350-201 practice questions 81–90

1. Question 81 · 137 in bank

   An API developer is improving an application code to prevent DDoS attacks. The solution needs to accommodate instances of a large number of API requests coming for legitimate purposes from trustworthy services. Which solution should be implemented?

   • ARestrict the number of requests based on a calculation of daily averages. If the limit is exceeded, temporarily block access from the IP address and return a 402 HTTP error code.
   • BImplement REST API Security Essentials solution to automatically mitigate limit exhaustion. If the limit is exceeded, temporarily block access from the service and return a 409 HTTP error code.
   • CIncrease a limit of replies in a given interval for each API. If the limit is exceeded, block access from the API key permanently and return a 450 HTTP error code.
   • DApply a limit to the number of requests in a given time interval for each API. If the rate is exceeded, block access from the API key temporarily and return a 429 HTTP error code.

   Show answer

   Answer: D

   Explanation

   Reference: https://www.whoishostingthis.com/resources/http-status-codes/

   Next question

2. Question 82 · 137 in bank

   

   Refer to the exhibit. IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?

   • ABlock list of internal IPs from the rule
   • BChange the rule content match to case sensitive
   • CSet the rule to track the source IP
   • DTune the count and seconds threshold of the rule

   Show answer

   Answer: C

   Next question

3. Question 83 · 137 in bank

   

   Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

   • AThe prioritized behavioral indicators of compromise do not justify the execution of the ג€ransomwareג€ because the scores do not indicate the likelihood of malicious ransomware.
   • BThe prioritized behavioral indicators of compromise do not justify the execution of the ג€ransomwareג€ because the scores are high and do not indicate the likelihood of malicious ransomware.
   • CThe prioritized behavioral indicators of compromise justify the execution of the ג€ransomwareג€ because the scores are high and indicate the likelihood that malicious ransomware has been detected.
   • DThe prioritized behavioral indicators of compromise justify the execution of the ג€ransomwareג€ because the scores are low and indicate the likelihood that malicious ransomware has been detected.

   Show answer

   Answer: C

   Explanation

   it is C The prioritized behavioral indicators of compromise justify the execution of the ג€ransomwareג€ because the scores are high and indicate the likelihood that malicious ransomware has been detected

   Source: Adapted from community discussion — TOLU1985

   Next question

4. Question 84 · 137 in bank

   Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?

   • Acustomer data
   • Binternal database
   • Cinternal cloud
   • DInternet

   Show answer

   Answer: D

   Next question

5. Question 85 · 137 in bank

   An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?

   • AModify the alert rule to ג€output alert_syslog: output logג€
   • BModify the output module rule to ג€output alert_quick: output filenameג€
   • CModify the alert rule to ג€output alert_syslog: output headerג€
   • DModify the output module rule to ג€output alert_fast: output filenameג€

   Show answer

   Answer: D

   Explanation

   2.6.2 alert_fast This will print Snort alerts in a quick one-line format to a specified output file. It is a faster alerting method than full alerts because it doesn't need to print all of the packet headers to the output file and because it logs to only 1 file.

   Source: Adapted from community discussion — tukan

   Next question

6. Question 86 · 137 in bank

   DRAG DROP - Drag and drop the type of attacks from the left onto the cyber kill chain stages at which the attacks are seen on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reconnaissance - Open port scans and multiple failed logins from the websites Weaponization - Not visible to the victim Delivery - USB with infected files inserted into company laptop Exploitation - Virus scanner turning off Installation - Malware placed on the targeted system C&C - System phones connecting to countries where no staff are located Actions on objectives - Large amount of data leaving the network through unusual ports

   Source: Adapted from community discussion — CiscoTester

   

   Next question

7. Question 87 · 137 in bank

   

   Refer to the exhibit. An engineer received a report that an attacker has compromised a workstation and gained access to sensitive customer data from the network using insecure protocols. Which action prevents this type of attack in the future?

   • AUse VLANs to segregate zones and the firewall to allow only required services and secured protocols
   • BDeploy a SOAR solution and correlate log alerts from customer zones
   • CDeploy IDS within sensitive areas and continuously update signatures
   • DUse syslog to gather data from multiple sources and detect intrusion logs for timely responses

   Show answer

   Answer: A

   Next question

8. Question 88 · 137 in bank

   How does Wireshark decrypt TLS network traffic?

   • Awith a key log file using per-session secrets
   • Busing an RSA public key
   • Cby observing DH key exchange
   • Dby defining a user-specified decode-as

   Show answer

   Answer: A

   Next question

9. Question 89 · 137 in bank

   

   Refer to the exhibit. An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company's user creation policy: ✑ minimum length: 3 ✑ usernames can only use letters, numbers, dots, and underscores ✑ usernames cannot begin with a number The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames. Which change is needed to apply the restrictions?

   • Amodify code to return error on restrictions def return false_user(username, minlen)
   • Bautomate the restrictions def automate_user(username, minlen)
   • Cvalidate the restrictions, def validate_user(username, minlen)
   • Dmodify code to force the restrictions, def force_user(username, minlen)

   Show answer

   Answer: C

   Next question

10. Question 90 · 137 in bank

    An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?

    • AMeet with privileged users to increase awareness and modify the rules for threat tags and anomalous behavior alerts
    • BChange the SOAR configuration flow to remove the automatic remediation that is increasing the false positives and triggering threats
    • CAdd a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts
    • DIncrease incorrect login tries and tune anomalous user behavior not to affect privileged accounts

    Show answer

    Answer: C

    Explanation

    C. Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts

    Source: Adapted from community discussion — Bobster02

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-201 practice, question 81. 137 questions available.