How to pass Cisco 350-201 exam with the help of dumps?

Question # 1

An engineer is investigating several cases of increased incoming spam emails andsuspicious emails from the HR and service departments. While checking the eventsources, the website monitoring tool showed several web scraping alerts overnight. Whichtype of compromise is indicated?

A. phishing
B. dumpster diving
C. social engineering
D. privilege escalation

Show Answer

Question # 2

An analyst wants to upload an infected file containing sensitive information to a hybridanalysis sandbox. According to the NIST.SP 800-150 guide to cyber threat informationsharing, what is the analyst required to do before uploading the file to safeguard privacy?

A. Verify hash integrity.
B. Remove all personally identifiable information.
C. Ensure the online sandbox is GDPR compliant.
D. Lock the file to prevent unauthorized access.

Show Answer

Question # 3

According to GDPR, what should be done with data to ensure its confidentiality, integrity,and availability?

A. Perform a vulnerability assessment
B. Conduct a data protection impact assessment
C. Conduct penetration testing
D. Perform awareness testing

Show Answer

Question # 4

An engineer is analyzing a possible compromise that happened a week ago when thecompany ? (Choose two.)

A. firewall
B. Wireshark
C. autopsy
D. SHA512
E. IPS

Show Answer

Question # 5

A. Block list of internal IPs from the rule
B. Change the rule content match to case sensitive
C. Set the rule to track the source IP
D. Tune the count and seconds threshold of the rule

Show Answer

Question # 6

A. Limit the number of API calls that a single client is allowed to make
B. Add restrictions on the edge router on how often a single client can access the API
C. Reduce the amount of data that can be fetched from the total pool of active clients thatcall the API
D. Increase the application cache of the total pool of active clients that call the API

Show Answer

Question # 7

A. NetFlow and event data
B. event data and syslog data
C. SNMP and syslog data
D. NetFlow and SNMP

Show Answer

Question # 8

The incident response team receives information about the abnormal behavior of a host. Amalicious file is found being executed from an external USB flash drive. The team collectsand documents all the necessary evidence from the computing resource. What is the nextstep?

A. Conduct a risk assessment of systems and applications
B. Isolate the infected host from the rest of the subnet
C. Install malware prevention software on the host
D. Analyze network traffic on the host’s subnet

Show Answer

Question # 9

A SOC analyst is investigating a recent email delivered to a high-value user for a customerwhose network their organization monitors. The email includes a suspicious attachmenttitled “Invoice RE: 0004489”. Thehash of the file is gathered from the Cisco Email Security Appliance. After searching OpenSource Intelligence, no available history of this hash is found anywhere on the web. Whatis the next step in analyzing this attachment to allow the analyst to gather indicators ofcompromise?

A. Run and analyze the DLP Incident Summary Report from the Email Security Appliance
B. Ask the company to execute the payload for real time analysis
C. Investigate further in open source repositories using YARA to find matches
D. Obtain a copy of the file for detonation in a sandbox

Show Answer

Question # 10

Which command does an engineer use to set read/write/execute access on a folder foreveryone who reaches the resource?

A. chmod 666
B. chmod 774
C. chmod 775
D. chmod 777

Show Answer

Question # 11

An organization suffered a security breach in which the attacker exploited a NetlogonRemote Protocol vulnerability for further privilege escalation. Which two actions should theincident response team take toprevent this type of attack from reoccurring? (Choose two.)

A. Implement a patch management process.
B. Scan the company server files for known viruses.
C. Apply existing patches to the company servers.
D. Automate antivirus scans of the company servers.
E. Define roles and responsibilities in the incident response playbook.

Show Answer

Question # 12

What is idempotence?

A. the assurance of system uniformity throughout the whole delivery process
B. the ability to recover from failures while keeping critical services running
C. the necessity of setting maintenance of individual deployment environments
D. the ability to set the target environment configuration regardless of the starting state

Show Answer

Question # 13

handling more threats than Security analysts have time to analyze. Without this analysis,the team cannot be proactive and anticipate attacks. Which action will accomplish thisgoal?

A. Exclude the step “BAN malicious IP” to allow analysts to conduct and track theremediation
B. Include a step “Take a Snapshot” to capture the endpoint state to contain the threat foranalysis
C. Exclude the step “Check for GeoIP location” to allow analysts to analyze the locationand the associated risk based on asset criticality
D. Include a step “Reporting” to alert the security department of threats identified by theSOAR reporting engine

Show Answer

Question # 14

An engineer received an incident ticket of a malware outbreak and used antivirus andmalware removal tools to eradicate the threat. The engineer notices that abnormalprocesses are still occurring in the system and determines that manual intervention isneeded to clean the infected host and restore functionality. What is the next step theengineer should take to complete this playbook step?

A. Scan the network to identify unknown assets and the asset owners.
B. Analyze the components of the infected hosts and associated business services.
C. Scan the host with updated signatures and remove temporary containment.
D. Analyze the impact of the malware and contain the artifacts.

Show Answer

Question # 15

How does Wireshark decrypt TLS network traffic?

