[Nov-2024] The Cisco 350-201 Exam Test For Brief Preparation
Revolutionary Guide To Exam Cisco Dumps
Cisco 350-201 exam is a certification exam that tests the knowledge and skills of individuals in performing cyber operations using Cisco security technologies. 350-201 exam is designed for professionals who are responsible for the implementation, operation, and troubleshooting of Cisco security technologies in a network environment. Performing CyberOps Using Cisco Security Technologies certification exam focuses on various aspects of cybersecurity, including threat intelligence, network security, endpoint protection, and incident response.
Cisco 350-201 certification exam is designed to test the knowledge and skills of cybersecurity professionals who use Cisco Security technologies to protect their organization's assets from cybercriminals. 350-201 exam is a part of the Cisco Certified CyberOps Professional certification program, which is designed to help individuals develop their cybersecurity skills and knowledge.
NEW QUESTION # 39
Refer to the exhibit.
An engineer must tune the Cisco IOS device to mitigate an attack that is broadcasting a large number of ICMP packets. The attack is sending the victim's spoofed source IP to a network using an IP broadcast address that causes devices in the network to respond back to the source IP address. Which action does the engineer recommend?
- A. Use command ip verify reverse-path interface
- B. Use global configuration command service tcp-keepalives-out
- C. Use logging trap 6
- D. Use subinterface command no ip directed-broadcast
Answer: D
Explanation:
The recommended action to mitigate an attack that is broadcasting a large number of ICMP packets using a spoofed source IP address is to use the subinterface command no ip directed-broadcast. This command prevents the Cisco IOS device from forwarding packets that are addressed to IP broadcast addresses. By disabling the directed broadcast feature, the network devices will not respond to broadcast messages sent to the network's broadcast address, thus mitigating the attack and preventing the amplification of the ICMP packets back to the victim's IP address.
NEW QUESTION # 40
An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?
- A. Meet with privileged users to increase awareness and modify the rules for threat tags and anomalous behavior alerts
- B. Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts
- C. Change the SOAR configuration flow to remove the automatic remediation that is increasing the false positives and triggering threats
- D. Increase incorrect login tries and tune anomalous user behavior not to affect privileged accounts
Answer: C
NEW QUESTION # 41
An organization had an incident with the network availability during which devices unexpectedly malfunctioned. An engineer is investigating the incident and found that the memory pool buffer usage reached a peak before the malfunction. Which action should the engineer take to prevent this issue from reoccurring?
- A. Disable memory limit.
- B. Enable memory tracing notifications.
- C. Disable CPU threshold trap toward the SNMP server.
- D. Enable memory threshold notifications.
Answer: D
Explanation:
To prevent network availability issues related to peak memory pool buffer usage, the engineer should enable memory threshold notifications. This action allows the system to alert administrators before the memory usage reaches a critical level, enabling them to take proactive measures to prevent malfunction
NEW QUESTION # 42
After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?
- A. Analyze the applications and services running on the affected workstation.
- B. Review audit logs for privilege escalation events.
- C. Inspect registry entries for recently executed files.
- D. Compare workstation configuration and asset configuration policy to identify gaps.
Answer: C
NEW QUESTION # 43
Refer to the exhibit.
An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?
- A. an archived malware
- B. a MS-DOS executable archive
- C. a DOS MZ executable format
- D. a Windows executable file
Answer: D
NEW QUESTION # 44
A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?
- A. risk model framework
- B. assessment scope
- C. incident response playbook
- D. event severity and likelihood
Answer: A
NEW QUESTION # 45
Refer to the exhibit.
Where are the browser page rendering permissions displayed?
- A. Content-Type
- B. X-XSS-Protection
- C. Cache-Control
- D. X-Frame-Options
Answer: D
Explanation:
The browser page rendering permissions are displayed in the X-Frame-Options HTTP response header. This header is used to control whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. The options are "DENY", "SAMEORIGIN", or
"ALLOW-FROM uri".
References:
* MDN Web Docs on X-Frame-Options
* Cisco's training on Performing CyberOps Using Cisco Security Technologies (CBRCOR) would cover the analysis of HTTP headers and their implications on security.
NEW QUESTION # 46
Refer to the exhibit.
An engineer notices a significant anomaly in the traffic in one of the host groups in Cisco Secure Network Analytics (Stealthwatch) and must analyze the top data transmissions. Which tool accomplishes this task?
- A. Top Ports
- B. Top Conversations
- C. Top Hosts
- D. Top Peers
Answer: B
Explanation:
In Cisco Secure Network Analytics (Stealthwatch), when an engineer needs to analyze the top data transmissions to identify significant anomalies in traffic within a host group, the Top Conversations tool is used. This tool provides a detailed view of the communication between hosts, showing which pairs of hosts are exchanging the most data. By examining the top conversations, the engineer can pinpoint which specific data flows are contributing to the anomaly and take appropriate action.
The Top Conversations tool is particularly useful for this task because it focuses on the interactions between hosts, rather than just the volume of traffic (Top Ports), the individual hosts themselves (Top Hosts), or the peers (Top Peers) involved in the network communications. It allows for a more granular analysis of the network traffic, which is essential for identifying and addressing anomalies.
NEW QUESTION # 47
Drag and drop the cloud computing service descriptions from the left onto the cloud service categories on the right.
Answer:
Explanation:
NEW QUESTION # 48
Refer to the exhibit.
Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?
- A. An attacker can transfer data to an external server.
