[Dec-2021] The Best CyberOps Professional Study Guide for the 350-201 Exam
350-201 certification guide Q&A from Training Expert PracticeMaterial
NEW QUESTION 82
Drag and drop the mitigation steps from the left onto the vulnerabilities they mitigate on the right.
Answer:
Explanation:
NEW QUESTION 83
A security engineer discovers that a spreadsheet containing confidential information for nine of their employees was fraudulently posted on a competitor's website. The spreadsheet contains names, salaries, and social security numbers. What is the next step the engineer should take in this investigation?
- A. Check incoming and outgoing communications to identify spoofed emails.
- B. Determine if there is internal knowledge of this incident.
- C. Engage the legal department to explore action against the competitor that posted the spreadsheet.
- D. Disconnect the network from Internet access to stop the phishing threats and regain control.
Answer: C
NEW QUESTION 84
An engineer is moving data from NAS servers in different departments to a combined storage database so that the data can be accessed and analyzed by the organization on-demand. Which data management process is being used?
- A. data ingestion
- B. data clustering
- C. data regression
- D. data obfuscation
Answer: B
NEW QUESTION 85
An engineer detects an intrusion event inside an organization's network and becomes aware that files that contain personal data have been accessed. Which action must be taken to contain this attack?
- A. Disconnect the affected server from the network.
- B. Access the affected server to confirm compromised files are encrypted.
- C. Analyze the source.
- D. Determine the attack surface.
Answer: B
NEW QUESTION 86
Drag and drop the NIST incident response process steps from the left onto the actions that occur in the steps on the right.
Answer:
Explanation:
Reference:
https://www.securitymetrics.com/blog/6-phases-incident-response-plan
NEW QUESTION 87
Drag and drop the telemetry-related considerations from the left onto their cloud service models on the right.
Answer:
Explanation:
NEW QUESTION 88
Drag and drop the actions below the image onto the boxes in the image for the actions that should be taken during this playbook step. Not all options are used.
Answer:
Explanation:
NEW QUESTION 89
A security incident affected an organization's critical business services, and the customer-side web API became unresponsive and crashed. An investigation revealed a spike of API call requests and a high number of inactive sessions during the incident. Which two recommendations should the engineers make to prevent similar incidents in the future? (Choose two.)
- A. Implement API key maintenance.
- B. Decrease simultaneous API responses.
- C. Determine API rate-limiting requirements.
- D. Configure shorter timeout periods.
- E. Automate server-side error reporting for customers.
Answer: C,E
NEW QUESTION 90
A security manager received an email from an anomaly detection service, that one of their contractors has downloaded 50 documents from the company's confidential document management folder using a company- owned asset al039-ice-4ce687TL0500. A security manager reviewed the content of downloaded documents and noticed that the data affected is from different departments. What are the actions a security manager should take?
- A. Measure confidentiality level of downloaded documents.
- B. Escalate to contractor's manager.
- C. Report to the incident response team.
- D. Communicate with the contractor to identify the motives.
Answer: C
NEW QUESTION 91
Refer to the exhibit.
An engineer received a report that an attacker has compromised a workstation and gained access to sensitive customer data from the network using insecure protocols. Which action prevents this type of attack in the future?
- A. Use VLANs to segregate zones and the firewall to allow only required services and secured protocols
- B. Deploy IDS within sensitive areas and continuously update signatures
- C. Use syslog to gather data from multiple sources and detect intrusion logs for timely responses
- D. Deploy a SOAR solution and correlate log alerts from customer zones
Answer: A
NEW QUESTION 92
Refer to the exhibit.
Where does it signify that a page will be stopped from loading when a scripting attack is detected?
- A. x-content-type-options
- B. x-test-debug
- C. x-frame-options
- D. x-xss-protection
Answer: D
NEW QUESTION 93 
Refer to the exhibit. An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?
- A. a Windows executable file
- B. a MS-DOS executable archive
- C. an archived malware
- D. a DOS MZ executable format
Answer: A
Explanation:
Explanation/Reference: https://stackoverflow.com/questions/2577545/why-is-this-program-cannot-be-run-in-dos-mode-text- present-in-dll-files#:~:text=The%20linker%20places%20a%20default,using%20the%20%2FSTUB%20linker%
20option.&text=This%20information%20enables%20Windows%20to,has%20an%20MS-DOS%20stub.
