350-201 Certification Exam Dumps Questions in here [Nov-2021]
Updated 350-201 Exam Practice Test Questions
Exam Details
Cisco 350-201 gives a solid base needed for the skills that you will get for the concentration test. This way, you will be able to gain all the required knowledge and earn the certification to prove your expertise for the real-life events. It measures your level of knowledge of various cybersecurity processes and techniques.
The exam contains about 100-110 questions and an interested candidate should answer them all within 2 hours. Please note that you can face with different types of questions, including fill-in-the-blank, drag and drop, testlet, as well as multiple choice with single and multiple answers. To become eligible for the concentration test, you have to score about 825 points. If talking about the registration process for this Cisco exam, it is important to mention that an applicant needs to pay $400. Besides that, you should have an account on the Pearson VUE platform to be able to schedule the test.
Preparation Process
If you want to learn all the details of the exam content and be ready for Cisco 350-201, you can take the Performing CyberOps Using Cisco Security Technologies v1.0 course. This is the official training option, which is available on the vendor’s website. It covers the information about the cybersecurity operations fundamentals and methods as well as automation. With the help of this course, an interested individual is able to learn the foundational concepts and know how to leverage playbooks to formulate Incident Response. It is led by a certified instructor and available in almost any country in the world. It lasts for 5 days of hands-on practice and 3 days of covering content with challenges and practice. Before enrolling for the training, it is recommended that you possess a good knowledge of the content covered in the associate-level CyberOps course as well as have familiarity with UNIX/Linux shells & shell commands. Additionally, you should have a basic understanding of scripting when JavaScript, Python, or PHP are used.
NEW QUESTION 83
A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?
- A. Run the sh command
- B. Run the w command
- C. Run the who command
- D. Run the sudo sysdiagnose command
Answer: D
NEW QUESTION 84
A security architect is working in a processing center and must implement a DLP solution to detect and prevent any type of copy and paste attempts of sensitive data within unapproved applications and removable devices. Which technical architecture must be used?
- A. DLP for data at rest
- B. DLP for data in motion
- C. DLP for removable data
- D. DLP for data in use
Answer: D
NEW QUESTION 85
Drag and drop the mitigation steps from the left onto the vulnerabilities they mitigate on the right.
Answer:
Explanation:
NEW QUESTION 86
An organization suffered a security breach in which the attacker exploited a Netlogon Remote Protocol vulnerability for further privilege escalation. Which two actions should the incident response team take to prevent this type of attack from reoccurring? (Choose two.)
- A. Implement a patch management process.
- B. Scan the company server files for known viruses.
- C. Define roles and responsibilities in the incident response playbook.
- D. Apply existing patches to the company servers.
- E. Automate antivirus scans of the company servers.
Answer: C,E
NEW QUESTION 87
What is the purpose of hardening systems?
- A. to securely configure machines to limit the attack surface
- B. to analyze attacks to identify threat actors and points of entry
- C. to identify vulnerabilities within an operating system
- D. to create the logic that triggers alerts when anomalies occur
Answer: A
NEW QUESTION 88
An engineer is going through vulnerability triage with company management because of a recent malware outbreak from which 21 affected assets need to be patched or remediated. Management decides not to prioritize fixing the assets and accepts the vulnerabilities. What is the next step the engineer should take?
- A. Apply vendor patches or available hot fixes
- B. Investigate the vulnerability to prevent further spread
- C. Isolate the assets affected in a separate network
- D. Acknowledge the vulnerabilities and document the risk
Answer: C
NEW QUESTION 89
A SOC analyst detected a ransomware outbreak in the organization coming from a malicious email attachment. Affected parties are notified, and the incident response team is assigned to the case. According to the NIST incident response handbook, what is the next step in handling the incident?
- A. Collect evidence and maintain a chain-of-custody during further analysis.
- B. Create a follow-up report based on the incident documentation.
- C. Perform a vulnerability assessment to find existing vulnerabilities.
- D. Eradicate malicious software from the infected machines.
Answer: A
NEW QUESTION 90
An engineer is analyzing a possible compromise that happened a week ago when the company ? (Choose two.)
- A. firewall
- B. IPS
- C. SHA512
- D. autopsy
- E. Wireshark
Answer: A,E
NEW QUESTION 91
How is a SIEM tool used?
- A. To search and compare security data against acceptance standards and generate reports for analysis
- B. To compare security alerts against configured scenarios and trigger system responses
- C. To collect and analyze security data from network devices and servers and produce alerts
- D. To collect security data from authentication failures and cyber attacks and forward it for analysis
Answer: C
NEW QUESTION 92
A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?
