350-201 practice questions 21–30

1. Question 21 · 137 in bank

   The network operations center has identified malware, created a ticket within their ticketing system, and assigned the case to the SOC with high-level information. A SOC analyst was able to stop the malware from spreading and identified the attacking host. What is the next step in the incident response workflow?

   • Aeradication and recovery
   • Bpost-incident activity
   • Ccontainment
   • Ddetection and analysis

   Show answer

   Answer: C

   Explanation

   The next step in the incident response workflow after stopping the malware from spreading and identifying the attacking host is containment. The goal of containment is to isolate and limit the impact of the incident to prevent further damage or data loss. - ChatGPT

   Source: Adapted from community discussion — DrVoIP

   Next question

2. Question 22 · 137 in bank

   A SOC engineer discovers that the organization had three DDOS attacks overnight. Four servers are reported offline, even though the hardware seems to be working as expected. One of the offline servers is affecting the pay system reporting times. Three employees, including executive management, have reported ransomware on their laptops. Which steps help the engineer understand a comprehensive overview of the incident?

   • ARun and evaluate a full packet capture on the workloads, review SIEM logs, and define a root cause.
   • BRun and evaluate a full packet capture on the workloads, review SIEM logs, and plan mitigation steps.
   • CCheck SOAR to learn what the security systems are reporting about the overnight events, research the attacks, and plan mitigation step.
   • DCheck SOAR to know what the security systems are reporting about the overnight events, review the threat vectors, and define a root cause.

   Show answer

   Answer: A

   Next question

3. Question 23 · 137 in bank

   According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?

   • APerform a vulnerability assessment
   • BConduct a data protection impact assessment
   • CConduct penetration testing
   • DPerform awareness testing

   Show answer

   Answer: B

   Next question

4. Question 24 · 137 in bank

   Which action should be taken when the HTTP response code 301 is received from a web application?

   • AUpdate the cached header metadata.
   • BConfirm the resource's location.
   • CIncrease the allowed user limit.
   • DModify the session timeout setting.

   Show answer

   Answer: B

   Explanation

   When the HTTP response code 301 is received from a web application, the appropriate action is to confirm the resource's location. The HTTP 301 response code indicates that the requested resource has moved permanently to a new URL, and the new URL should be used for future requests. By confirming the new location, clients can ensure they are accessing the most up-to-date resource. Updating the cached header metadata, increasing the allowed user limit, and modifying the session timeout setting are not relevant actions to take in response to an HTTP 301 response code. - ChatGPT

   Source: Adapted from community discussion — DrVoIP

   Next question

5. Question 25 · 137 in bank

   Select 2

   Employees receive an email from an executive within the organization that summarizes a recent security breach and requests that employees verify their credentials through a provided link. Several employees report the email as suspicious, and a security analyst is investigating the reports. Which two steps should the analyst take to begin this investigation? (Choose two.)

   • AEvaluate the intrusion detection system alerts to determine the threat source and attack surface.
   • BCommunicate with employees to determine who opened the link and isolate the affected assets.
   • CExamine the firewall and HIPS configuration to identify the exploited vulnerabilities and apply recommended mitigation.
   • DReview the mail server and proxy logs to identify the impact of a potential breach.
   • ECheck the email header to identify the sender and analyze the link in an isolated environment.

   Show answer

   Answer: DE

   Explanation

   You need to check how the attack was delivered and who open the link: proxy you can check the users who open the link email you can check the users who received the link Check the email header and open the link in a sandbox Check the headers to know from where the email comes if is possible at all Open the link in a sandbox to see the behaviors D and E

   Source: Adapted from community discussion — jaciro11

   Next question

6. Question 26 · 137 in bank

   A SOC team is investigating a recent, targeted social engineering attack on multiple employees. Cross-correlated log analysis revealed that two hours before the attack, multiple assets received requests on TCP port 79. Which action should be taken by the SOC team to mitigate this attack?

   • ADisable BIND forwarding from the DNS server to avoid reconnaissance.
   • BDisable affected assets and isolate them for further investigation.
   • CConfigure affected devices to disable NETRJS protocol.
   • DConfigure affected devices to disable the Finger service.

   Show answer

   Answer: D

   Next question

7. Question 27 · 137 in bank

   What is idempotence?

   • Athe assurance of system uniformity throughout the whole delivery process
   • Bthe ability to recover from failures while keeping critical services running
   • Cthe necessity of setting maintenance of individual deployment environments
   • Dthe ability to set the target environment configuration regardless of the starting state

   Show answer

   Answer: D

   Explanation

   D. the ability to set the target environment configuration regardless of the starting state is idempotence. In other words, performing the same operation multiple times should have the same effect as performing it only once. This is a key property of automation and infrastructure-as-code systems, where the desired state of a system is defined and then automatically applied to ensure that it is always in the correct state, regardless of its current state. - ChatGPT

   Source: Adapted from community discussion — DrVoIP

   References

   • Microsoft Learn

   Next question

8. Question 28 · 137 in bank

   A security architect in an automotive factory is working on the Cyber Security Management System and is implementing procedures and creating policies to prevent attacks. Which standard must the architect apply?

   • AIEC62446
   • BIEC62443
   • CIEC62439-3
   • DIEC62439-2

   Show answer

   Answer: B

   Next question

9. Question 29 · 137 in bank

   Select 2

   An organization suffered a security breach in which the attacker exploited a Netlogon Remote Protocol vulnerability for further privilege escalation. Which two actions should the incident response team take to prevent this type of attack from reoccurring? (Choose two.)

   • AImplement a patch management process.
   • BScan the company server files for known viruses.
   • CApply existing patches to the company servers.
   • DAutomate antivirus scans of the company servers.
   • EDefine roles and responsibilities in the incident response playbook.

   Show answer

   Answer: AC

   References

   • nist.gov documentation

   Next question

10. Question 30 · 137 in bank

    

    Refer to the exhibit. Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?

    • AAn attacker can initiate a DoS attack.
    • BAn attacker can read or change data.
    • CAn attacker can transfer data to an external server.
    • DAn attacker can modify the access logs.

    Show answer

    Answer: B

    Explanation

    The threat model for the SQL database in this scenario is that an attacker can read or change data, as both types of clients are accessing the core database that manages transactions and access control. This means that an attacker who gains access to the SQL database could potentially view or modify sensitive data, such as user account information or transaction details. Therefore, protecting against unauthorized access to the database and implementing appropriate access controls are critical to mitigating this threat. - ChatGPT

    Source: Adapted from community discussion — DrVoIP

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 21. 137 questions available.