350-201 practice questions 91–100

1. Question 91 · 137 in bank

   

   Refer to the exhibit. Where does it signify that a page will be stopped from loading when a scripting attack is detected?

   • Ax-frame-options
   • Bx-content-type-options
   • Cx-xss-protection
   • Dx-test-debug

   Show answer

   Answer: C

   Explanation

   Reference: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs

   Next question

2. Question 92 · 137 in bank

   What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?

   • A401
   • B402
   • C403
   • D404
   • E405

   Show answer

   Answer: D

   Explanation

   Reference: https://airbrake.io/blog/http-errors/401-unauthorized-error#:~:text=The%20401%20Unauthorized%20Error%20is,client%20could%20not%20be% 20authenticated .

   Next question

3. Question 93 · 137 in bank

   What is a principle of Infrastructure as Code?

   • ASystem maintenance is delegated to software systems
   • BComprehensive initial designs support robust systems
   • CScripts and manual configurations work together to ensure repeatable routines
   • DSystem downtime is grouped and scheduled across the infrastructure

   Show answer

   Answer: A

   Next question

4. Question 94 · 137 in bank

   The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

   • ADetermine the assets to which the attacker has access
   • BIdentify assets the attacker handled or acquired
   • CChange access controls to high risk assets in the enterprise
   • DIdentify movement of the attacker in the enterprise

   Show answer

   Answer: D

   Explanation

   "documented & given to analyze", which steps taken at this stage? It doesn't confirm an atacker exists (not A) and I wouldn't change anything until I have finished analyzing (Not C). First Identify where the person has been, who they are etc. He might be the new guy and you are lableing him as an attacker, If he seems unusual/mischievous then proceed with ABC.My Answer is: D

   Source: Adapted from community discussion — CiscoTester

   Next question

5. Question 95 · 137 in bank

   

   Refer to the exhibit. An engineer configured this SOAR solution workflow to identify account theft threats and privilege escalation, evaluate risk, and respond by resolving the threat. This solution is handling more threats than Security analysts have time to analyze. Without this analysis, the team cannot be proactive and anticipate attacks. Which action will accomplish this goal?

   • AExclude the step ג€BAN malicious IPג€ to allow analysts to conduct and track the remediation
   • BInclude a step ג€Take a Snapshotג€ to capture the endpoint state to contain the threat for analysis
   • CExclude the step ג€Check for GeoIP locationג€ to allow analysts to analyze the location and the associated risk based on asset criticality
   • DInclude a step ג€Reportingג€ to alert the security department of threats identified by the SOAR reporting engine

   Show answer

   Answer: B

   Next question

6. Question 96 · 137 in bank

   DRAG DROP - Drag and drop the telemetry-related considerations from the left onto their cloud service models on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For me answer is wrong. It should be: SaaS - The customer controls limited application configuration settings and obtaining logs for security monitoring may be limited PaaS - Logs, alerts and events for application performance monitoring and application health are configurable by the customer IaaS - Logs, alerts and events for operating systems are configurable by the customer

   Source: Adapted from community discussion — Keannan

   References

   • redhat.com documentation

   

   Next question

7. Question 97 · 137 in bank

   A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?

   • Aassessment scope
   • Bevent severity and likelihood
   • Cincident response playbook
   • Drisk model framework

   Show answer

   Answer: B

   Explanation

   According to NIST https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf on page 32 To conduct an assessment the following steps are required: 1) Identify threat sources and events 2) Identify vulnerabilities and predisposing conditions 3) Determine likelihood of occurrence 4) Determine magnitude of impact 5) Determine risk Answer: B

   Source: Adapted from community discussion — SilentJay

   References

   • nist.gov documentation

   Next question

8. Question 98 · 137 in bank

   DRAG DROP - Drag and drop the components from the left onto the phases of the CI/CD pipeline on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.densify.com/resources/continuous-integration-delivery-phases

   

   Next question

9. Question 99 · 137 in bank

   Select 2

   An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)

   • Adomain belongs to a competitor
   • Blog in during non-working hours
   • Cemail forwarding to an external domain
   • Dlog in from a first-seen country
   • Eincreased number of sent mails

   Show answer

   Answer: BD

   Explanation

   UEBA (User and Entity Behavior Analytics) (D). log in from a first-seen country User Behavior (B). log in during non-working hours User Behavior (C). email forwarding to an external domain This shit dont have sense... UEBA IS User and Entity Behavior Analytics REMEMBER!!

   Source: Adapted from community discussion — jaciro11

   Next question

10. Question 100 · 137 in bank

    How is a SIEM tool used?

    • ATo collect security data from authentication failures and cyber attacks and forward it for analysis
    • BTo search and compare security data against acceptance standards and generate reports for analysis
    • CTo compare security alerts against configured scenarios and trigger system responses
    • DTo collect and analyze security data from network devices and servers and produce alerts

    Show answer

    Answer: D

    Explanation

    Reference: https://www.varonis.com/blog/what-is-siem/

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 91. 137 questions available.