[Jan 26, 2023] Get New 350-201 Certification – Valid Exam Dumps Questions
100% Passing Guarantee - Brilliant 350-201 Exam Questions PDF
Cisco 350-201 Exam Certification Details:
| Passing Score | Variable (750-850 / 1000 Approx.) |
| Exam Code | 350-201 CBRCOR |
| Duration | 120 minutes |
| Recommended Training | Performing CyberOps Using Cisco Security Technologies (CBRCOR) CBRCOR study materials |
| Exam Price | $400 USD |
| Exam Name | Performing CyberOps Using Cisco Security Technologies |
| Number of Questions | 90-110 |
| Exam Registration | PEARSON VUE |
Who should take the 350-201 CISCO Performing CyberOps Using Cisco Security Exam
The certification is fashioned for:
- Network designers
- Cisco integrators and partners
- Network engineers
- Server administrators
- Consulting systems engineers
- Storage administrators
- Systems engineers
- Network managers
- Field engineers
NEW QUESTION 13
Drag and drop the components from the left onto the phases of the CI/CD pipeline on the right.
Answer:
Explanation:
Reference:
https://www.densify.com/resources/continuous-integration-delivery-phases
NEW QUESTION 14
Refer to the exhibit.
What is occurring in this packet capture?
- A. DNS flood
- B. TCP port scan
- C. TCP flood
- D. DNS tunneling
Answer: C
NEW QUESTION 15
Refer to the exhibit.
Two types of clients are accessing the front ends and the core database that manages transactions, access control, and atomicity. What is the threat model for the SQL database?
- A. An attacker can initiate a DoS attack.
- B. An attacker can transfer data to an external server.
- C. An attacker can modify the access logs.
- D. An attacker can read or change data.
Answer: A
NEW QUESTION 16
Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?
- A. internal database
- B. Internet
- C. customer data
- D. internal cloud
Answer: B
NEW QUESTION 17
Refer to the exhibit.
IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
- A. Tune the count and seconds threshold of the rule
- B. Set the rule to track the source IP
- C. Block list of internal IPs from the rule
- D. Change the rule content match to case sensitive
Answer: D
NEW QUESTION 18
A cloud engineer needs a solution to deploy applications on a cloud without being able to manage and control the server OS. Which type of cloud environment should be used?
- A. SaaS
- B. PaaS
- C. IaaS
- D. DaaS
Answer: C
NEW QUESTION 19
Refer to the exhibit.
An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company's user creation policy:
minimum length: 3
usernames can only use letters, numbers, dots, and underscores
usernames cannot begin with a number
The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames. Which change is needed to apply the restrictions?
- A. validate the restrictions, def validate_user(username, minlen)
- B. automate the restrictions def automate_user(username, minlen)
- C. modify code to return error on restrictions def return false_user(username, minlen)
- D. modify code to force the restrictions, def force_user(username, minlen)
Answer: B
NEW QUESTION 20
The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?
- A. Install IPS software
- B. Perform vulnerability assessment
- C. Determine the escalation path
- D. Contain the malware
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION 21
An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?
- A. Modify the alert rule to "output alert_syslog: output header"
- B. Modify the alert rule to "output alert_syslog: output log"
- C. Modify the output module rule to "output alert_quick: output filename"
- D. Modify the output module rule to "output alert_fast: output filename"
Answer: B
Explanation:
Explanation
Explanation/Reference: https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/000/249/original/ snort_manual.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIXACIED2SPMSC7GA%
2F20201231%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20201231T141156Z&X-Amz- Expires=172800&X-Amz-SignedHeaders=host&X-Amz- Signature=e122ab6eb1659e13b3bc6bb2451ce693c0298b76c1962c3743924bc5fd83d382
NEW QUESTION 22
Refer to the exhibit.
For IP 192.168.1.209, what are the risk level, activity, and next step?
- A. critical risk level, data exfiltration, isolate the device
- B. high risk level, anomalous periodic communication, quarantine with antivirus
- C. critical risk level, malicious server IP, run in a sandboxed environment
- D. high risk level, malicious host, investigate further
Answer: B
NEW QUESTION 23
An engineer is utilizing interactive behavior analysis to test malware in a sandbox environment to see how the malware performs when it is successfully executed. A location is secured to perform reverse engineering on a piece of malware. What is the next step the engineer should take to analyze this malware?
- A. Disassemble the malware to understand how it was constructed
- B. Research the malware online to see if there are noted findings
- C. Unpack the file in a sandbox to see how it reacts
- D. Run the program through a debugger to see the sequential actions
Answer: B
NEW QUESTION 24
What is the difference between process orchestration and automation?
- A. Orchestration arranges the tasks, while automation arranges processes.
- B. Orchestration minimizes redundancies, while automation decreases the time to recover from redundancies.
- C. Orchestration combines a set of automated tools, while automation is focused on the tools to automate process flows.
- D. Automation optimizes the individual tasks to execute the process, while orchestration optimizes frequent and repeatable processes.
Answer: C
NEW QUESTION 25
A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled. Which activity triggered the behavior analytics tool?
- A. downloading more than 10 files
- B. accessing the Active Directory server
- C. accessing the server with financial data
- D. accessing multiple servers
Answer: D
NEW QUESTION 26
Refer to the exhibit.
What is the connection status of the ICMP event?
- A. allowed in the default action
- B. allowed by a configured access policy rule
- C. blocked by an intrusion policy rule
- D. blocked by a configured access policy rule
Answer: B
NEW QUESTION 27
Refer to the exhibit.
An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?
- A. There is a possible data leak because payloads should be encoded as UTF-8 text
- B. There is a malware that is communicating via encrypted channels to the command and control server
- C. The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
- D. The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
Answer: A
NEW QUESTION 28
Refer to the exhibit.
The Cisco Secure Network Analytics (Stealthwatch) console alerted with "New Malware Server Discovered" and the IOC indicates communication from an end-user desktop to a Zeus C&C Server. Drag and drop the actions that the analyst should take from the left into the order on the right to investigate and remediate this IOC.
Answer:
Explanation:
NEW QUESTION 29
The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?
- A. Install IPS software
- B. Perform vulnerability assessment
- C. Determine the escalation path
- D. Contain the malware
Answer: B
NEW QUESTION 30
......
Exam Topics
To be able to clear as many questions as possible, you need to cover all the domains covered in the test. All in all, the Cisco 350-201 exam includes the evaluation of your knowledge of the following topics:
Fundamentals – 20%
- Understanding the components within a playbook and which tools you can use on a playbook scenario;
- Knowing the limitations and concepts of the cyber risk insurance;
- Comparing the security operations considerations of the Cloud platforms.
- Analyzing the elements of risk analysis;
Free 350-201 braindumps download: https://www.prep4surereview.com/350-201-latest-braindumps.html
350-201 Dumps 2023 - NewCisco Exam Questions: https://drive.google.com/open?id=13r7dCkBRSZ25y4v1GQg1cNf6atBGauT6
