Broadcom Security Analytics Technical Specialist (250-552) Certification Sample Questions

01. A team compares the internal addresses appearing in a month of retained traffic from an access segment against the organization's asset inventory, and finds several addresses that no inventory entry accounts for.
What should the team conclude about the record?
a) That those addresses belong to devices outside the organization, since anything the inventory does not hold cannot have been on an internal segment.
b) That sessions have been attributed to addresses nothing was using, since an address appears in the traffic of any host that asks about it.
c) That the inventory is the authority on what exists, so the month should be filtered to the addresses it lists before any further work is done.
d) That the record covers whatever was on the link, so a device nobody has inventoried appears in it just as a known one does.

02. Every workstation at a site reaches the internet through a forward proxy, and the capture point sits on the site's internet uplink, outside that proxy. An investigation into outbound activity finds that every session it examines names the proxy as its source.
What does the team need in order to attribute the activity to a workstation?
a) Either a capture point on the segments inside the proxy, or the proxy's own record of which internal host each request was made for.
b) The digests of the objects carried in those sessions, since the same content appearing elsewhere identifies which workstation sent it.
c) A longer retention window on the uplink capture point, so that enough sessions accumulate for the workstations behind the proxy to separate out.
d) The addressing the proxy applies to each session it forwards, which the uplink capture records alongside the proxy's own address.

03. A capture interface receives a copy of the traffic on a monitored link, but it is configured so that it has no addressable presence on that network.
What does that configuration achieve?
a) The sensor can send reset frames to sessions it judges malicious while staying unknown to the endpoints on either side of the conversation.
b) The sensor takes in everything the link carries without appearing on the monitored network or answering anything on it.
c) The interface accepts only the frames addressed to the hosts or services currently under investigation, which reduces the volume written to storage.
d) The devices on the monitored link treat the sensor as an additional hop, which is what lets both directions of a session be recorded.

04. A site has capture points in two places: one on the link to the internet and one on the segment carrying its application servers. An analyst investigating a session between an application server and an external service finds that same session in the record from both.
What does that mean?
a) That the exchange was carried twice, once by each of the two paths the site offers between an application server and an external service.
b) That one of the two capture points has been given a feed it was not meant to have, since a session should reach the record from the point nearest the host that opened it.
c) That one conversation was recorded at each place it passed, so the two records describe the same traffic seen at two points rather than two separate exchanges.
d) That the analysis layer has reassembled the same packets twice, once on behalf of each capture point, and that one of the two records will be the incomplete one.

05. An analyst reconstructing an intrusion finds the message that carried the attachment and, minutes later, the first outbound contact to the attacker's infrastructure. Nothing in the record covers the moment the attachment's code actually ran on the machine.
What accounts for that gap?
a) The code ran on the machine itself, so the network record holds what arrived and what followed rather than the execution between them.
b) The code ran during a stretch the sensor did not write, so a short interruption in capture removed exactly that part of the record.
c) The code ran before the analysis layer had worked through the surrounding sessions, so the event is retained but not yet reachable from a search.
d) The code ran inside a session that was encrypted on the wire, so the record holds the traffic but cannot present what it carried.

06. What distinguishes a report from a dashboard view in Security Analytics?
a) A report is compiled from the retained packets themselves, while a dashboard is built from session metadata alone and cannot reach the underlying traffic.
b) A report is a produced artifact covering a defined period that can be circulated; a dashboard is a view watched inside the interface.
c) A report draws only on sessions an analyst has already opened, while a dashboard draws on everything captured.
d) A report covers a single sensor, while a dashboard aggregates across every sensor in the deployment.

07. A file is extracted from a captured session and turns out to be an archive holding several other files.
What has the platform produced?
a) A partial object, since an archive cannot be reconstructed from captured traffic unless every file it holds was itself transferred whole.
b) The files held inside the archive, since reconstruction works through the container to the content it carries and presents each item on its own.
c) The object as it crossed the link, rebuilt from the retained packets of that session, which in this case is the archive that was transferred.
d) The archive together with a listing of what it holds, since the names inside it are carried in the session and recorded as the transfer is reassembled.

08. An administrator wants to find out why a sensor restarted during the night.
Where does that evidence sit?
a) In the appliance's own operational logging, kept separately from the traffic it records.
b) In the index, which carries a gap for the interval and describes what caused it.
c) In the monthly report, once the period covering the restart has been compiled.
d) In the captured traffic for the period, which records the appliance's own activity alongside everything else on the link.

09. An intrusion has been eradicated and the affected systems are back in service. The team is preparing its post-incident review and asks what the retained capture can contribute to it.
What does the record support?
a) Deciding which of the rules added during containment should remain in place, since the review owns the perimeter configuration.
b) Establishing which persistence mechanisms were removed from each server, so the review can confirm eradication was complete.
c) Determining whether the organization is obliged to notify anyone, which the review has to settle before it closes.
d) Measuring the gap between the attacker's first contact and the moment anyone noticed, so the team can judge how long it was blind.

10. A security team spends a week testing a hypothesis that internal hosts are communicating with newly registered domains at fixed intervals. Every candidate session it examines resolves to sanctioned software checking for updates, and no adversary activity is found.
How should the outcome of that work be regarded?
a) The hunt should be reopened with an alert from the detection tooling as its starting point, so that the effort has something concrete to work from.
b) The hunt is complete and its result is useful, since testing the hypothesis has ruled that behavior out across the retention window.
c) The hunt failed, because a hunt is measured by the compromises it uncovers and this one uncovered none.
d) The result shows that existing detection coverage is sufficient for this traffic, so further hunting on the segment can be dropped.