Performing CyberOps Using Cisco Security Technologies (CBRCOR) practice questions

1. Question 1 of 25

   Select 2

   

   Refer to the exhibit. Which two steps mitigate attacks on the webserver from the Internet? (Choose two.)

   • ACreate an ACL on the firewall to allow only TLS 1.3
   • BImplement a reverse server in the DMZ network
   • CCreate an ACL on the firewall to allow only external connections
   • DMove the webserver to the internal network
   • EMove the webserver to the external network

   Show answer

   Correct answer: A, B

   How others answered

   • AB50%
   • BD50%

   Only 50% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Only allowing TLS 1.3 can mitigate attacks, the proxy server can also help. C might cause issues for internal users, and D doen't do anything to mitigate attacks. Ans is: A.B.

   Adapted from community discussion by CiscoTester · 2023-05-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. D

      DrVoIP

      2024-08-17

      1 upvote

      The two steps that mitigate attacks on the webserver from the Internet are: A. Create an ACL on the firewall to allow only TLS 1.3: Transport Layer Security (TLS) is a protocol that provides secure communication between web servers and clients over the internet. By creating an Access Control List (ACL) on the firewall to allow only TLS 1.3, the web server can be configured to only accept secure connections from clients. This helps to protect against attacks that try to intercept or eavesdrop on communications. B. Implement a reverse server in the DMZ network: A reverse proxy server acts as an intermediary between the internet and the web server. It receives all incoming traffic and then forwards it to the web server. By implementing a reverse server in the DMZ network, the web server can be protected from direct exposure to the internet. The reverse proxy server can perform functions such as filtering traffic, caching data, and providing an additional layer of security by masking the web server's IP address.

   2. C

      CiscoTester

      2023-05-28

      4 upvotes

      Only allowing TLS 1.3 can mitigate attacks, the proxy server can also help. C might cause issues for internal users, and D doen't do anything to mitigate attacks. Ans is: A.B.

   3. T

      TOLU1985

      2024-03-25

      Selected A, B1 upvote

      Create an ACL on the firewall to allow only TLS 1.3 Implement a proxy server in the DMZ network not sure why they mentioned reverse server... AB is correct

   4. K

      kyle942

      2024-03-23

      1 upvote

      https://resources.infosecinstitute.com/topic/what-is-enumeration/ Enumeration is defined as a process which establishes an active connection to the target hosts to discover potential attack vectors in the system, and the same can be used for further exploitation of the system.

2. Question 2 of 25

   The SIEM tool informs a SOC team of a suspicious file. The team initializes the analysis with an automated sandbox tool, sets up a controlled laboratory to examine the malware specimen, and proceeds with behavioral analysis. What is the next step in the malware analysis process?

   • APerform static and dynamic code analysis of the specimen.
   • BUnpack the specimen and perform memory forensics.
   • CContain the subnet in which the suspicious file was found.
   • DDocument findings and clean-up the laboratory.

   Show answer

   Correct answer: A

   How others answered

   • A67%
   • B33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   The next step in the malware analysis process would be to perform static and dynamic code analysis of the specimen. After performing behavioral analysis, static analysis involves examining the code and characteristics of the malware to identify any recognizable patterns or signatures, while dynamic analysis involves observing the behavior of the malware in a controlled environment to understand its methods of attack and any associated network communications. These steps help in developing countermeasures and detection methods for similar types of malware. - ChatGPT

   Adapted from community discussion by DrVoIP · 2023-02-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. B

      Bobster02

      2021-11-29

      Selected A7 upvotes

      A. Perform static and dynamic code analysis of the specimen.

   2. D

      DrVoIP

      2023-02-18

      2 upvotes

      The next step in the malware analysis process would be to perform static and dynamic code analysis of the specimen. After performing behavioral analysis, static analysis involves examining the code and characteristics of the malware to identify any recognizable patterns or signatures, while dynamic analysis involves observing the behavior of the malware in a controlled environment to understand its methods of attack and any associated network communications. These steps help in developing countermeasures and detection methods for similar types of malware. - ChatGPT

   3. T

      TrainingTeam

      2024-10-21

      Selected A1 upvote

      Following behavioral analysis in a controlled laboratory, the next step in the malware analysis process is to perform static and dynamic code analysis of the specimen. Static analysis involves examining the malware without executing it, while dynamic analysis involves observing the malware's behavior in a controlled environment. These analyses provide deeper insights into the malware's capabilities and intentions2.

   4. J

      jaciro11

      2022-08-31

      Selected A1 upvote

      https://sansorg.egnyte.com/dl/oZleNgF6uF A would be the next step :)

3. Question 3 of 25

   Which action should be taken when the HTTP response code 301 is received from a web application?

   • AUpdate the cached header metadata.
   • BConfirm the resource's location.
   • CIncrease the allowed user limit.
   • DModify the session timeout setting.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   When the HTTP response code 301 is received from a web application, the appropriate action is to confirm the resource's location. The HTTP 301 response code indicates that the requested resource has moved permanently to a new URL, and the new URL should be used for future requests. By confirming the new location, clients can ensure they are accessing the most up-to-date resource. Updating the cached header metadata, increasing the allowed user limit, and modifying the session timeout setting are not relevant actions to take in response to an HTTP 301 response code. - ChatGPT

   Adapted from community discussion by DrVoIP · 2023-02-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. D

      DrVoIP

      2023-02-18

      2 upvotes

      When the HTTP response code 301 is received from a web application, the appropriate action is to confirm the resource's location. The HTTP 301 response code indicates that the requested resource has moved permanently to a new URL, and the new URL should be used for future requests. By confirming the new location, clients can ensure they are accessing the most up-to-date resource. Updating the cached header metadata, increasing the allowed user limit, and modifying the session timeout setting are not relevant actions to take in response to an HTTP 301 response code. - ChatGPT

   2. K

      kyle942

      2023-01-07

      Selected B1 upvote

      What are the Browsers Compatibility of the 301 HTTP Status Code? You can see the table that shows the browser’s compatibility of the 301 HTTP Status Code below. Browser Name Browser Compatibility of 301 HTTP Status Code Chrome YES Firefox YES Internet Explorer YES Opera YES Safari YES WebView Android YES Chrome Android YES Firefox for Android YES

   3. T

      TrainingTeam

      2024-10-21

      Selected B1 upvote

      When an HTTP response code 301 is received from a web application, it indicates that the requested resource has been permanently moved to a new location. The action to be taken is to confirm the resource's new location, as the 301 status code is used for permanent URL redirection

   4. G

      germx

      2021-12-18

      1 upvote

      B is correct 301 Moved Permanently -> check ressource location

4. Question 4 of 25

   What is idempotence?

