350-201 practice questions 11–20

1. Question 11 · 137 in bank

   The SIEM tool informs a SOC team of a suspicious file. The team initializes the analysis with an automated sandbox tool, sets up a controlled laboratory to examine the malware specimen, and proceeds with behavioral analysis. What is the next step in the malware analysis process?

   • APerform static and dynamic code analysis of the specimen.
   • BUnpack the specimen and perform memory forensics.
   • CContain the subnet in which the suspicious file was found.
   • DDocument findings and clean-up the laboratory.

   Show answer

   Answer: A

   Explanation

   The next step in the malware analysis process would be to perform static and dynamic code analysis of the specimen. After performing behavioral analysis, static analysis involves examining the code and characteristics of the malware to identify any recognizable patterns or signatures, while dynamic analysis involves observing the behavior of the malware in a controlled environment to understand its methods of attack and any associated network communications. These steps help in developing countermeasures and detection methods for similar types of malware. - ChatGPT

   Source: Adapted from community discussion — DrVoIP

   Next question

2. Question 12 · 137 in bank

   DRAG DROP - Drag and drop the phases to evaluate the security posture of an asset from the left onto the activity that happens during the phases on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think you have the las two wrong. Recon gathers info from many sources not only probing the target. Enumeration focuses on probing the taget. it should be: Vulnerability assessment - Confirming the existence of known vulnerabilities in the target system Persistence - Inserting backdoor access or covert channels to ensure access to target system Exploit - Using previously identified vulnerabilities to gain access to the target system Cover tracks - Erasing traces of actions in audit logs and registry entries *Reconnaissance - Gathering information on a target for future use *Enumeration - Probing the target to discover operating system details

   Source: Adapted from community discussion — CiscoTester

   

   Next question

3. Question 13 · 137 in bank

   A logistic company must use an outdated application located in a private VLAN during the migration to new technologies. The IPS blocked and reported an unencrypted communication. Which tuning option should be applied to IPS?

   • AAllow list only authorized hosts to contact the application's IP at a specific port.
   • BAllow list HTTP traffic through the corporate VLANS.
   • CAllow list traffic to application's IP from the internal network at a specific port.
   • DAllow list only authorized hosts to contact the application's VLAN.

   Show answer

   Answer: A

   Next question

4. Question 14 · 137 in bank

   A company recently started accepting credit card payments in their local warehouses and is undergoing a PCI audit. Based on business requirements, the company needs to store sensitive authentication data for 45 days. How must data be stored for compliance?

   • Apost-authorization by non-issuing entities if there is a documented business justification
   • Bby entities that issue the payment cards or that perform support issuing services
   • Cpost-authorization by non-issuing entities if the data is encrypted and securely stored
   • Dby issuers and issuer processors if there is a legitimate reason

   Show answer

   Answer: C

   Next question

5. Question 15 · 137 in bank

   A security engineer discovers that a spreadsheet containing confidential information for nine of their employees was fraudulently posted on a competitor's website. The spreadsheet contains names, salaries, and social security numbers. What is the next step the engineer should take in this investigation?

   • ADetermine if there is internal knowledge of this incident.
   • BCheck incoming and outgoing communications to identify spoofed emails.
   • CDisconnect the network from Internet access to stop the phishing threats and regain control.
   • DEngage the legal department to explore action against the competitor that posted the spreadsheet.

   Show answer

   Answer: A

   Explanation

   D. Engage the legal department to explore action against the competitor that posted the spreadsheet. The unauthorized disclosure of confidential information poses a significant risk to an organization, and the legal department should be involved immediately to determine if any legal action can be taken against the competitor. Additionally, the security engineer should also investigate how the spreadsheet was leaked and determine if any internal personnel had a role in the incident. - ChatGPT

   Source: Adapted from community discussion — DrVoIP

   Next question

6. Question 16 · 137 in bank

   An engineer notices that every Sunday night, there is a two-hour period with a large load of network activity. Upon further investigation, the engineer finds that the activity is from locations around the globe outside the organization's service area. What are the next steps the engineer must take?

   • AAssign the issue to the incident handling provider because no suspicious activity has been observed during business hours.
   • BReview the SIEM and FirePower logs, block all traffic, and document the results of calling the call center.
   • CDefine the access points using StealthWatch or SIEM logs, understand services being offered during the hours in question, and cross-correlate other source events.
   • DTreat it as a false positive, and accept the SIEM issue as valid to avoid alerts from triggering on weekends.

   Show answer

   Answer: C

   Explanation

   The next steps the engineer must take are to define the access points using StealthWatch or SIEM logs, understand the services being offered during the hours in question, and cross-correlate other source events. This will help to identify the root cause of the abnormal network activity, determine if it is malicious or not, and take appropriate action to address the issue. Simply accepting the SIEM issue as valid to avoid alerts from triggering on weekends or assigning the issue to the incident handling provider without further investigation may leave the organization vulnerable to potential threats. - ChatGPT

   Source: Adapted from community discussion — DrVoIP

   Next question

7. Question 17 · 137 in bank

   An organization had an incident with the network availability during which devices unexpectedly malfunctioned. An engineer is investigating the incident and found that the memory pool buffer usage reached a peak before the malfunction. Which action should the engineer take to prevent this issue from reoccurring?

   • ADisable memory limit.
   • BDisable CPU threshold trap toward the SNMP server.
   • CEnable memory tracing notifications.
   • DEnable memory threshold notifications.

   Show answer

   Answer: D

   Next question

8. Question 18 · 137 in bank

   A SOC analyst detected a ransomware outbreak in the organization coming from a malicious email attachment. Affected parties are notified, and the incident response team is assigned to the case. According to the NIST incident response handbook, what is the next step in handling the incident?

   • ACreate a follow-up report based on the incident documentation.
   • BPerform a vulnerability assessment to find existing vulnerabilities.
   • CEradicate malicious software from the infected machines.
   • DCollect evidence and maintain a chain-of-custody during further analysis.

   Show answer

   Answer: C

   Next question

9. Question 19 · 137 in bank

   A security manager received an email from an anomaly detection service, that one of their contractors has downloaded 50 documents from the company's confidential document management folder using a company-owned asset al039-ice-4ce687TL0500. A security manager reviewed the content of downloaded documents and noticed that the data affected is from different departments. What are the actions a security manager should take?

   • AMeasure confidentiality level of downloaded documents.
   • BReport to the incident response team.
   • CEscalate to contractor's manager.
   • DCommunicate with the contractor to identify the motives.

   Show answer

   Answer: B

   Next question

10. Question 20 · 137 in bank

    An engineer detects an intrusion event inside an organization's network and becomes aware that files that contain personal data have been accessed. Which action must be taken to contain this attack?

    • ADisconnect the affected server from the network.
    • BAnalyze the source.
    • CAccess the affected server to confirm compromised files are encrypted.
    • DDetermine the attack surface.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 11. 137 questions available.