Cisco Updated 350-201 Exam Questions and Answers by rebeca

Run and evaluate a full packet capture on the workloads, review SIEM logs, and define a root cause.

Run and evaluate a full packet capture on the workloads, review SIEM logs, and plan mitigation steps.

Check SOAR to learn what the security systems are reporting about the overnight events, research the attacks, and plan mitigation step.

Check SOAR to know what the security systems are reporting about the overnight events, review the threat vectors, and define a root cause.

Assign the issue to the incident handling provider because no suspicious activity has been observed during business hours.

Review the SIEM and FirePower logs, block all traffic, and document the results of calling the call center.

Define the access points using StealthWatch or SIEM logs, understand services being offered during the hours in QUESTION NO:, and cross-correlate other source events.

Treat it as a false positive, and accept the SIEM issue as valid to avoid alerts from triggering on weekends.