200-201 Analyst Practice Questions

An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, "File: Clean." Which regex must the analyst import?

• AA. File: Clean
• BB. ^Parent File Clean$
• CC. File: Clean (.*)
• DD. ^File: Clean$

What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

• AA. Tapping interrogation replicates signals to a separate port for analyzing traffic
• BB. Tapping interrogations detect and block malicious traffic
• CC. Inline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies
• DD. Inline interrogation detects malicious traffic but does not block the traffic