[Oct-2024] Pass Cisco 350-201 Exam in First Attempt Guaranteed!
Full 350-201 Practice Test and 141 unique questions with explanations waiting just for you, get it now!
NEW QUESTION # 21
A threat actor has crafted and sent a spear-phishing email with what appears to be a trustworthy link to the site of a conference that an employee recently attended. The employee clicked the link and was redirected to a malicious site through which the employee downloaded a PDF attachment infected with ransomware. The employee opened the attachment, which exploited vulnerabilities on the desktop. The ransomware is now installed and is calling back to its command and control server. Which security solution is needed at this stage to mitigate the attack?
- A. network security solution
- B. email security solution
- C. web security solution
- D. endpoint security solution
Answer: D
Explanation:
At this stage of a ransomware attack, where the ransomware is installed and calling back to its command and control server, an endpoint security solution is needed to mitigate the attack. Endpoint security solutions can detect and respond to threats at the device level, isolate infected machines, and prevent the spread of ransomware within the network4.
NEW QUESTION # 22
A logistic company must use an outdated application located in a private VLAN during the migration to new technologies. The IPS blocked and reported an unencrypted communication. Which tuning option should be applied to IPS?
- A. Allow list only authorized hosts to contact the application's VLAN.
- B. Allow list HTTP traffic through the corporate VLANS.
- C. Allow list traffic to application's IP from the internal network at a specific port.
- D. Allow list only authorized hosts to contact the application's IP at a specific port.
Answer: A
NEW QUESTION # 23
An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?
- A. Modify the output module rule to "output alert_quick: output filename"
- B. Modify the output module rule to "output alert_fast: output filename"
- C. Modify the alert rule to "output alert_syslog: output log"
- D. Modify the alert rule to "output alert_syslog: output header"
Answer: B
Explanation:
To review packet overviews of SNORT alerts without including all the packet headers, which can result in excessively large files, the engineer should modify the output module rule to use the "alert_fast" option. This option allows SNORT to log alerts in a 'fast' format, which includes the timestamp, alert message, and the IP addresses and ports involved, but omits the packet headers. The correct syntax for this action would be output alert_fast: output filename, where 'filename' is the desired name for the alert log file.
NEW QUESTION # 24
The SIEM tool informs a SOC team of a suspicious file. The team initializes the analysis with an automated sandbox tool, sets up a controlled laboratory to examine the malware specimen, and proceeds with behavioral analysis. What is the next step in the malware analysis process?
- A. Document findings and clean-up the laboratory.
- B. Perform static and dynamic code analysis of the specimen.
- C. Unpack the specimen and perform memory forensics.
- D. Contain the subnet in which the suspicious file was found.
Answer: C
NEW QUESTION # 25
A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?
- A. Validate CSRF by executing exploits within Metasploit
- B. Identify the business applications running on the assets
- C. Fix applications according to the risk scores
- D. Update software to patch third-party software
Answer: C
NEW QUESTION # 26
Drag and drop the cloud computing service descriptions from the left onto the cloud service categories on the right.
Answer:
Explanation:
NEW QUESTION # 27
A threat actor has crafted and sent a spear-phishing email with what appears to be a trustworthy link to the site of a conference that an employee recently attended. The employee clicked the link and was redirected to a malicious site through which the employee downloaded a PDF attachment infected with ransomware. The employee opened the attachment, which exploited vulnerabilities on the desktop. The ransomware is now installed and is calling back to its command and control server. Which security solution is needed at this stage to mitigate the attack?
- A. email security solution
- B. endpoint security solution
- C. web security solution
- D. network security solution
Answer: D
NEW QUESTION # 28
Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?
- A. chmod 774
- B. chmod 777
- C. chmod 775
- D. chmod 666
Answer: B
Explanation:
The chmod command is used in Unix and Unix-like operating systems to change the file system modes of files and directories. The modes determine the permissions granted to the owner, group, and others. The command chmod 777 sets the mode of the file to be readable, writable, and executable by everyone. The number 777 corresponds to the permissions rwxrwxrwx, where r is read, w is write, and x is execute. This command is generally not recommended for use on a production system as it gives full permissions to every user, which can pose a significant security risk1.
NEW QUESTION # 29
How does Wireshark decrypt TLS network traffic?
- A. by observing DH key exchange
- B. by defining a user-specified decode-as
- C. using an RSA public key
- D. with a key log file using per-session secrets
Answer: D
NEW QUESTION # 30 
Refer to the exhibit. An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?