   • Athe assurance of system uniformity throughout the whole delivery process
   • Bthe ability to recover from failures while keeping critical services running
   • Cthe necessity of setting maintenance of individual deployment environments
   • Dthe ability to set the target environment configuration regardless of the starting state

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   D. the ability to set the target environment configuration regardless of the starting state is idempotence. In other words, performing the same operation multiple times should have the same effect as performing it only once. This is a key property of automation and infrastructure-as-code systems, where the desired state of a system is defined and then automatically applied to ensure that it is always in the correct state, regardless of its current state. - ChatGPT

   Adapted from community discussion by DrVoIP · 2024-08-18 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. D

      DrVoIP

      2024-08-18

      2 upvotes

      D. the ability to set the target environment configuration regardless of the starting state is idempotence. In other words, performing the same operation multiple times should have the same effect as performing it only once. This is a key property of automation and infrastructure-as-code systems, where the desired state of a system is defined and then automatically applied to ensure that it is always in the correct state, regardless of its current state. - ChatGPT

   2. E

      ETSec

      2024-07-21

      Selected D1 upvote

      idempotence can be used to describe the ability to set the target environment configuration regardless of the starting state. This is a common use case in configuration management and infrastructure as code, where you want to ensure that your infrastructure is in a known, desired state. By using idempotent operations and scripts, you can repeatedly apply the same configuration to a system without worrying about the current state of the system, and be confident that the final state will be the same.

   3. B

      Bobster02

      2023-05-27

      Selected D2 upvotes

      D. the ability to set the target environment configuration regardless of the starting state

   4. K

      kyle942

      2024-07-07

      1 upvote

      Idempotence, the ability of a given operation to always produce the same result, is an important IaC principle. A deployment command always sets the target environment into the same configuration, regardless of the environment's starting state. Idempotency is achieved by either automatically configuring the existing target, or by discarding the existing target and recreating a fresh environment.

5. Question 5 of 25

   A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?

   • AClassify the criticality of the information, research the attacker's motives, and identify missing patches
   • BDetermine the damage to the business, extract reports, and save evidence according to a chain of custody
   • CClassify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited
   • DDetermine the attack surface, evaluate the risks involved, and communicate the incident according to the escalation plan

   Show answer

   Correct answer: D

   How others answered

   • D38%
   • C38%
   • B25%

   Only 38% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I think its B. The only thing we know is the user noticed a change. Gathering evidence and logs would be my move, escalating too soon migth not be good.

   Adapted from community discussion by CiscoTester · 2021-11-28 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. C

      CiscoTester

      2021-11-28

      5 upvotes

      I think its B. The only thing we know is the user noticed a change. Gathering evidence and logs would be my move, escalating too soon migth not be good.

   2. V

      Vic25H

      2023-07-04

      Selected D3 upvotes

      I think could be option D. Person that detected the anomaly is a payroll administrator don't think He could have an idea on how to classify the attack vector.

   3. M

      Medjai89

      2022-12-25

      1 upvote

      ITs C for sure. Read the NIST handbook before you assume things.. The incident response team should work quickly to analyze and validate each incident, following a predefined process and documenting each step taken. When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring (e.g., what tools or attack methods are being used, what vulnerabilities are being exploited). The initial analysis should provide enough information for the team to prioritize subsequent activities, such as containment of the incident and deeper analysis of the effects of the incident.

   4. D

      DrVoIP

      2023-02-17

      1 upvote

      At this step in the incident response workflow, the following actions should be taken: C. Classify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited. The first priority of the incident response team should be to gain a full understanding of the incident. This includes identifying the attack vector, understanding the scope of the event, and identifying the vulnerabilities being exploited. By classifying the attack vector and determining the scope of the event, the incident response team can begin to determine the level of response needed and whether additional resources or expertise may be necessary to address the incident. Then A followed by B

6. Question 6 of 25

   A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?

   • AIdentify the business applications running on the assets
   • BUpdate software to patch third-party software
   • CValidate CSRF by executing exploits within Metasploit
   • DFix applications according to the risk scores

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   D. Fix applications according to the risk scores. In order to prioritize the patching process, the engineer should prioritize applications based on their risk scores. Risk scoring allows for a systematic evaluation of the level of risk associated with the applications and assists in determining the order of priority for addressing the vulnerabilities. This ensures that the most critical applications are patched first, thereby mitigating the risk of a successful attack. Identifying the business applications running on the assets (Option A) is an important step, but it does not directly address the issue of patching the CSRF vulnerability. Updating software to patch third-party software (Option B) is also important, but may not be the most critical step at this time. Validating CSRF by executing exploits In order to prioritize the patching process, the engineer should prioritize applications based on their risk scores. within Metasploit (Option C) is not necessary as the vulnerability has already been identified.

   Adapted from community discussion by DrVoIP · 2023-02-17 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. D

      DrVoIP

      2023-02-17

      2 upvotes

      D. Fix applications according to the risk scores. In order to prioritize the patching process, the engineer should prioritize applications based on their risk scores. Risk scoring allows for a systematic evaluation of the level of risk associated with the applications and assists in determining the order of priority for addressing the vulnerabilities. This ensures that the most critical applications are patched first, thereby mitigating the risk of a successful attack. Identifying the business applications running on the assets (Option A) is an important step, but it does not directly address the issue of patching the CSRF vulnerability. Updating software to patch third-party software (Option B) is also important, but may not be the most critical step at this time. Validating CSRF by executing exploits In order to prioritize the patching process, the engineer should prioritize applications based on their risk scores. within Metasploit (Option C) is not necessary as the vulnerability has already been identified.

   2. T

      TOLU1985

      2022-09-25

      Selected D2 upvotes

      Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site when the user is authenticated. A CSRF attack works because browser requests automatically include all cookies including session cookies. Therefore, if the user is authenticated to the site, the site cannot distinguish between legitimate authorized requests and forged authenticated requests. https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html D fit here, any concerns?

