350-201 practice questions 51–60

1. Question 51 · 137 in bank

   DRAG DROP - An organization lost connectivity to critical servers, and users cannot access business applications and internal websites. An engineer checks the network devices to investigate the outage and determines that all devices are functioning. Drag and drop the steps from the left into the sequence on the right to continue investigating this issue. Not all options are used. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1 Verify Memory State, 2 check memory logs, 3 Generate Core File, 4 Validate MD5.... I wouldn't nomrallym TS by reading the whole running config or ACLs unless I someone was working on the network devices.

   Source: Adapted from community discussion — CiscoTester

   

   Next question

2. Question 52 · 137 in bank

   DRAG DROP - An engineer notices that unauthorized software was installed on the network and discovers that it was installed by a dormant user account. The engineer suspects an escalation of privilege attack and responds to the incident. Drag and drop the activities from the left into the order for the response on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

3. Question 53 · 137 in bank

   An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?

   • Adiagnostic
   • Bqualitative
   • Cpredictive
   • Dstatistical

   Show answer

   Answer: C

   Explanation

   Reference: https://insights.principa.co.za/4-types-of-data-analytics-descriptive-diagnostic-predictive-prescriptive

   Next question

4. Question 54 · 137 in bank

   A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

   • AAssess the network for unexpected behavior
   • BIsolate critical hosts from the network
   • CPatch detected vulnerabilities from critical hosts
   • DPerform analysis based on the established risk factors

   Show answer

   Answer: B

   Next question

5. Question 55 · 137 in bank

   

   Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop automatically submitted a low prevalence file to the Threat Grid analysis engine. What should be concluded from this report?

   • AThreat scores are high, malicious ransomware has been detected, and files have been modified
   • BThreat scores are low, malicious ransomware has been detected, and files have been modified
   • CThreat scores are high, malicious activity is detected, but files have not been modified
   • DThreat scores are low and no malicious file activity is detected

   Show answer

   Answer: D

   Explanation

   If you check the other image from similar question, the report will specify "Ransomeware" and "Modified File" those are not found here. Answer is D

   Source: Adapted from community discussion — CiscoTester

   Next question

6. Question 56 · 137 in bank

   An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

   • AImplement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.
   • BIntegrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.
   • CImplement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.
   • DIntegrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.

   Show answer

   Answer: C

   Next question

7. Question 57 · 137 in bank

   DRAG DROP - Drag and drop the NIST incident response process steps from the left onto the actions that occur in the steps on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.securitymetrics.com/blog/6-phases-incident-response-plan

   Source: Adapted from community discussion — Keannan

   References

   • nist.gov documentation

   

   Next question

8. Question 58 · 137 in bank

   Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?

   • Achmod 666
   • Bchmod 774
   • Cchmod 775
   • Dchmod 777

   Show answer

   Answer: D

   Explanation

   Reference: https://www.pluralsight.com/blog/it-ops/linux-file-permissions

   Next question

9. Question 59 · 137 in bank

   A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?

   • ABlock the source IP from the firewall
   • BPerform an antivirus scan on the laptop
   • CIdentify systems or services at risk
   • DIdentify lateral movement

   Show answer

   Answer: C

   Explanation

   You have already identified a few systems at risk, not C. Somehow you know there is an attempt to connect using VPN, blocking seems logical. answer :A

   Source: Adapted from community discussion — CiscoTester

   Next question

10. Question 60 · 137 in bank

    A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

    • ADetermine the systems involved and deploy available patches
    • BAnalyze event logs and restrict network access
    • CReview access lists and require users to increase password complexity
    • DIdentify the attack vector and update the IDS signature list

    Show answer

    Answer: A

    Explanation

    ChatGPT: During the recovery stage of the incident response process, the focus is on restoring affected systems to a secure state and preventing reinfection.

    Source: Adapted from community discussion — marceus

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 51. 137 questions available.