350-201 practice questions 101–110

1. Question 101 · 137 in bank

   

   Refer to the exhibit. An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?

   • Aa DOS MZ executable format
   • Ba MS-DOS executable archive
   • Can archived malware
   • Da Windows executable file

   Show answer

   Answer: A

   Explanation

   The DOS MZ executable format is the executable file format used for. EXE files in DOS. The file can be identified by the ASCII string "MZ" (hexadecimal: 4D 5A) at the beginning of the file (the "magic number").

   Source: Adapted from community discussion — kyle942

   Next question

2. Question 102 · 137 in bank

   

   Refer to the exhibit. An engineer is performing a static analysis on a malware and knows that it is capturing keys and webcam events on a company server. What is the indicator of compromise?

   • AThe malware is performing comprehensive fingerprinting of the host, including a processor, motherboard manufacturer, and connected removable storage.
   • BThe malware is a ransomware querying for installed anti-virus products and operating systems to encrypt and render unreadable until payment is made for file decryption.
   • CThe malware has moved to harvesting cookies and stored account information from major browsers and configuring a reverse proxy for intercepting network activity.
   • DThe malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.

   Show answer

   Answer: D

   Explanation

   D. The malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.

   Source: Adapted from community discussion — Bobster02

   Next question

3. Question 103 · 137 in bank

   An audit is assessing a small business that is selling automotive parts and diagnostic services. Due to increased customer demands, the company recently started to accept credit card payments and acquired a POS terminal. Which compliance regulations must the audit apply to the company?

   • AHIPAA
   • BFISMA
   • CCOBIT
   • DPCI DSS

   Show answer

   Answer: D

   Explanation

   Reference: https://upserve.com/restaurant-insider/restaurant-pos-pci-compliance-checklist/

   Next question

4. Question 104 · 137 in bank

   A customer is using a central device to manage network devices over SNMPv2. A remote attacker caused a denial of service condition and can trigger this vulnerability by issuing a GET request for the ciscoFlashMIB OID on an affected device. Which should be disabled to resolve the issue?

   • ASNMPv2
   • BTCP small services
   • Cport UDP 161 and 162
   • DUDP small services

   Show answer

   Answer: A

   Explanation

   Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-0161

   References

   • cisco.com documentation

   Next question

5. Question 105 · 137 in bank

   Select 2

   A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment. The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)

   • Aincident response playbooks
   • Basset vulnerability assessment
   • Creport of staff members with asset relations
   • Dkey assets and executives
   • Emalware analysis report

   Show answer

   Answer: BE

   Explanation

   Reference: https://cloudogre.com/risk-assessment/

   Source: Adapted from community discussion — DrVoIP

   Next question

6. Question 106 · 137 in bank

   DRAG DROP - Drag and drop the mitigation steps from the left onto the vulnerabilities they mitigate on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

7. Question 107 · 137 in bank

   Refer to the exhibit. Which indicator of compromise is represented by this STIX?

   

   • Awebsite redirecting traffic to ransomware server
   • Bwebsite hosting malware to download files
   • Cweb server vulnerability exploited by malware
   • Dcross-site scripting vulnerability to backdoor server

   Show answer

   Answer: B

   Explanation

   The STIX (Structured Threat Information eXpression) object in the exhibit indicates that the compromise involves a website hosting malware, which is designed to download files onto a user's system without their knowledge. This type of indicator is commonly associated with drive-by download attacks, where visiting a website can result in the automatic download and execution of malware. The STIX object would contain information about the malicious URLs, file hashes, and other relevant indicators that can be used to detect and prevent such threats.

   Source: Adapted from community discussion — TrainingTeam

   Next question

8. Question 108 · 137 in bank

   Refer to the exhibit. What is occurring in this packet capture?

   

   • ATCP port scan
   • BTCP flood
   • CDNS flood
   • DDNS tunneling

   Show answer

   Answer: B

   Next question

9. Question 109 · 137 in bank

   DRAG DROP - Drag and drop the cloud computing service descriptions from the left onto the cloud service categories on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Agree with Bobster02 answered. Remember PaaS is for developer and SaaS is not to be an IT expert. #SaaS companies deliver their products via the internet to the end-users. And the great thing about it is that you don't have to be an IT expert or software engineer to install and use the SaaS app on each computer. Many of these apps directly run on a web browser, which means you only need a computer, a browser, and an internet connection to access them. #PaaS is delivered almost the same way as SaaS, i.e., over the internet. However, instead of providing software over the web, it gives necessary development tools, operating systems, and infrastructure to the developers to build apps and software that perform specific functions. https://markuphero.com/blog/saas-vs-paas/

   Source: Adapted from community discussion — chongchangchi

   

   Next question

10. Question 110 · 137 in bank

    

    Refer to the exhibit. What is the threat in this Wireshark traffic capture?

    • AA high rate of SYN packets being sent from multiple sources toward a single destination IP
    • BA flood of ACK packets coming from a single source IP to multiple destination IPs
    • CA high rate of SYN packets being sent from a single source IP toward multiple destination IPs
    • DA flood of SYN packets coming from a single source IP to a single destination IP

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 101. 137 questions available.