Pass 350-201 Exam with Updated 350-201 Exam Dumps PDF 2021
350-201 Exam Dumps - Free Demo & 365 Day Updates
Topics Tested in the Cisco 350-201 Exam
Those who want to pass the Cisco 350-201 test should demonstrate that they possess the following knowledge and skills:
- Strong understanding of the CyberOps fundamentals and cloud environments’ types, improvement areas, and cyber risk insurance limitations and concepts;
- Having the ability to work with different techniques to meet specific needs and prevent data loss with the help of various host-based, application-based, network-based, or cloud-based solutions;
- Understanding how to work with different processes for performing reverse engineering and dynamic malware analysis, as well as determining the right steps to investigate threatening endpoint intrusions;
- The ability to interpret basic scripts and common HTTP response as well as describe the principles of Infrastructure as Code and the use of Bash commands.
NEW QUESTION 63
An engineer receives an incident ticket with hundreds of intrusion alerts that require investigation. An analysis of the incident log shows that the alerts are from trusted IP addresses and internal devices. The final incident report stated that these alerts were false positives and that no intrusions were detected. What action should be taken to harden the network?
- A. Configure reverse port forwarding on the IPS
- B. Move the IPS to before the firewall facing the outside network
- C. Move the IPS to after the firewall facing the internal network
- D. Configure the proxy service on the IPS
Answer: D
NEW QUESTION 64
Refer to the exhibit.
At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?
- A. reconnaissance
- B. exploitation
- C. delivery
- D. actions on objectives
Answer: C
NEW QUESTION 65
Refer to the exhibit.
Which asset has the highest risk value?
- A. servers
- B. website
- C. payment process
- D. secretary workstation
Answer: C
NEW QUESTION 66
A threat actor has crafted and sent a spear-phishing email with what appears to be a trustworthy link to the site of a conference that an employee recently attended. The employee clicked the link and was redirected to a malicious site through which the employee downloaded a PDF attachment infected with ransomware. The employee opened the attachment, which exploited vulnerabilities on the desktop. The ransomware is now installed and is calling back to its command and control server. Which security solution is needed at this stage to mitigate the attack?
- A. web security solution
- B. network security solution
- C. email security solution
- D. endpoint security solution
Answer: B
NEW QUESTION 67
According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?
- A. Conduct a data protection impact assessment
- B. Perform a vulnerability assessment
- C. Conduct penetration testing
- D. Perform awareness testing
Answer: A
NEW QUESTION 68
An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?
- A. Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.
- B. Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.
- C. Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.
- D. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.
Answer: D
NEW QUESTION 69
The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive. The team collects and documents all the necessary evidence from the computing resource. What is the next step?
- A. Analyze network traffic on the host's subnet
- B. Conduct a risk assessment of systems and applications
- C. Isolate the infected host from the rest of the subnet
- D. Install malware prevention software on the host
Answer: C
NEW QUESTION 70 
Refer to the exhibit. An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company's user creation policy:
* minimum length: 3
* usernames can only use letters, numbers, dots, and underscores
* usernames cannot begin with a number
The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames. Which change is needed to apply the restrictions?
- A. modify code to return error on restrictions def return false_user(username, minlen)
- B. validate the restrictions, def validate_user(username, minlen)
- C. automate the restrictions def automate_user(username, minlen)
- D. modify code to force the restrictions, def force_user(username, minlen)
Answer: C
NEW QUESTION 71
A security expert is investigating a breach that resulted in a $32 million loss from customer accounts. Hackers were able to steal API keys and two-factor codes due to a vulnerability that was introduced in a new code a few weeks before the attack. Which step was missed that would have prevented this breach?
- A. use of SecDevOps to detect the vulnerability during development
- B. implementation of an endpoint protection system
- C. use of the Nmap tool to identify the vulnerability when the new code was deployed
- D. implementation of a firewall and intrusion detection system
Answer: A
NEW QUESTION 72
An organization suffered a security breach in which the attacker exploited a Netlogon Remote Protocol vulnerability for further privilege escalation. Which two actions should the incident response team take to prevent this type of attack from reoccurring? (Choose two.)
- A. Define roles and responsibilities in the incident response playbook.
- B. Implement a patch management process.
- C. Scan the company server files for known viruses.
- D. Automate antivirus scans of the company servers.
- E. Apply existing patches to the company servers.
Answer: A,D
NEW QUESTION 73
An analyst wants to upload an infected file containing sensitive information to a hybrid-analysis sandbox. According to the NIST.SP 800-150 guide to cyber threat information sharing, what is the analyst required to do before uploading the file to safeguard privacy?
- A. Verify hash integrity.
- B. Lock the file to prevent unauthorized access.
- C. Ensure the online sandbox is GDPR compliant.
- D. Remove all personally identifiable information.
Answer: D
NEW QUESTION 74
A security architect is working in a processing center and must implement a DLP solution to detect and prevent any type of copy and paste attempts of sensitive data within unapproved applications and removable devices.
Which technical architecture must be used?
- A. DLP for data in use
- B. DLP for data in motion
- C. DLP for removable data
- D. DLP for data at rest
Answer: A
Explanation:
Explanation/Reference: https://www.endpointprotector.com/blog/what-is-data-loss-prevention-dlp/
NEW QUESTION 75
Refer to the exhibit.
An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?
- A. a Windows executable file
- B. a MS-DOS executable archive
- C. a DOS MZ executable format
- D. an archived malware
Answer: A
NEW QUESTION 76
Which action should be taken when the HTTP response code 301 is received from a web application?
- A. Increase the allowed user limit.
- B. Update the cached header metadata.
- C. Modify the session timeout setting.
- D. Confirm the resource's location.
Answer: B
NEW QUESTION 77
Refer to the exhibit.
An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?
- A. The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
- B. There is a malware that is communicating via encrypted channels to the command and control server
- C. There is a possible data leak because payloads should be encoded as UTF-8 text
- D. The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
Answer: C
NEW QUESTION 78
......
Processes – 30%
- Applying the concepts & sequence of steps in the malware analysis process;
- Performing static malware analysis;
- Defining Indicators of Compromise & Indicators of Attack;
- Recommending the general mitigation steps to address any vulnerability issues;
- Knowing the steps required to investigate the potential endpoint intrusion across a variety of platform types;
- Identifying the need for the additional static malware analysis;
- Performing reverse engineering;
- Performing dynamic malware analysis with the use of a sandbox environment;
- Determining Indicators of Compromise in a sandbox environment.
350-201 Dumps - Pass Your Certification Exam: https://www.torrentvce.com/350-201-valid-vce-collection.html
Free Sales Ending Soon - Use Real 350-201 PDF Questions: https://drive.google.com/open?id=1GNimAK25XbwZkaJgRejvA-q9yl_3tGCc