   3. T

      TrainingTeam

      2024-10-21

      Selected D1 upvote

      When dealing with a CSRF vulnerability discovered in multiple applications, the recommended approach is to prioritize patching based on the risk scores associated with each application. This ensures that the most critical vulnerabilities that pose the greatest risk to the organization are addressed first. It is a strategic approach that aligns remediation efforts with the potential impact of the vulnerabilities4.

   4. M

      marceus

      2025-02-13

      Selected D1 upvote

      ChatGPT: The most effective approach is to fix applications based on their risk scores. This ensures that the most critical vulnerabilities, which could lead to serious security breaches, are addressed first, reducing overall risk to the organization.

7. Question 7 of 25

   Select 2

   An engineer is analyzing a possible compromise that happened a week ago when the company database servers unexpectedly went down. The analysis reveals that attackers tampered with Microsoft SQL Server Resolution Protocol and launched a DDoS attack. The engineer must act quickly to ensure that all systems are protected. Which two tools should be used to detect and mitigate this type of future attack? (Choose two.)

   • Afirewall
   • BWireshark
   • Cautopsy
   • DSHA512
   • EIPS

   Show answer

   Correct answer: A, E

   How others answered

   • AE100%

   Explanation

   Wirehsark can also detect but it takes time to understand the packet streams. https://contenthub.netacad.com/courses/cyberops/_common/17.2.6-lab---attacking-a-mysql-database.pdf The question is that it needs to be quik, so answer is definitaly A &E

   Adapted from community discussion by Medjai89 · 2023-12-16 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. D

      DrVoIP

      2024-02-17

      1 upvote

      A. Firewall: A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. By using a firewall, an organization can block traffic associated with the Microsoft SQL Server Resolution Protocol and DDoS attacks. E. IPS: Intrusion Prevention System (IPS) is a security tool that monitors network traffic for signs of malicious activity and can block or prevent that traffic from entering the network. An IPS can detect and prevent DDoS attacks by identifying suspicious traffic patterns and blocking them. While Wireshark (Option B) and Autopsy (Option C) are both useful network analysis tools, they are not specifically designed for detecting and mitigating DDoS attacks. SHA512 (Option D) is a cryptographic hash function that can be used to verify the integrity of data, but it is not a tool for detecting or mitigating DDoS attacks.

   2. M

      Medjai89

      2023-12-16

      2 upvotes

      Wirehsark can also detect but it takes time to understand the packet streams. https://contenthub.netacad.com/courses/cyberops/_common/17.2.6-lab---attacking-a-mysql-database.pdf The question is that it needs to be quik, so answer is definitaly A &E

   3. A

      archbbo

      2025-03-13

      Selected A, E1 upvote

      Wireshark CAN detect but the problem is it happened a week ago, its a live PCAPture, so it wouldnt do no good a week later, the IPS is a fix for future security, and firewall logs can show the evens in the past, so i would go with A and E,

   4. K

      kyle942

      2023-09-17

      1 upvote

      AB is correct, the server was compromised, https://myakamai.force.com/customers/s/article/Attackers-Using-New-MS-SQL-Reflection-Techniques?language=en_US it was used to launch the attack

8. Question 8 of 25

   An engineer is going through vulnerability triage with company management because of a recent malware outbreak from which 21 affected assets need to be patched or remediated. Management decides not to prioritize fixing the assets and accepts the vulnerabilities. What is the next step the engineer should take?

   • AInvestigate the vulnerability to prevent further spread
   • BAcknowledge the vulnerabilities and document the risk
   • CApply vendor patches or available hot fixes
   • DIsolate the assets affected in a separate network

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Did you read ?? Management decides not to prioritize fixing the assets and accepts the vulnerabilities Really guys dont follow that guy, all the answers from that guy are incorrectly

   Adapted from community discussion by jaciro11 · 2024-02-29 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. J

      jaciro11

      2024-02-29

      4 upvotes

      Did you read ?? Management decides not to prioritize fixing the assets and accepts the vulnerabilities Really guys dont follow that guy, all the answers from that guy are incorrectly

   2. D

      DrVoIP

      2024-08-17

      1 upvote

      B. Acknowledge the vulnerabilities and document the risk. It is essential to acknowledge vulnerabilities and document their associated risks, even if the organization decides not to remediate them. By documenting the risk, the engineer can help the organization to make informed decisions regarding the acceptance of potential risks. This documentation can also be used to develop a plan to mitigate the risks associated with the vulnerabilities. A. Investigating the vulnerability to prevent further spread, C. Applying vendor patches or available hot fixes, and D. Isolating the assets affected in a separate network are all important steps to take in response to a vulnerability, but they may not be applicable in this scenario since management has already decided to accept the vulnerabilities. Therefore, it is crucial to focus on the documentation of the risks associated with the vulnerabilities. -GPT

   3. D

      Dunky

      2022-11-26

      2 upvotes

      B. Acknowledge issues are those which, for whatever reason, you decide not to resolve at present. There are valid reasons for not immediately resolving a vulnerability, and they should be recorded, along with the reasoning for acknowledging it and a review date given. If the level of risk they present is sufficiently high, record the issue in a risk register.

   4. C

      CiscoTester

      2023-05-28

      2 upvotes

      If you are going through triage because there was an outbreak, why would you take Managements opinion? We are the experts not Management, forget that and the best option is C.

9. Question 9 of 25

   

   Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop automatically submitted a low prevalence file to the Threat Grid analysis engine. What should be concluded from this report?