- A. a MS-DOS executable archive
- B. a DOS MZ executable format
- C. a Windows executable file
- D. an archived malware
Answer: C
Explanation:
Explanation/Reference: https://stackoverflow.com/questions/2577545/why-is-this-program-cannot-be-run-in-dos-mode-text- present-in-dll-files#:~:text=The%20linker%20places%20a%20default,using%20the%20%2FSTUB%20linker%
20option.&text=This%20information%20enables%20Windows%20to,has%20an%20MS-DOS%20stub.
NEW QUESTION # 31
Refer to the exhibit.
Based on the detected vulnerabilities, what is the next recommended mitigation step?
- A. Temporarily shut down unnecessary services until patch deployment ends.
- B. Perform root cause analysis for all detected vulnerabilities.
- C. Evaluate service disruption and associated risk before prioritizing patches.
- D. Remediate all vulnerabilities with descending CVSS score order.
Answer: C
Explanation:
When addressing detected vulnerabilities, it is crucial to first evaluate the potential service disruption and associated risks before prioritizing patches. This approach ensures that the most critical services remain operational and that the patches are applied in a manner that minimizes impact on business operations. It is important to consider the severity of the vulnerabilities, the importance of the affected systems, and the potential consequences of applying patches, which may require system reboots or could lead to compatibility issues with other applications123.
References:
* Cisco's Performing CyberOps Using Cisco Security Technologies (CBRCOR) course provides guidance on cybersecurity operations, including vulnerability management and mitigation strategies1.
* The CBRCOR Exam Topics outline the importance of evaluating the security posture of an asset and determining patching recommendations based on scenarios, which aligns with the recommended mitigation step of evaluating service disruption and associated risk2.
* Industry best practices for vulnerability management also emphasize the need to assess the impact of patches and to prioritize them based on the risk to the organization
NEW QUESTION # 32
Refer to the exhibit.
The Cisco Secure Network Analytics (Stealthwatch) console alerted with "New Malware Server Discovered" and the IOC indicates communication from an end-user desktop to a Zeus C&C Server. Drag and drop the actions that the analyst should take from the left into the order on the right to investigate and remediate this IOC.
Answer:
Explanation:
NEW QUESTION # 33
Engineers are working to document, list, and discover all used applications within an organization. During the regular assessment of applications from the HR backup server, an engineer discovered an unknown application. The analysis showed that the application is communicating with external addresses on a non- secure, unencrypted channel. Information gathering revealed that the unknown application does not have an owner and is not being used by a business unit. What are the next two steps the engineers should take in this investigation? (Choose two.)
- A. Identify who installed the application by reviewing the logs and gather a user access log from the HR department.
- B. Initiate a triage meeting with department leads to determine if the application is owned internally or used by any business unit and document the asset owner.
- C. Determine the type of data stored on the affected asset, document the access logs, and engage the incident response team.
- D. Verify user credentials on the affected asset, modify passwords, and confirm available patches and updates are installed.
Answer: A,C
Explanation:
The engineers should first determine the type of data stored on the affected asset and document the access logs to understand the potential impact of the unknown application. Engaging the incident response team is crucial for a coordinatedresponse to the security issue. Additionally, identifying who installed the application by reviewing the logs and gathering a user access log from the HR department will help trace the origin of the application and assess the extent of the unauthorized activity
NEW QUESTION # 34
A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?
- A. Isolate critical hosts from the network
- B. Assess the network for unexpected behavior
- C. Patch detected vulnerabilities from critical hosts
- D. Perform analysis based on the established risk factors
Answer: A
Explanation:
The first action for an incident response team following the detection of a malware outbreak is to isolate critical hosts from the network. This containment strategy is crucial to prevent the spread of the malware to other parts of the network and to minimize the impact while the team works on eradicating the threat and recovering from the incident4.
NEW QUESTION # 35
What is a limitation of cyber security risk insurance?
- A. It does not cover the costs to restore stolen identities as a result of a cyber attack
- B. It does not cover the costs of damage done by third parties as a result of a cyber attack
- C. It does not cover the costs to hire forensics experts to analyze the cyber attack
- D. It does not cover the costs to hire a public relations company to help deal with a cyber attack
Answer: A
NEW QUESTION # 36
Refer to the exhibit.
Based on the detected vulnerabilities, what is the next recommended mitigation step?
- A. Evaluate service disruption and associated risk before prioritizing patches.
