Cisco Performing CyberOps Using Cisco Security Technologies - 350-201 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

An engineer notices that every Sunday night, there is a two-hour period with a large load of network activity.
Upon further investigation, the engineer finds that the activity is from locations around the globe outside the organization's service area. What are the next steps the engineer must take?

A. Define the access points using StealthWatch or SIEM logs, understand services being offered during the hours in question and cross-correlate other source events. B. Review the SIEM and FirePower logs, block all traffic, and document the results of calling the call center. C. Assign the issue to the incident handling provider because no suspicious activity has been observed during business hours. D. Treat it as a false positive, and accept the SIEM issue as valid to avoid alerts from triggering on weekends.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit.

What results from this script?

A. Seeds for existing domains are checked B. A list of domains as seeds is blocked C. A search is conducted for additional seeds D. Domains are compared to seed rules

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle.
The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually.
Which action will improve workflow automation?

A. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed. B. Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates. C. Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests. D. Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.

Discussion 0

Correct Answer: A Vote an answer

Question 4

Refer to the exhibit.

Which code snippet will parse the response to identify the status of the domain as malicious, clean or undefined?

A. Option B B. Option A C. Option C D. Option D

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit.

An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

A. The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible B. There is a malware that is communicating via encrypted channels to the command and control server C. There is a possible data leak because payloads should be encoded as UTF-8 text D. The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

Which action should be taken when the HTTP response code 301 is received from a web application?

A. Increase the allowed user limit. B. Update the cached header metadata. C. Modify the session timeout setting. D. Confirm the resource's location.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit.

Cisco Advanced Malware Protection installed on an end-user desktop automatically submitted a low prevalence file to the Threat Grid analysis engine. What should be concluded from this report?

A. Threat scores are high, malicious activity is detected, but files have not been modified B. Threat scores are low and no malicious file activity is detected C. Threat scores are high, malicious ransomware has been detected, and files have been modified D. Threat scores are low, malicious ransomware has been detected, and files have been modified

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?

A. Determine the escalation path B. Install IPS software C. Perform vulnerability assessment D. Contain the malware

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

Refer to the exhibit.

Rapid Threat Containment using Cisco Secure Network Analytics (Stealthwatch) and ISE detects the threat of malware-infected 802.1x authenticated endpoints and places that endpoint into a quarantine VLAN using Adaptive Network Control policy. Which method was used to signal ISE to quarantine the endpoints?

A. pxGrid B. syslog C. REST API D. SNMP

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).