   • AThreat scores are high, malicious ransomware has been detected, and files have been modified
   • BThreat scores are low, malicious ransomware has been detected, and files have been modified
   • CThreat scores are high, malicious activity is detected, but files have not been modified
   • DThreat scores are low and no malicious file activity is detected

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   If you check the other image from similar question, the report will specify "Ransomeware" and "Modified File" those are not found here. Answer is D

   Adapted from community discussion by CiscoTester · 2023-05-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

   1. D

      DrVoIP

      2024-08-17

      1 upvote

      D. Threat scores are low, and no malicious file activity is detected. The exhibit shows that the Threat Grid report for the low prevalence file detected by Cisco Advanced Malware Protection (AMP) indicates a low threat score, no malicious activity, and no files modified. This suggests that the file is safe and not associated with any malicious activity or malware. Option A, B, and C are not correct because the exhibit indicates that there is no evidence of malicious activity or file modifications associated with the submitted file, and the threat score is low. - ChatGPT

   2. C

      CiscoTester

      2023-05-28

      2 upvotes

      If you check the other image from similar question, the report will specify "Ransomeware" and "Modified File" those are not found here. Answer is D

   3. T

      TOLU1985

      2024-03-26

      Selected D1 upvote

      Threat scores are low and no malicious file activity is detected. Why admin sharing wrong answers?

   4. A

      ak_technonet

      2024-11-15

      Selected D1 upvote

      I found no evidence about malicious file in the report. So D is correct answer.

10. Question 10 of 25

    A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?

    • ABlock the source IP from the firewall
    • BPerform an antivirus scan on the laptop
    • CIdentify systems or services at risk
    • DIdentify lateral movement

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    You have already identified a few systems at risk, not C. Somehow you know there is an attempt to connect using VPN, blocking seems logical. answer :A

    Adapted from community discussion by CiscoTester · 2023-05-28 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. C

       CiscoTester

       2023-05-28

       5 upvotes

       You have already identified a few systems at risk, not C. Somehow you know there is an attempt to connect using VPN, blocking seems logical. answer :A

    2. D

       DrVoIP

       2024-08-17

       1 upvote

       The next step in handling the incident where the attacker has installed a remote access tool on a user's laptop while traveling and is attempting to connect to the network is: C. Identify systems or services at risk. After validating the alert, the incident response team needs to determine the scope of the attack, which systems or services are at risk, and the potential impact of the attack. The next step would be to identify which other systems or services may be at risk of compromise or attack and assess the potential impact on the organization. A (Block the source IP from the firewall) may be a valid action, but it should be taken after identifying the systems or services at risk and determining the impact of the attack. B (Perform an antivirus scan on the laptop) and D (Identify lateral movement) may also be important steps in responding to the incident, but they should be taken after identifying the systems or services at risk and determining the impact of the attack. - ChatGPT

    3. J

       jaciro11

       2024-03-01

       1 upvote

       You block the IP and what? The attacker can connect through another IP. In no one part the mentioned they have already identified a few systems at risk, that's the next task. so answer is C.

    4. A

       ak_technonet

       2024-11-15

       1 upvote

       Once the team validated true positive alert, it should be identify the system before blocking source ip address in FW. So the correct answer is C

11. Question 11 of 25

    A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

    • ADetermine the systems involved and deploy available patches
    • BAnalyze event logs and restrict network access
    • CReview access lists and require users to increase password complexity
    • DIdentify the attack vector and update the IDS signature list

    Show answer

    Correct answer: A

    How others answered

    • A83%
    • D17%

    Explanation

    ChatGPT: During the recovery stage of the incident response process, the focus is on restoring affected systems to a secure state and preventing reinfection.

    Adapted from community discussion by marceus · 2025-02-13 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. D

       danny069

       2021-08-02

       13 upvotes

       Guys I took the exam and failed today. All the questions are here but the answers are wrong.

    2. D

       DrVoIP

       2023-02-17

       1 upvote

       At the recovery stage of an incident where a remote code execution attack has occurred in a company's infrastructure after a phishing email was used to deliver a file with an embedded macro, the following step should be taken: A. Determine the systems involved and deploy available patches. After an incident, it is essential to determine the scope of the attack, including which systems were involved and the extent of the damage. In this case, the first step in the recovery process should be to identify the affected systems and deploy available patches to prevent the attack from recurring and to address any vulnerabilities that were exploited. Other answers also important steps in responding to the incident, but they are not specific to the recovery stage. These steps can be taken earlier in the incident response process to help identify and contain the attack, but at the recovery stage, the focus is on restoring affected systems and preventing the attack from recurring. - ChatGPT

    3. D

       danny069

       2021-08-02

       1 upvote

       So for this question we need to know what happens in the NIST "recovery" stage: In recovery, administrators restore systems to normal operation, confirm that the systems are functioning normally, and (if applicable) remediate vulnerabilities to prevent similar incidents. Recovery may involve such actions as restoring systems from clean backups, rebuilding systems from scratch, replacing compromised files with clean versions, installing patches, changing passwords, and tightening network perimeter security (e.g., firewall rulesets, boundary router access control lists). Although the answer seen here is B, I also believe the answer is A.

    4. M

       marceus

       2025-02-13

       Selected A2 upvotes

       ChatGPT: During the recovery stage of the incident response process, the focus is on restoring affected systems to a secure state and preventing reinfection.

12. Question 12 of 25

    A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled. Which activity triggered the behavior analytics tool?

    • Aaccessing the Active Directory server
    • Baccessing the server with financial data
    • Caccessing multiple servers
    • Ddownloading more than 10 files

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    I believe the answer is B... If you have admin then it is normal to jump through many RDPs for many tasks, an admin in a financial server would be more suspicious. Accesing multiple servers would probably raise many False Positive alerts and disabled accounts.

    Adapted from community discussion by CiscoTester · 2022-11-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. C

       CiscoTester

       2022-11-28

       4 upvotes

       I believe the answer is B... If you have admin then it is normal to jump through many RDPs for many tasks, an admin in a financial server would be more suspicious. Accesing multiple servers would probably raise many False Positive alerts and disabled accounts.

    2. S

       sz3cur3

       2024-07-03

       4 upvotes

       Hi, Did u passed the exam. Which dump was used as primary one. Planning to take exam within a week. Thanks.

    3. D

       DrVoIP

       2024-02-17

       1 upvote

       Based on the information provided, the activity that most likely triggered the behavior analytics tool is: B. Accessing the server with financial data. The behavior analytics tool likely detected suspicious activity when the threat actor attempted to access the server with corporate financial data, which triggered the system to disconnect the session and disable the administrator's account. This response suggests that the system detected and responded to the threat actor's behavior, indicating that a behavior analytics tool was in place. Accessing the Active Directory server and multiple servers could be considered suspicious activity, but not necessarily indicative of a threat. Downloading more than 10 files may also be considered suspicious, but it is less likely to be the specific trigger for the behavior analytics tool in this scenario.