- A. Fix applications according to the risk scores
- B. Validate CSRF by executing exploits within Metasploit
- C. Update software to patch third-party software
- D. Identify the business applications running on the assets
Answer: A
NEW QUESTION 93
Refer to the exhibit.
Where are the browser page rendering permissions displayed?
- A. x-test-debug
- B. x-xss-protection
- C. x-frame-options
- D. x-content-type-options
Answer: D
NEW QUESTION 94
Refer to the exhibit.
At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?
- A. reconnaissance
- B. actions on objectives
- C. delivery
- D. exploitation
Answer: C
NEW QUESTION 95
What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
Answer: C
NEW QUESTION 96
A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?
- A. Run the sh command
- B. Run the w command
- C. Run the who command
- D. Run the sudo sysdiagnose command
Answer: D
Explanation:
Explanation/Reference: https://eclecticlight.co/2016/02/06/the-ultimate-diagnostic-tool-sysdiagnose/
NEW QUESTION 97
The network operations center has identified malware, created a ticket within their ticketing system, and assigned the case to the SOC with high-level information. A SOC analyst was able to stop the malware from spreading and identified the attacking host. What is the next step in the incident response workflow?
- A. post-incident activity
- B. eradication and recovery
- C. containment
- D. detection and analysis
Answer: B
NEW QUESTION 98 
Refer to the exhibit. What results from this script?
- A. Seeds for existing domains are checked
- B. A search is conducted for additional seeds
- C. Domains are compared to seed rules
- D. A list of domains as seeds is blocked
Answer: B
NEW QUESTION 99
An organization had an incident with the network availability during which devices unexpectedly malfunctioned. An engineer is investigating the incident and found that the memory pool buffer usage reached a peak before the malfunction. Which action should the engineer take to prevent this issue from reoccurring?
- A. Enable memory threshold notifications.
- B. Enable memory tracing notifications.
- C. Disable memory limit.
- D. Disable CPU threshold trap toward the SNMP server.
Answer: A
NEW QUESTION 100
Refer to the exhibit. A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?
- A. Increase the application cache of the total pool of active clients that call the API
- B. Limit the number of API calls that a single client is allowed to make
- C. Add restrictions on the edge router on how often a single client can access the API
- D. Reduce the amount of data that can be fetched from the total pool of active clients that call the API
Answer: B
NEW QUESTION 101
Refer to the exhibit.
A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?
- A. Increase the application cache of the total pool of active clients that call the API
- B. Limit the number of API calls that a single client is allowed to make
- C. Add restrictions on the edge router on how often a single client can access the API
- D. Reduce the amount of data that can be fetched from the total pool of active clients that call the API
Answer: B
NEW QUESTION 102
Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system's startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?
- A. Remove the shortcut files
- B. Identify affected systems
- C. Check the audit logs
- D. Investigate the malicious URLs
Answer: B
NEW QUESTION 103
An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?
- A. Analyze environmental threats and causes
- B. Analyze the precursors and indicators
- C. Inform the product security incident response team to investigate further
- D. Inform the computer security incident response team to investigate further
Answer: B
NEW QUESTION 104
An engineer returned to work and realized that payments that were received over the weekend were sent to the wrong recipient. The engineer discovered that the SaaS tool that processes these payments was down over the weekend. Which step should the engineer take first?
- A. Utilize the SaaS tool team to gather more information on the potential breach
- B. Contact the incident response team to inform them of a potential breach
- C. Request that the purchasing department creates and sends the payments manually
- D. Organize a meeting to discuss the services that may be affected
Answer: A
NEW QUESTION 105
How does Wireshark decrypt TLS network traffic?
- A. by defining a user-specified decode-as
- B. with a key log file using per-session secrets
- C. by observing DH key exchange
- D. using an RSA public key
Answer: B
Explanation:
Explanation/Reference: https://wiki.wireshark.org/TLS
NEW QUESTION 106
Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?
- A. Internet
- B. customer data
- C. internal cloud
- D. internal database
Answer: A
NEW QUESTION 107 
Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?
- A. There is a malware that is communicating via encrypted channels to the command and control server
- B. The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
- C. The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
- D. There is a possible data leak because payloads should be encoded as UTF-8 text
Answer: D
NEW QUESTION 108
......
Pass CyberOps Professional 350-201 Exam With 141 Questions: https://pdfexamfiles.actualtestsquiz.com/350-201-test-torrent.html
