Cisco 350-201 CBRCOR Exam Questions Instant Access

Question 1

A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?

ARun the sudo sysdiagnose command

BRun the sh command

CRun the w command

DRun the who command

Answer : A

Question 2

Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system's startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?

ARemove the shortcut files

BCheck the audit logs

CIdentify affected systems

DInvestigate the malicious URLs

Answer : C

Question 3

Refer to the exhibit.

Which code snippet will parse the response to identify the status of the domain as malicious, clean or undefined?

AOption A

BOption B

COption C

DOption D

Answer : C

Question 4

Refer to the exhibit.

An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

AThe extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible

BThe traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information

CThere is a possible data leak because payloads should be encoded as UTF-8 text

DThere is a malware that is communicating via encrypted channels to the command and control server

Answer : C

Question 5

A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?

AClassify the criticality of the information, research the attacker's motives, and identify missing patches

BDetermine the damage to the business, extract reports, and save evidence according to a chain of custody

CClassify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited

DDetermine the attack surface, evaluate the risks involved, and communicate the incident according to the escalation plan

Answer : B

Question 6

A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

AAssess the network for unexpected behavior

BIsolate critical hosts from the network

CPatch detected vulnerabilities from critical hosts

DPerform analysis based on the established risk factors

Answer : B

Question 7

An engineer received an alert of a zero-day vulnerability affecting desktop phones through which an attacker sends a crafted packet to a device, resets the credentials, makes the device unavailable, and allows a default

administrator account login. Which step should an engineer take after receiving this alert?

AInitiate a triage meeting to acknowledge the vulnerability and its potential impact

BDetermine company usage of the affected products

CSearch for a patch to install from the vendor

DImplement restrictions within the VoIP VLANS

Answer : C

Cisco Performing Cybersecurity Using Cisco Security Technologies 350-201 CBRCOR Exam Questions