    4. T

       TOLU1985

       2023-09-25

       Selected C1 upvote

       All dump sites show same answer - accessing multiple servers, so probably it's correct one

13. Question 13 of 25

    The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?

    • AContain the malware
    • BInstall IPS software
    • CDetermine the escalation path
    • DPerform vulnerability assessment

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • C25%

    Explanation

    The fact that it says "IR team was notified" makes me think there has always been an escalation path. They removed the malware (eradicate) but did they fully contain it, could it happen again? I think its A.

    Adapted from community discussion by CiscoTester · 2021-11-28 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. D

       DrVoIP

       2023-02-17

       1 upvote

       D. Perform vulnerability assessment. After removing the malware and restoring the functionality and data of infected systems, the incident response team should perform a vulnerability assessment to identify the root cause of the incident and any other potential vulnerabilities that could lead to future incidents. This step is important to prevent future incidents and to improve the incident handling capability of the organization. Containment (A) is the initial step in the incident response process, and installing IPS software (B) can be a part of the containment or mitigation phase, depending on the specific incident. Determining the escalation path (C) is an important step in incident response, but it is not directly related to the handling of the current incident. Therefore, performing a vulnerability assessment (D) is the step that was missed in the incident response scenario according to the NIST incident handling guide. - ChatGPT

    2. T

       TrainingTeam

       2024-10-21

       Selected A1 upvote

       According to the NIST incident handling guide, the steps for handling an incident include preparation, detection and analysis, containment, eradication, recovery, and post-incident activity12. In the scenario described, the incident response team has detected the malware, eradicated it by removing the malware, and recovered by restoring the functionality and data of infected systems. However, the step of containment, which should occur before eradication and recovery to prevent the spread of malware and further damage, appears to have been missed. Containment strategies are crucial to limit the scope and magnitude of an incident1.

    3. C

       CiscoTester

       2021-11-28

       3 upvotes

       The fact that it says "IR team was notified" makes me think there has always been an escalation path. They removed the malware (eradicate) but did they fully contain it, could it happen again? I think its A.

    4. M

       Medjai89

       2022-12-16

       2 upvotes

       A, contain the malware https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

14. Question 14 of 25

    

    Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

    • AThe extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
    • BThe traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
    • CThere is a possible data leak because payloads should be encoded as UTF-8 text
    • DThere is a malware that is communicating via encrypted channels to the command and control server

    Show answer

    Correct answer: C

    How others answered

    • C50%
    • D50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Go to your extension settings, these can have regular updates. Websocket protocol can use TLS so encrypted traffic is most not an IoC. The traffic from websocket is masked to avoid problems with devices that do not understand the protocol. Answer is: B

    Adapted from community discussion by CiscoTester · 2021-11-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. D

       DrVoIP

       2023-02-17

       1 upvote

       Without more information, it is difficult to determine the exact meaning of the STIX. However, the fact that direct IP connections are being initiated by a Google Chrome extension using the WebSocket protocol and that the message payloads are obfuscated and unreadable could indicate a possible data exfiltration or command and control communication. The obfuscation of payloads is a common technique used by malware to avoid detection and evade analysis. Therefore, option D, "There is malware that is communicating via encrypted channels to the command and control server," is a plausible interpretation of the situation. However, further analysis would be required to confirm this. - ChatGPT

    2. C

       CiscoTester

       2021-11-28

       2 upvotes

       Go to your extension settings, these can have regular updates. Websocket protocol can use TLS so encrypted traffic is most not an IoC. The traffic from websocket is masked to avoid problems with devices that do not understand the protocol. Answer is: B

    3. W

       Websantos

       2022-01-18

       2 upvotes

       https://www.extrahop.com/company/blog/2019/investigating-fake-chrome-extension-postman-part-1/ I will the correct answer is C

    4. J

       jaciro11

       2022-08-31

       Selected C1 upvote

       1Normally the connection is only over 80 or 443. 2The encoded not looks like UTF-8 3This looking like malicious request, the port is different Answer would be C

15. Question 15 of 25

    An engineer received an alert of a zero-day vulnerability affecting desktop phones through which an attacker sends a crafted packet to a device, resets the credentials, makes the device unavailable, and allows a default administrator account login. Which step should an engineer take after receiving this alert?

    • AInitiate a triage meeting to acknowledge the vulnerability and its potential impact
    • BDetermine company usage of the affected products
    • CSearch for a patch to install from the vendor
    • DImplement restrictions within the VoIP VLANS

    Show answer

    Correct answer: B

    How others answered

    • B60%
    • A40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    It doesn't mention any incidents, an alert could be the vendors 0day advisory. If there was an incident A,C,D would all be correct because it doesn't specify a IR phase. This time I will choose B

    Adapted from community discussion by CiscoTester · 2023-05-28 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. C

       CiscoTester

       2023-05-28

       7 upvotes

       It doesn't mention any incidents, an alert could be the vendors 0day advisory. If there was an incident A,C,D would all be correct because it doesn't specify a IR phase. This time I will choose B

    2. D

       DrVoIP

       2024-08-17

       1 upvote

       D. Implement restrictions within the VoIP VLANS After receiving an alert about a zero-day vulnerability affecting desktop phones, the engineer should immediately take action to mitigate the threat. One of the first steps in this process should be to implement restrictions within the VoIP VLANs to prevent unauthorized access and limit the scope of the attack. This could involve measures such as updating firewall rules, configuring access control lists, or isolating affected devices from the network until a patch can be applied. The engineer should also continue to monitor the situation and work with the vendor to identify and implement a patch as soon as possible. - ChatGPT

    3. M

       marceus

       2025-02-13

       Selected B1 upvote

       ChatGPT: In summary, determining usage helps prioritize the vulnerability's impact in the context of your organization, and it's the best first step to take after receiving the alert.

    4. K

       kyle942

       2024-07-08

       Selected B1 upvote

       Cisco playbook graph shows the floww: https://www.cisco.com/c/dam/en_us/about/security/images/csc_child_pages/white_papers/risk-triage-sir-flowchart.gif

16. Question 16 of 25

    Refer to the exhibit. A security analyst needs to investigate a security incident involving several suspicious connections with a possible attacker. Which tool should the analyst use to identify the source IP of the offender?

