Quiz about Certification Exam, Cisco, Cisco-350-201

Question 1

A new malware variant is discovered hidden in pirated software that is distributed on the Internet.  Executives have asked for an organizational risk assessment. The security officer is given a list of all 
assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose 
two.)

Accepted Answer

asset vulnerability assessment

Accepted Answer

malware analysis report

Answer

incident response playbooks

Answer

report of staff members with asset relations

Answer

key assets and executives

Question 2

Refer to the exhibit. $\"Certification$ A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?

Accepted Answer

Limit the number of API calls that a single client is allowed to make

Answer

Add restrictions on the edge router on how often a single client can access the API

Answer

Reduce the amount of data that can be fetched from the total pool of active clients that call the API

Answer

Increase the application cache of the total pool of active clients that call the API

Question 3

DRAG DROP An organization lost connectivity to critical servers, and users cannot access business applications and internal websites. An engineer checks the network devices to investigate the outage and determines that all devices are functioning. Drag and drop the steps from the left into the sequence on the right to continue investigating this issue. Not all options are used. $\"Certification$

Accepted Answer

$\"Certification$

Question 4

A threat actor attacked an organization’s Active Directory server from a remote location, and in a   thirty-minute timeframe, stole the password for the administrator account and attempted to access 
3 company servers. The threat actor successfully accessed the first server that contained sales data,  
but no files were downloaded. A second server was also accessed that contained marketing 
information and 11 files were downloaded. When the threat actor accessed the third server that 
contained corporate financial data, the session was disconnected, and the administrator’s account  
was disabled. Which activity triggered the behavior analytics tool?

Accepted Answer

accessing multiple servers

Answer

accessing the Active Directory server

Answer

accessing the server with financial data

Answer

downloading more than 10 files

Question 5

Refer to the exhibit. $\"Certification$ A security analyst needs to investigate a security incident involving several suspicious connections with a possible attacker. Which tool should the analyst use to identify the source IP of the offender?

Accepted Answer

packet sniffer

Answer

malware analysis

Answer

SIEM

Answer

firewall manager

Question 6

Refer to the exhibit. $\"Certification$ Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

Accepted Answer

The prioritized behavioral indicators of compromise justify the execution of the “ransomware” because the
scores are high and indicate the likelihood that malicious ransomware has been detected.

Answer

The prioritized behavioral indicators of compromise do not justify the execution of the “ransomware” because the scores do not indicate the likelihood of malicious ransomware.

Answer

The prioritized behavioral indicators of compromise do not justify the execution of the “ransomware” because the scores are high and do not indicate the likelihood of malicious
ransomware.

Answer

The prioritized behavioral indicators of compromise justify the execution of the “ransomware” because the scores are low and indicate the likelihood that malicious ransomware has been
detected.

Question 7

The physical security department received a report that an unauthorized person followed an  authorized individual to enter a secured premise. The incident was documented and given to a 
security specialist to analyze. Which step should be taken at this stage?

Accepted Answer

Identify movement of the attacker in the enterprise

Answer

Determine the assets to which the attacker has access

Answer

Identify assets the attacker handled or acquired

Answer

Change access controls to high risk assets in the enterprise

Question 8

Refer to the exhibit. $\"Certification$ At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?

Accepted Answer

delivery

Answer

exploitation

Answer

actions on objectives

Answer

reconnaissance

Question 9

Refer to the exhibit. $\"Certification$ How must these advisories be prioritized for handling?

Accepted Answer

Vulnerability #1 is the highest priority for every type of institution

Answer

The highest priority for handling depends on the type of institution deploying the devices

Answer

Vulnerability #2 is the highest priority for every type of institution

Answer

Vulnerability #1 and vulnerability #2 have the same priority

Question 10

Refer to the exhibit. $\"Certification$ Which two steps mitigate attacks on the webserver from the Internet? (Choose two.)

Accepted Answer

Implement a proxy server in the DMZ network

Accepted Answer

Move the webserver to the internal network

Answer

Create an ACL on the firewall to allow only TLS 1.3

Answer

Create an ACL on the firewall to allow only external connections

Quiz Cisco-350-201

Free Test - Simulator Cisco-350-201

Cisco-350-201 Practice test unlocks all online simulator questions

What to expect from our Cisco-350-201 practice tests and how to prepare for any exam?