A. with a key log file using per-session secrets
B. using an RSA public key
C. by observing DH key exchange
D. by defining a user-specified decode-as

Show Answer

Question # 16

A SIEM tool fires an alert about a VPN connection attempt from an unusual location. Theincident response team validates that an attacker has installed a remote access tool on auser’s laptop while traveling. The attacker has the user’s credentials and is attempting toconnect to the network.What is the next step in handling the incident?

A. Block the source IP from the firewall
B. Perform an antivirus scan on the laptop
C. Identify systems or services at risk
D. Identify lateral movement

Show Answer

Question # 17

Refer to the exhibit.

A. website redirecting traffic to ransomware server
B. website hosting malware to download files
C. web server vulnerability exploited by malware
D. cross-site scripting vulnerability to backdoor server

Show Answer

Question # 18

A threat actor attacked an organization’s Active Directory server from a remote location,and in a thirty-minute timeframe, stole the password for the administrator account andattempted to access 3 company servers. The threat actor successfully accessed the firstserver that contained sales data, but no files were downloaded. A second server was alsoaccessed that contained marketing information and 11 files were downloaded. When thethreat actor accessed the third server that contained corporate financial data, the sessionwas disconnected, and the administrator’s account was disabled. Which activity triggeredthe behavior analytics tool?

A. accessing the Active Directory server
B. accessing the server with financial data
C. accessing multiple servers
D. downloading more than 10 files

Show Answer

Question # 19

A logistic company must use an outdated application located in a private VLAN during themigration to new technologies. The IPS blocked and reported an unencryptedcommunication. Which tuning option should be applied to IPS?

A. Allow list only authorized hosts to contact the application’s IP at a specific port.
B. Allow list HTTP traffic through the corporate VLANS.
C. Allow list traffic to application’s IP from the internal network at a specific port.
D. Allow list only authorized hosts to contact the application’s VLAN.

Show Answer

Question # 20

Employees receive an email from an executive within the organization that summarizes arecent security breach and requests that employees verify their credentials through aprovided link. Several employees report the email as suspicious, and a security analyst isinvestigating the reports. Which two steps should the analyst take to begin thisinvestigation? (Choose two.)

A. Evaluate the intrusion detection system alerts to determine the threat source and attacksurface.
B. Communicate with employees to determine who opened the link and isolate the affectedassets.
C. Examine the firewall and HIPS configuration to identify the exploited vulnerabilities andapply recommended mitigation.
D. Review the mail server and proxy logs to identify the impact of a potential breach.
E. Check the email header to identify the sender and analyze the link in an isolatedenvironment.

Show Answer

Question # 21

Refer to the exhibit.

A. Option A 
B. Option B 
C. Option C 
D. Option D 

Show Answer

Question # 22

An engineer returned to work and realized that payments that were received over theweekend were sent to the wrong recipient. The engineer discovered that the SaaS tool thatprocesses these payments was down over the weekend. Which step should the engineertake first?

A. Utilize the SaaS tool team to gather more information on the potential breach
B. Contact the incident response team to inform them of a potential breach
C. Organize a meeting to discuss the services that may be affected
D. Request that the purchasing department creates and sends the payments manually

Show Answer

Question # 23

https. What should be determined regarding data loss between the employee’s laptop andthe remote technician’s system?

A. No database files were disclosed
B. The database files were disclosed
C. The database files integrity was violated
D. The database files were intentionally corrupted, and encryption is possible

Show Answer

Question # 24

An engineer detects an intrusion event inside an organization’s network and becomesaware that files that contain personal data have been accessed. Which action must betaken to contain this attack?

A. Disconnect the affected server from the network.
B. Analyze the source.
C. Access the affected server to confirm compromised files are encrypted.
D. Determine the attack surface.

Show Answer

Question # 25

An organization had an incident with the network availability during which devicesunexpectedly malfunctioned. An engineer is investigating the incident and found that thememory pool buffer usage reached a peak before the malfunction. Which action should theengineer take to prevent this issue from reoccurring?

A. Disable memory limit.
B. Disable CPU threshold trap toward the SNMP server.
C. Enable memory tracing notifications.
D. Enable memory threshold notifications.

Show Answer

Question # 26

A. Get-EventLog -LogName*
B. Get-EventLog -List
C. Get-WinEvent -ListLog* -ComputerName localhost
D. Get-WinEvent -ListLog*

Show Answer

Question # 27

An organization had several cyberattacks over the last 6 months and has tasked anengineer with looking for patterns or trends that will help the organization anticipate futureattacks and mitigate them. Which data analytic technique should the engineer use toaccomplish this task?

A. diagnostic
B. qualitative
C. predictive
D. statistical

Show Answer

Question # 28

An engineer receives a report that indicates a possible incident of a malicious insidersending company information to outside parties. What is the first action the engineer musttake to determine whether an incident has occurred?

A. Analyze environmental threats and causes
B. Inform the product security incident response team to investigate further
C. Analyze the precursors and indicators
D. Inform the computer security incident response team to investigate further

Show Answer