MENU
An analyst received multiple alerts on the SIEM console of users that are navigating to malicious URLs. The analyst needs to automate the task of receiving alerts and processing the data for further investigations. Three variables are available from the SIEM console to include in an automation script: console_ip, api_token, and reference_set_name. What must be added to this script to receive a successful HTTP response?
#!/usr/bin/python import sys import requests
Suggested Answer: C
Get Premium 350-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
RU
Rutha
11 months ago
Is it really that simple? I thought there'd be more to it.
DI
Dick
12 months ago
Totally agree with C, makes the most sense!
EL
Elza
12 months ago
Wait, why would you need reference_set_name for a response?
JU
Julio
1 year ago
I think option C is the right choice!
CR
Craig
1 year ago
You definitely need console_ip and api_token for the HTTP request.
AN
Annabelle
1 year ago
I vaguely recall something about needing the console_ip and api_token together for the script to work, but I’m not completely confident.
ZA
Zana
1 year ago
I’m a bit confused about this one. I thought we needed all three variables, but maybe we only need the first two for a successful response?
LO
Lovetta
1 year ago
I remember a practice question where we had to use API tokens for authentication, so I feel like option C might be the right choice.
RO
Rolf
1 year ago
I think we need to include the console_ip and api_token to authenticate the request, but I'm not entirely sure if reference_set_name is also necessary.
KE
Kerrie
1 year ago
Hmm, I'm not totally sure about this one. I'm thinking it could also be used to apply a non-identical service configuration to multiple CPEs, like option C. But I'm not 100% confident on that.
ST
Stefanie
1 year ago
Hmm, I'm a bit unsure about this one. Data aggregation could have a few different benefits, so I'll need to read the options closely to determine the main one.
AD
Adelaide
1 year ago
This is a tricky one. I'm not entirely sure about the relationship between the captain, the deployer, and the new search head. I'll need to review my notes on search head clustering to make sure I understand the correct sequence of steps.