- B. An attacker can modify the access logs.
- C. An attacker can read or change data.
- D. An attacker can initiate a DoS attack.
Answer: D
NEW QUESTION # 49
An engineer is moving data from NAS servers in different departments to a combined storage database so that the data can be accessed and analyzed by the organization on-demand. Which data management process is being used?
- A. data ingestion
- B. data clustering
- C. data regression
- D. data obfuscation
Answer: B
NEW QUESTION # 50
An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?
- A. predictive
- B. qualitative
- C. statistical
- D. diagnostic
Answer: A
Explanation:
Predictive analytics is the most suitable data analytic technique for anticipating future cyberattacks. It involves using historical data, statistical algorithms, and machine learning techniques to identify the likelihood of future outcomes based on patterns and trends. This approach can help organizations forecast potential cyber threats and take proactive measures to mitigate them before they occur123.
NEW QUESTION # 51
A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled. Which activity triggered the behavior analytics tool?
- A. accessing the server with financial data
- B. accessing multiple servers
- C. downloading more than 10 files
- D. accessing the Active Directory server
Answer: C
Explanation:
The behavior analytics tool was likely triggered by the action of downloading more than 10 files. Behavior analytics tools, such as User and Entity Behavior Analytics (UEBA), are designed to detect anomalous behavior that deviates from a user's normal activity patterns. In this scenario, the downloading of a large number of files in a short period is an unusual activity that could indicate a data exfiltration attempt. This is especially true if the baseline or normal behavior for the administrator account does not include frequent bulk file downloads. The sudden spike in file download activity would be flagged by the behavior analytics tool as potentially malicious, leading to the disconnection of the session and the disabling of the administrator's account to prevent further unauthorized access or data loss.
NEW QUESTION # 52
After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes.
The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?
- A. Analyze the applications and services running on the affected workstation.
- B. Review audit logs for privilege escalation events.
- C. Inspect registry entries for recently executed files.
- D. Compare workstation configuration and asset configuration policy to identify gaps.
Answer: C
Explanation:
After isolating the affected workstation in a malware incident, the next step in the investigation is to inspect the registry entries for recently executed files. This can provide clues about the malware's actions and potential persistence mechanisms. It's a critical step in understanding the scope of the breach and the methods used by the attacker
NEW QUESTION # 53
An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)
- A. email forwarding to an external domain
- B. log in from a first-seen country
- C. domain belongs to a competitor
- D. increased number of sent mails
- E. log in during non-working hours
Answer: B,E
Explanation:
The behaviors that triggered the User and Entity Behavior Analytics (UEBA) are the employee logging in during non-working hours and from a first-seen country. UEBA systems are designed to detect anomalies in user behavior that could indicate security threats. Logging in from a new location, especially during unusual hours, deviates from the user's typical behavior patterns and raises flags about potential unauthorized access or compromised credentials.
NEW QUESTION # 54
Refer to the exhibit. Which indicator of compromise is represented by this STIX?
- A. website hosting malware to download files
- B. website redirecting traffic to ransomware server
- C. web server vulnerability exploited by malware
- D. cross-site scripting vulnerability to backdoor server
Answer: C
NEW QUESTION # 55
Drag and drop the type of attacks from the left onto the cyber kill chain stages at which the attacks are seen on the right.
Answer:
Explanation:
NEW QUESTION # 56
How does Wireshark decrypt TLS network traffic?
- A. with a key log file using per-session secrets
- B. by defining a user-specified decode-as
- C. by observing DH key exchange
- D. using an RSA public key
Answer: A
Explanation:
Explanation/Reference: https://wiki.wireshark.org/TLS
NEW QUESTION # 57
According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?
- A. Perform awareness testing
- B. Conduct a data protection impact assessment
- C. Perform a vulnerability assessment
- D. Conduct penetration testing
Answer: B
NEW QUESTION # 58
Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?
- A. chmod 775
- B. chmod 666
- C. chmod 774
- D. chmod 777
Answer: D
Explanation:
The chmod command is used in Unix and Unix-like operating systems to change the file system modes of files and directories. The modes determine the permissions granted to the owner, group, and others. The command chmod 777 sets the mode of the file to be readable, writable, and executable by everyone. The number 777 corresponds to the permissions rwxrwxrwx, where r is read, w is write, and x is execute. This command is generally not recommended for use on a production system as it gives full permissions to every user, which can pose a significant security risk1.
NEW QUESTION # 59
A SOC analyst detected a ransomware outbreak in the organization coming from a malicious email attachment. Affected parties are notified, and the incident response team is assigned to the case. According to the NIST incident response handbook, what is the next step in handling the incident?
- A. Perform a vulnerability assessment to find existing vulnerabilities.
- B. Eradicate malicious software from the infected machines.
- C. Collect evidence and maintain a chain-of-custody during further analysis.
- D. Create a follow-up report based on the incident documentation.
Answer: B
Explanation:
According to the NIST incident response handbook, after detecting a ransomware outbreak and notifying the affected parties, the next step is to eradicate the malicious software from the infected machines. This involves removing the ransomware and any associated malware to prevent further encryption or spread of the infection3
NEW QUESTION # 60
......
350-201 Free Study Guide! with New Questions: https://www.dumpsfree.com/350-201-valid-exam.html
Pass 350-201 Exam Latest Practice Questions: https://drive.google.com/open?id=1av9wcr6I2rbjQxibX1Scpii_zZ5JkIyb