Performing CyberOps Using Cisco Security Technologies (CBRCOR)137 questions across 14 pages are complete and free, with no account or card.
137 questions in this bank
Free access · progress saved on this device
DRAG DROP - Drag and drop the actions below the image onto the boxes in the image for the actions that should be taken during this playbook step. Not all options are used. Select and Place:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
An engineer is utilizing interactive behavior analysis to test malware in a sandbox environment to see how the malware performs when it is successfully executed. A location is secured to perform reverse engineering on a piece of malware. What is the next step the engineer should take to analyze this malware?
Answer: A
for me it should be A is the answer "Run the program through a debugger to see the sequential actions" before in the first place why did you put and analyze the malware on a isolated sandbox if you have just search it online? They're a lot of tools to perform static and dynamic malware analysis like Malware STATIC Analysis tools: Hybrid Analysis Cuckoo Sandbox Jotti Valkyrie Sandbox Malware DYNAMIC Analysis tools: Process Explorer OpManager Monit Advanced Windows Service Manager Process Hacker Netwrix Service Monitor AnVir Task Manager please correct me if I'm wrong.
Source: Adapted from community discussion — chongchangchi
What is a limitation of cyber security risk insurance?
Answer: C
Reference: https://tplinsurance.com/products/cyber-risk-insurance/
Source: Adapted from community discussion — DrVoIP
An engineer returned to work and realized that payments that were received over the weekend were sent to the wrong recipient. The engineer discovered that the SaaS tool that processes these payments was down over the weekend. Which step should the engineer take first?
Answer: B
he first step the engineer should take is to immediately notify the appropriate personnel of the error so that they can take the necessary steps to mitigate any potential damage. Therefore, option B, contact the incident response team to inform them of a potential breach, would be the best first step to take. This will help ensure that the incident is properly documented, investigated, and managed. Once the incident response team has been notified, the engineer can work with them to determine the root cause of the issue and develop a plan to prevent it from happening again in the future. - ChatGPT
Source: Adapted from community discussion — DrVoIP
An analyst is alerted for a malicious file hash. After analysis, the analyst determined that an internal workstation is communicating over port 80 with an external server and that the file hash is associated with Duqu malware. Which tactics, techniques, and procedures align with this analysis?
Answer: A
DRAG DROP - Drag and drop the function on the left onto the mechanism on the right. Select and Place:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Automation – creates the set of executable tasks Automation – minimizes redundancies and streamlines repetitive tasks. Orchestration – systematically executes large workflows Orchestration - organizes components to seamlessly run applications.
Source: Adapted from community discussion — Casperov
Refer to the exhibit. How must these advisories be prioritized for handling?
Answer: B
I also think this should be B. All that is needed is port 80 access on #2 whereas #1 requires a login by a privileged account to exploit.
Source: Adapted from community discussion — vprollc
A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?
Answer: A
Reference: https://eclecticlight.co/2016/02/06/the-ultimate-diagnostic-tool-sysdiagnose/
A SOC analyst is investigating a recent email delivered to a high-value user for a customer whose network their organization monitors. The email includes a suspicious attachment titled `Invoice RE: 0004489`. The hash of the file is gathered from the Cisco Email Security Appliance. After searching Open Source Intelligence, no available history of this hash is found anywhere on the web. What is the next step in analyzing this attachment to allow the analyst to gather indicators of compromise?
Answer: D
D. Obtain a copy of the file for detonation in a sandbox. Since no available history of the file hash was found anywhere on the web, the best next step would be to obtain a copy of the file and detonate it in a sandbox environment to gather indicators of compromise. This will help to determine whether the attachment is malicious or not and provide additional information for further investigation. Running and analyzing the DLP Incident Summary Report or investigating in open-source repositories using YARA may provide additional information but are not the best next step in this scenario. Asking the company to execute the payload for real-time analysis is not recommended as it could result in potential damage or loss of data. - ChatGPT
Source: Adapted from community discussion — DrVoIP
A SOC analyst is notified by the network monitoring tool that there are unusual types of internal traffic on IP subnet 103.921.2239.0/24. The analyst discovers unexplained encrypted data files on a computer system that belongs on that specific subnet. What is the cause of the issue?
Answer: C
The question has an error in the IP address, so I resubmitted it: The cause of the issue is more likely a malware outbreak. The unusual types of internal traffic and the presence of unexplained encrypted data files on a system are indicators of a possible malware infection. The specific IP subnet may have been targeted by the attacker to spread the malware within the network. The SOC analyst should conduct further analysis to identify the malware type and determine the extent of the infection to mitigate the issue.
Source: Adapted from community discussion — DrVoIP
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
350-201 practice, question 121. 137 questions available.
Version 1.0.0. How we source questions