NEW QUESTION 94
The SIEM tool informs a SOC team of a suspicious file. The team initializes the analysis with an automated sandbox tool, sets up a controlled laboratory to examine the malware specimen, and proceeds with behavioral analysis. What is the next step in the malware analysis process?
- A. Unpack the specimen and perform memory forensics.
- B. Perform static and dynamic code analysis of the specimen.
- C. Contain the subnet in which the suspicious file was found.
- D. Document findings and clean-up the laboratory.
Answer: A
NEW QUESTION 95
After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?
- A. Analyze the applications and services running on the affected workstation.
- B. Compare workstation configuration and asset configuration policy to identify gaps.
- C. Review audit logs for privilege escalation events.
- D. Inspect registry entries for recently executed files.
Answer: D
NEW QUESTION 96
A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?
- A. Fix applications according to the risk scores
- B. Validate CSRF by executing exploits within Metasploit
- C. Update software to patch third-party software
- D. Identify the business applications running on the assets
Answer: A
NEW QUESTION 97
An analyst received multiple alerts on the SIEM console of users that are navigating to malicious URLs. The analyst needs to automate the task of receiving alerts and processing the data for further investigations. Three variables are available from the SIEM console to include in an automation script: console_ip, api_token, and reference_set_name. What must be added to this script to receive a successful HTTP response?
#!/usr/bin/python import sys import requests
- A. {1}, {3}
- B. console_ip, api_token
- C. {1}, {2}
- D. console_ip, reference_set_name
Answer: B
NEW QUESTION 98
Refer to the exhibit. What is occurring in this packet capture?
- A. DNS flood
- B. TCP port scan
- C. TCP flood
- D. DNS tunneling
Answer: C
NEW QUESTION 99
The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive. The team collects and documents all the necessary evidence from the computing resource. What is the next step?
- A. Conduct a risk assessment of systems and applications
- B. Analyze network traffic on the host's subnet
- C. Install malware prevention software on the host
- D. Isolate the infected host from the rest of the subnet
Answer: D
NEW QUESTION 100
A SOC team receives multiple alerts by a rule that detects requests to malicious URLs and informs the incident response team to block the malicious URLs requested on the firewall. Which action will improve the effectiveness of the process?
- A. Inform the user by enabling an automated email response when the rule is triggered.
- B. Block local to remote HTTP/HTTPS requests on the firewall for users who triggered the rule.
- C. Inform the incident response team by enabling an automated email response when the rule is triggered.
- D. Create an automation script for blocking URLs on the firewall when the rule is triggered.
Answer: B
NEW QUESTION 101
Drag and drop the phases to evaluate the security posture of an asset from the left onto the activity that happens during the phases on the right.
Answer:
Explanation:
NEW QUESTION 102
Refer to the exhibit.
The Cisco Secure Network Analytics (Stealthwatch) console alerted with "New Malware Server Discovered" and the IOC indicates communication from an end-user desktop to a Zeus C&C Server. Drag and drop the actions that the analyst should take from the left into the order on the right to investigate and remediate this IOC.
Answer:
Explanation:
NEW QUESTION 103
A security architect in an automotive factory is working on the Cyber Security Management System and is implementing procedures and creating policies to prevent attacks. Which standard must the architect apply?
- A. IEC62439-3
- B. IEC62446
- C. IEC62439-2
- D. IEC62443
Answer: D
NEW QUESTION 104
An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?
- A. Analyze environmental threats and causes
- B. Analyze the precursors and indicators
- C. Inform the product security incident response team to investigate further
- D. Inform the computer security incident response team to investigate further
Answer: B
NEW QUESTION 105
Engineers are working to document, list, and discover all used applications within an organization. During the regular assessment of applications from the HR backup server, an engineer discovered an unknown application. The analysis showed that the application is communicating with external addresses on a non- secure, unencrypted channel. Information gathering revealed that the unknown application does not have an owner and is not being used by a business unit. What are the next two steps the engineers should take in this investigation? (Choose two.)
- A. Verify user credentials on the affected asset, modify passwords, and confirm available patches and updates are installed.
- B. Identify who installed the application by reviewing the logs and gather a user access log from the HR department.
- C. Determine the type of data stored on the affected asset, document the access logs, and engage the incident response team.
- D. Initiate a triage meeting with department leads to determine if the application is owned internally or used by any business unit and document the asset owner.
Answer: C,D
NEW QUESTION 106
......
The Best Cisco 350-201 Study Guides and Dumps of 2021: https://testking.practicematerial.com/350-201-questions-answers.html