    

    • Apacket sniffer
    • Bmalware analysis
    • CSIEM
    • Dfirewall manager

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Netstat image is useless without the source of infomration that identified the possible attacker connections. An FMC as in "D. Firewallmanager" would identify the attack based on IPS and show the IP. A sniffer does not have security intel to identify the offending IP.

    Adapted from community discussion by CiscoTester · 2023-05-28 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. C

       CiscoTester

       2023-05-28

       3 upvotes

       Netstat image is useless without the source of infomration that identified the possible attacker connections. An FMC as in "D. Firewallmanager" would identify the attack based on IPS and show the IP. A sniffer does not have security intel to identify the offending IP.

    2. T

       TOLU1985

       2024-03-25

       Selected A1 upvote

       Correct answer is packet sniffer. For example wireshark is packet sniffer where you see source ip

    3. A

       ak_technonet

       2024-11-14

       Selected A1 upvote

       Packet capture tools like Wireshark can identify attacker ip by analyzing packet headers

    4. M

       Medjai89

       2024-06-11

       1 upvote

       Wireshark is a powerful tool that can analyze traffic between hosts on your network. But it can also be used to help you discover and monitor unknown hosts, pull their IP addresses, and even learn a little about the device itself. SO answers is Packet Sniffer( Wireshark).

17. Question 17 of 25

    An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?

    • AAnalyze environmental threats and causes
    • BInform the product security incident response team to investigate further
    • CAnalyze the precursors and indicators
    • DInform the computer security incident response team to investigate further

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • C50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    ChatGPT was torn between C and D when asked to regenerate but as the engineer in this scenario is not known to be a member of the IR team, D is correct.D. Inform the computer security incident response team to investigate further. An incident of a malicious insider sending company information to outside parties is a security incident that requires immediate attention. The first step an engineer should take is to notify the computer security incident response team (CSIRT) to investigate the incident further, determine the scope of the incident, and take appropriate measures to contain and remediate the incident.

    Adapted from community discussion by DrVoIP · 2024-08-17 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. D

       DrVoIP

       2024-08-17

       3 upvotes

       ChatGPT was torn between C and D when asked to regenerate but as the engineer in this scenario is not known to be a member of the IR team, D is correct.D. Inform the computer security incident response team to investigate further. An incident of a malicious insider sending company information to outside parties is a security incident that requires immediate attention. The first step an engineer should take is to notify the computer security incident response team (CSIRT) to investigate the incident further, determine the scope of the incident, and take appropriate measures to contain and remediate the incident.

    2. J

       jaciro11

       2024-02-29

       Selected D2 upvotes

       D. Inform the computer security incident response team to investigate further. If an incident is detected the first thing its advice the Incident Response Team

    3. J

       jay_c_an

       2024-10-30

       1 upvote

       Engineer doesn't have the speciality and time is of essenance. Unauthorized data export must be invenstigated ASAP.

    4. J

       jaciro11

       2024-03-01

       1 upvote

       Retracted, this is the Incident response engineer checking the incident Answer is C

18. Question 18 of 25

    An employee abused PowerShell commands and script interpreters, which lead to an indicator of compromise (IOC) trigger. The IOC event shows that a known malicious file has been executed, and there is an increased likelihood of a breach. Which indicator generated this IOC event?

    • AExecutedMalware.ioc
    • BCrossrider.ioc
    • CConnectToSuspiciousDomain.ioc
    • DW32.AccesschkUtility.ioc

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Crossrider is unwanted app and not realted with PS/script interpreters. In AMP4E console IoC list, ExecutedMalware.IoC describes it as malicioud file executed. Answer is A

    Adapted from community discussion by CiscoTester · 2023-05-28 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. C

       CiscoTester

       2023-05-28

       5 upvotes

       Crossrider is unwanted app and not realted with PS/script interpreters. In AMP4E console IoC list, ExecutedMalware.IoC describes it as malicioud file executed. Answer is A

    2. J

       jaciro11

       2024-02-29

       1 upvote

       Crossrider.ioc Crossrider is a an Adware variant that targets Mac with the intent of displaying ads. It also changes the default home page of Safari and Chrome browsers. W32.AccesschkUtility.ioc Accesscheck is a Windows utility that lets users check for access rights on resources including files, directories, registry keys, global objects and Windows services. This utility could be used by malware or threat actors with malicious intent such as collection of information necessary for privilege escalation on the compromised host. This indicator monitors for accesschk tool used with suspicious options that suppress errors and dialog boxes. ExecutedMalware.ioc A known malicious file was executed. This increases the likelihood of a successful breach and this event should be promptly investigated. Answer is A

    3. J

       J_Dub

       2023-03-21

       2 upvotes

       I believe B is correct since Crossrider is malware. This malware is part of the Adware family.

    4. M

       marceus

       2025-02-13

       Selected A1 upvote

       ChatGPT: Since the IOC event is related to a known malicious file being executed, the most fitting indicator would be ExecutedMalware.ioc.

19. Question 19 of 25

    

    Refer to the exhibit. Cisco Rapid Threat Containment using Cisco Secure Network Analytics (Stealthwatch) and ISE detects the threat of malware-infected 802.1x authenticated endpoints and places that endpoint into a Quarantine VLAN using Adaptive Network Control policy. Which telemetry feeds were correlated with SMC to identify the malware?

