct Answer: Selectively enabling logging (such as Log at End of Connection) primarily on rules where the traffic is security-relevant, rather than logging every single permitted low-risk internal flow in full detail
Explanation: Selectively enabling logging on security-relevant rules balances event volume with meaningful visibility, unlike disabling all logging entirely, logging everything in full detail with no scoping, or arbitrary, non-risk-based restrictions such as day-of-week, a single user, or a narrow time window.

Correct Answer: Selectively logged connection events on security-relevant rules, regularly reviewed discovery events for new hosts/applications, and periodic trend analysis of aggregated data to inform both investigations and capacity planning
Explanation: Effective SOC visibility combines selective connection logging, regular discovery event review, and periodic trend analysis, unlike relying solely on intrusion events, logging everything with no discovery review, annual-only discovery review with no connection logging, collecting but never reviewing events, or trend analysis alone with no individual event review for investigations.