Broadcom Cloud SOC Technical Specialist (250-599) Certification Sample Questions

02. A user changes another account's permissions in a sanctioned application. The user holds no administrative entitlement there, and the change was made during the working day from a familiar location.
How is the activity best classified?
a) Risky configuration, since an entitlement on the account changed
b) Unauthorized activity, since the entitlement was absent
c) Shadow IT usage, since the change skirted the IT process
d) Anomalous activity, since the action departs from the norm

03. The company's privacy lead must be able to review what CloudSOC finds about how personal information is handled. The appointment must not carry the ability to change how the portal is configured.
Which role fits that appointment?
a) The Data Protection Officer role
b) The Security Contact role
c) The End User role
d) The System Administrator role

04. A security team is setting out the work involved in the cloud service safe adoption life-cycle.
Which three activities belong to it?
(Choose three.)
a) Publish the finished service list to the help desk, for reference or review
b) Assign each portal administrator a role that matches their duties
c) Keep watching a sanctioned service once the workforce is using it
d) Judge each discovered service on its own merits before adopting it
e) Establish which cloud services the workforce reaches, sanctioned or not

05. A company deploys CloudSOC around a cloud storage service its staff have used for years. Management asks which sensitive files are sitting in that service today, including everything uploaded long before the deployment.
Which approach answers the question?
a) Watch the activity of users in the service and note the material they open
b) Reach into the service itself and scan the content it already holds
c) Watch the sessions reaching the service and record what they move
d) Read the perimeter log records and identify the uploads they describe

06. A service the company sanctioned last year is still in daily use. A colleague argues that its business readiness assessment was completed at adoption and does not need revisiting.
What is the strongest operational reason to reassess it?
a) A service's own offering changes over time
b) A service's traffic pattern shifts as the business year progresses
c) A service's stored content grows as teams keep adding files to it
d) A service's user population grows as teams are added and given access

07. An organization wants the notices CloudSOC issues about its standing to reach a named individual rather than whoever happens to be administering the portal that week.
Which role should that individual's account be given?
a) Assign the Data Protection Officer role to that account
b) Assign the End User role to that account
c) Assign the Security Contact role to that account
d) Assign the Administrator role to that account

08. A research team's normal work produces steady bulk downloads from a sanctioned repository, and the resulting findings are crowding out other work in the analyst's queue. The same pattern from other teams would still warrant investigation.
What should the analyst do?
a) Lower the detector's sensitivity for the organization
b) Exclude that team's accounts from activity collection
c) Withdraw the detector from the service that team uses
d) Narrow the detector's conditions to that team's group

09. A content policy on a connected application reports the same regulated spreadsheet week after week. Each time, the team acts on the copy it finds, and a fresh copy appears in the same folder from a member's laptop soon afterwards.
What does this pattern indicate?
a) The content definition is far too broad, so ordinary work keeps matching it
b) The stored copies are governed, while the transfers that create them are not
c) The member's entitlement is too wide, so the folder remains open to them
d) The application connection keeps re-inspecting material it has already covered

10. An analyst reports that she can sign in to the CloudSOC portal but cannot reach the applications her team is responsible for. Other members of the team are working normally.
Which two settings on the analyst's account should the administrator examine first?
(Choose two.)
a) The role the account has been given
b) The Securlets connected for those applications
c) The group the account was placed in
d) The dashboard she is shown at sign-in
e) The user profile assigned to the account