    • ANetFlow and event data
    • Bevent data and syslog data
    • CSNMP and syslog data
    • DNetFlow and SNMP

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • A50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer is A Telemetry Tools After all information is collected from the network (packet captures, NetFlow, logs), suspicious activity can be identified by analyzing the information. There are many vendors that can aggregate and process all the available data to assess the security of the network. Some, but not all, of these tools are available from Splunk, Lancope, Plixer, and SolarWinds. All these can collect and analyze NetFlow in meaningful ways. https://tools.cisco.com/security/center/resources/network_integrity_monitoring.html#8

    Adapted from community discussion by Bobster02 · 2022-07-19 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation
    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. C

       CiscoTester

       2022-11-28

       4 upvotes

       SMC and FC only communicate over 443 (must mean "Event Data"), the NETFLOW* data is not actually being sent to SMC for correlation. SNMP is not telemetry. SMC can receive Syslog from external sources, and of course the event data, meaning netflow telemetry queried from the FC and/or Threat Intel sources. The keywork is telemetry..... Answer is B

    2. B

       Bobster02

       2022-07-19

       3 upvotes

       Correct Answer is A Telemetry Tools After all information is collected from the network (packet captures, NetFlow, logs), suspicious activity can be identified by analyzing the information. There are many vendors that can aggregate and process all the available data to assess the security of the network. Some, but not all, of these tools are available from Splunk, Lancope, Plixer, and SolarWinds. All these can collect and analyze NetFlow in meaningful ways. https://tools.cisco.com/security/center/resources/network_integrity_monitoring.html#8

    3. G

       gsmith7

       2023-05-11

       3 upvotes

       I would go with Answer "B" on the following bases: Syslog Data = the only data which are valuable from NAD (Switch - 802.1x) Event Data = NetFlow "NetFlow and syslog data" would have been a correct answer if included to the answers... The answers are clearly trying to confuse the candidate. Classic Cisco...

    4. B

       Bobster02

       2022-07-19

       3 upvotes

       Correction: Correct Answer is D: NetFlow and SNMP https://www.ciscopress.com/articles/article.asp?p=791595&seqNum=2

20. Question 20 of 25

    An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?

    • AModify the alert rule to ג€output alert_syslog: output logג€
    • BModify the output module rule to ג€output alert_quick: output filenameג€
    • CModify the alert rule to ג€output alert_syslog: output headerג€
    • DModify the output module rule to ג€output alert_fast: output filenameג€

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    2.6.2 alert_fast This will print Snort alerts in a quick one-line format to a specified output file. It is a faster alerting method than full alerts because it doesn't need to print all of the packet headers to the output file and because it logs to only 1 file.

    Adapted from community discussion by tukan · 2023-04-28 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. T

       tukan

       2023-04-28

       5 upvotes

       2.6.2 alert_fast This will print Snort alerts in a quick one-line format to a specified output file. It is a faster alerting method than full alerts because it doesn't need to print all of the packet headers to the output file and because it logs to only 1 file.

    2. B

       Bobster02

       2023-05-30

       Selected D4 upvotes

       Modify the output module rule to "output alert_fast: output filename"

    3. T

       TOLU1985

       2024-03-26

       Selected D2 upvotes

       D http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node21.html#SECTION00362000000000000000 2.6.2 alert_fast This will print Snort alerts in a quick one-line format to a specified output file. It is a faster alerting method than full alerts because it doesn't need to print all of the packet headers to the output file and because it logs to only 1 file. 2.6.2.1 Format output alert_fast: [ ["packet"] [ ]] ::= [('G'|'M'|K')]

    4. D

       DrVoIP

       2024-09-08

       1 upvote

       even AI is confused: To reduce the size of the file when printing the SNORT alerts, the output module rule should be modified to "output alert_fast: output filename". This will print a much smaller packet overview with just enough information to identify the alert, reducing the size of the file. Therefore, option D is the correct answer: D. Modify the output module rule to "output alert_fast: output filename".

21. Question 21 of 25

    The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

    • ADetermine the assets to which the attacker has access
    • BIdentify assets the attacker handled or acquired
    • CChange access controls to high risk assets in the enterprise
    • DIdentify movement of the attacker in the enterprise

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    "documented & given to analyze", which steps taken at this stage? It doesn't confirm an atacker exists (not A) and I wouldn't change anything until I have finished analyzing (Not C). First Identify where the person has been, who they are etc. He might be the new guy and you are lableing him as an attacker, If he seems unusual/mischievous then proceed with ABC.My Answer is: D

    Adapted from community discussion by CiscoTester · 2022-11-28 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. D

       DrVoIP

       2024-02-17

       1 upvote

       At this stage, the following step should be taken: D. Identify movement of the attacker in the enterprise. The first step in responding to any security incident is to identify the scope and extent of the incident. In this case, an unauthorized individual followed an authorized individual to enter a secured premise. Therefore, the security specialist should identify the movement of the attacker in the enterprise, including where the attacker went and what the attacker did while on the premises. Once the movement of the attacker is identified, the security specialist can take appropriate action to contain the incident and minimize any damage or risk. The other options (A, B, and C) may also be important steps in a larger incident response plan, but they are not the appropriate next step in this specific scenario.

    2. C

       CiscoTester

       2022-11-28

       2 upvotes

       "documented & given to analyze", which steps taken at this stage? It doesn't confirm an atacker exists (not A) and I wouldn't change anything until I have finished analyzing (Not C). First Identify where the person has been, who they are etc. He might be the new guy and you are lableing him as an attacker, If he seems unusual/mischievous then proceed with ABC.My Answer is: D

    3. S

       ShammaA

       2024-07-17

       Selected D1 upvote

       Answer is D, the simplest logic is that the attacker is already in the premises so you cant say "A" is an answer because the attacker has followed an "authorized individual" so he basically piggy backed him to enter -- the best answer would be to track him down.

    4. B

       balhimoh

       2023-12-28

       1 upvote

       Hello, Did you passed the exam recently with this dump, the questions are not correct at all in this dump. Can you please confirm, thanks!

22. Question 22 of 25

    A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?

    • Aassessment scope
    • Bevent severity and likelihood
    • Cincident response playbook
    • Drisk model framework

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    According to NIST https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf on page 32 To conduct an assessment the following steps are required: 1) Identify threat sources and events 2) Identify vulnerabilities and predisposing conditions 3) Determine likelihood of occurrence 4) Determine magnitude of impact 5) Determine risk Answer: B

    Adapted from community discussion by SilentJay · 2023-06-22 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. S

       SilentJay

       2023-06-22

       4 upvotes

       According to NIST https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf on page 32 To conduct an assessment the following steps are required: 1) Identify threat sources and events 2) Identify vulnerabilities and predisposing conditions 3) Determine likelihood of occurrence 4) Determine magnitude of impact 5) Determine risk Answer: B

    2. E

       ETSec

       2024-01-21

       1 upvote

       B. Event severity and likelihood A risk assessment of the asset should include an evaluation of the event severity and likelihood. Event severity refers to the level of harm or damage that an event or incident can cause, and likelihood refers to the probability of a specific threat exploiting a specific vulnerability. By considering both of these factors, the risk assessment will provide a more complete understanding of the potential consequences of a successful attack on the web server and the likelihood that it will occur. A. assessment scope, C. incident response playbook, and D. risk model framework are important element but it's more related to the risk assessment process rather than the specific calculation of risk.