- B. Temporarily shut down unnecessary services until patch deployment ends.
- C. Perform root cause analysis for all detected vulnerabilities.
- D. Remediate all vulnerabilities with descending CVSS score order.
Answer: C
NEW QUESTION # 37
Refer to the exhibit.
An engineer is performing a static analysis on a malware and knows that it is capturing keys and webcam events on a company server. What is the indicator of compromise?
- A. The malware has moved to harvesting cookies and stored account information from major browsers and configuring a reverse proxy for intercepting network activity.
- B. The malware is a ransomware querying for installed anti-virus products and operating systems to encrypt and render unreadable until payment is made for file decryption.
- C. The malware contains an encryption and decryption routine to hide URLs/IP addresses and is storing the output of loggers and webcam captures in locally encrypted files for retrieval.
- D. The malware is performing comprehensive fingerprinting of the host, including a processor, motherboard manufacturer, and connected removable storage.
Answer: C
Explanation:
The indicator of compromise (IoC) for the malware in question is that it has routines for encryption and decryption, which are used to conceal URLs/IP addresses. Additionally, it is capturing keystrokes and webcam events, and storing this data in encrypted files locally on the company server. This behavior is indicative of malware that is designed to stealthily collect and exfiltrate sensitive information without being easily detected.
The use of encryption helps to hide the data and the destination to which it may be sent, making it more challenging for security systems to identify and block the malicious activity.
NEW QUESTION # 38
Which bash command will print all lines from the "colors.txt" file containing the non case-sensitive pattern "Yellow"?
- A. grep -i "yellow" colors.txt
- B. grep "Yellow" colors.txt
- C. locate "yellow" colors.txt
- D. locate -i "Yellow" colors.txt
Answer: A
NEW QUESTION # 39
A European-based advertisement company collects tracking information from partner websites and stores it on a local server to provide tailored ads. Which standard must the company follow to safeguard the resting data?
- A. Sarbanes-Oxley
- B. HIPAA
- C. PCI-DSS
- D. GDPR
Answer: D
Explanation:
Explanation/Reference: https://www.thesslstore.com/blog/10-data-privacy-and-encryption-laws-every-business-needs-to- know/
NEW QUESTION # 40
Refer to the exhibit.
Which command was executed in PowerShell to generate this log?
- A. Get-EventLog -LogName*
- B. Get-WinEvent -ListLog* -ComputerName localhost
- C. Get-WinEvent -ListLog*
- D. Get-EventLog -List
Answer: B
Explanation:
The command that was executed in PowerShell to generate the log shown in the exhibit is Get-WinEvent
-ListLog* -ComputerName localhost. This command is used to list all event logs and their properties on the local computer. The inclusion of -ComputerName localhost specifies that the command should target the local machine, which is consistent with the details provided in the log exhibit. The output format displayed in the exhibit, showing details such as "Max (K)", "Retain", "OverflowAction", "Entries", and "Log", matches the typical output of the Get-WinEvent cmdlet when used with the -ListLog parameter.
References :=
* PowerShell documentation on the Get-WinEvent cmdlet.
* Best practices for using PowerShell to manage Windows event logs.
NEW QUESTION # 41
Refer to the exhibit.
Which command was executed in PowerShell to generate this log?
- A. Get-EventLog -LogName*
- B. Get-WinEvent -ListLog*
- C. Get-WinEvent -ListLog* -ComputerName localhost
- D. Get-EventLog -List
Answer: A
NEW QUESTION # 42
Refer to the exhibit.
How must these advisories be prioritized for handling?
- A. Vulnerability #1 is the highest priority for every type of institution
- B. Vulnerability #2 is the highest priority for every type of institution
- C. The highest priority for handling depends on the type of institution deploying the devices
- D. Vulnerability #1 and vulnerability #2 have the same priority
Answer: A
NEW QUESTION # 43
Refer to the exhibit.
What is the threat in this Wireshark traffic capture?
- A. A flood of ACK packets coming from a single source IP to multiple destination IPs
- B. A high rate of SYN packets being sent from multiple sources toward a single destination IP
- C. A flood of SYN packets coming from a single source IP to a single destination IP
- D. A high rate of SYN packets being sent from a single source IP toward multiple destination IPs
Answer: C
NEW QUESTION # 44
......
Get Latest 350-201 Dumps Exam Questions in here: https://testking.practicematerial.com/350-201-questions-answers.html