    3. M

       marceus

       2025-02-13

       Selected B1 upvote

       ChatGPT: To calculate risk, the analyst needs to determine the impact (severity) of the event and the probability (likelihood) of it occurring. This helps quantify the potential risk to the organization.

    4. J

       jay_c_an

       2024-06-25

       1 upvote

       risk model framework is overall task. For adding one system, likelyhood.

23. Question 23 of 25

    Select 2

    An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)

    • Adomain belongs to a competitor
    • Blog in during non-working hours
    • Cemail forwarding to an external domain
    • Dlog in from a first-seen country
    • Eincreased number of sent mails

    Show answer

    Correct answer: B, D

    How others answered

    • BD100%

    Explanation

    UEBA (User and Entity Behavior Analytics) (D). log in from a first-seen country User Behavior (B). log in during non-working hours User Behavior (C). email forwarding to an external domain This shit dont have sense... UEBA IS User and Entity Behavior Analytics REMEMBER!!

    Adapted from community discussion by jaciro11 · 2023-08-30 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. J

       jaciro11

       2023-08-30

       Selected B, D3 upvotes

       UEBA (User and Entity Behavior Analytics) (D). log in from a first-seen country User Behavior (B). log in during non-working hours User Behavior (C). email forwarding to an external domain This shit dont have sense... UEBA IS User and Entity Behavior Analytics REMEMBER!!

    2. C

       CiscoTester

       2022-11-29

       4 upvotes

       The employee travels often, hes proabaly used to working after work hours (Not B). It would be a pain to feed all competitor domains to UEBA, That was just a surprising conclusion not behavior. I think its CD

    3. E

       ETSec

       2024-01-21

       1 upvote

       My answer is B. log in during non-working hours and C. email forwarding to an external domain UEBA (User and Entity Behavior Analytics) is a security technique that uses machine learning algorithms to identify abnormal behavior within an organization's network. In this scenario, two behaviors that likely triggered an UEBA alert are the employee logging in during non-working hours and forwarding an increased amount of emails to an external mail domain. These behaviors deviate from the employee's normal patterns of activity and may indicate an attempt to exfiltrate sensitive information to a competitor. A. domain belongs to a competitor is not a behavior, it's an information that's used in the investigation process. D. Log in from a first-seen country and E. increased number of sent mails also can be important indicators, but they are not enough to trigger UEBA alerts.

    4. D

       Deco123

       2024-11-08

       1 upvote

       It's C & E, the answer is in the question. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out.

24. Question 24 of 25

    

    Refer to the exhibit. An engineer is performing a static analysis on a malware and knows that it is capturing keys and webcam events on a company server. What is the indicator of compromise?

    • AThe malware is performing comprehensive fingerprinting of the host, including a processor, motherboard manufacturer, and connected removable storage.
    • BThe malware is a ransomware querying for installed anti-virus products and operating systems to encrypt and render unreadable until payment is made for file decryption.
    • CThe malware has moved to harvesting cookies and stored account information from major browsers and configuring a reverse proxy for intercepting network activity.
    • DThe malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.

    Show answer

    Correct answer: D

    How others answered

    • D93%

    Explanation

    D. The malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.

    Adapted from community discussion by Bobster02 · 2023-05-27 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. B

       Bobster02

       2023-05-27

       Selected D11 upvotes

       D. The malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.

    2. E

       ETSec

       2024-07-21

       1 upvote

       D. The malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval. An indicator of compromise (IOC) is a characteristic of an attack that can be used to identify it. In this scenario, the malware is capturing keys and webcam events on a company server. One way it could do this is by using an encryption and decryption routine to hide URLs/IP addresses and storing the output of loggers and webcam captures in locally encrypted files for retrieval. This behavior is an indicator of compromise, as it shows that the malware is attempting to hide its tracks and steal sensitive information from the company.

    3. K

       kyle942

       2024-03-23

       Selected D1 upvote

       https://gist.github.com/yetanotherchris/810c5900616b6c76f78dedda9bf3be85

    4. A

       attiko

       2024-04-30

       Selected D1 upvote

       based on that the code is all about encrypting, the obvious answer is D

25. Question 25 of 25

    Refer to the exhibit. Which indicator of compromise is represented by this STIX?

    

    • Awebsite redirecting traffic to ransomware server
    • Bwebsite hosting malware to download files
    • Cweb server vulnerability exploited by malware
    • Dcross-site scripting vulnerability to backdoor server

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    The STIX (Structured Threat Information eXpression) object in the exhibit indicates that the compromise involves a website hosting malware, which is designed to download files onto a user's system without their knowledge. This type of indicator is commonly associated with drive-by download attacks, where visiting a website can result in the automatic download and execution of malware. The STIX object would contain information about the malicious URLs, file hashes, and other relevant indicators that can be used to detect and prevent such threats.

    Adapted from community discussion by TrainingTeam · 2024-10-21 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 350-201 or CertExamHQ.

    1. T

       TrainingTeam

       2024-10-21

       Selected B2 upvotes

       The STIX (Structured Threat Information eXpression) object in the exhibit indicates that the compromise involves a website hosting malware, which is designed to download files onto a user's system without their knowledge. This type of indicator is commonly associated with drive-by download attacks, where visiting a website can result in the automatic download and execution of malware. The STIX object would contain information about the malicious URLs, file hashes, and other relevant indicators that can be used to detect and prevent such threats.

    2. C

       CiscoTester

       2021-11-29

       2 upvotes

       there are 3 objects, first is type is "Indicator" used for hosting malicious downloads. Answer is: C

    3. 2

       27ea763

       2025-01-23

       Selected B1 upvote

       B - In the STIX it mentions Malicous Site to Download. So would go with B

    4. D

       DrVoIP

       2023-03-08

       1 upvote

       The IoC (Indicator of Compromise) shown in the above STIX is B. Website hosting malware to download files.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 1 of 25