50 free Cisco 350-201 CBRCOR practice questions from the CertStash pack of 228, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 50 free here, all 228 in the pack, and each step includes the one before it.
Get all 228 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled. Which activity triggered the behavior analytics tool?
Show answer and explanation
Correct answer: D. downloading more than 10 files
Behavior analytics tools are designed to detect anomalous activities that deviate from normal user patterns. Downloading more than 10 files represents a quantifiable threshold that typically triggers alerts in such systems, as it indicates data exfiltration activity. While accessing multiple servers is suspicious, the downloading of a significant volume of files is the specific metric-based behavior that automated tools use to detect compromise. The other activities (accessing AD, accessing financial server, accessing multiple servers) represent contextual information but lack the specific threshold-based trigger that behavior analytics tools use.
Why the other options are wrong
- A. Accessing the Active Directory server alone would not necessarily trigger behavior analytics without additional suspicious activity.
- B. The session disconnection and account disabling were reactive responses, not the trigger itself.
- C. Accessing multiple servers is suspicious but lacks the specific quantifiable threshold that automated behavior analytics tools use for detection.
Question 2
The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?
Show answer and explanation
Correct answer: D. Identify movement of the attacker in the enterprise
In the initial analysis phase of a physical security incident, the security specialist must first understand what occurred and trace the unauthorized person's movement through the facility. Identifying the attacker's movement and access path is the critical first step before taking any remedial action. This establishes the scope of the incident and determines which areas may have been compromised. Only after understanding movement patterns can the organization determine which assets were accessed, what was handled, or what control changes are necessary.
Why the other options are wrong
- A. Determining asset access is a later step that depends on knowing the attacker's location and movement first.
- B. Identifying specific assets handled comes after establishing the scope of movement through the facility.
- C. Changing access controls is a remediation step that should only occur after the full scope of the incident is understood.
Question 3
A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment. The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)
Show answer and explanation
Correct answer: B, E. asset vulnerability assessment; malware analysis report
According to NIST risk assessment methodology, calculating risk requires: assets (provided), vulnerabilities (vulnerability assessment), and threat information. The two missing elements are the asset vulnerability assessment, which identifies what security weaknesses exist in the organization's assets, and a malware analysis report, which provides the threat information specific to the malware variant discovered. These elements allow the organization to assess the likelihood of exploitation and potential impact. Incident response playbooks, staff relations reports, and executive listings are not components of the risk calculation itself.
Why the other options are wrong
- A. Incident response playbooks address response procedures, not risk assessment components.
- C. Staff relations to assets are not required for calculating risk in the NIST framework.
- D. While key assets matter, this option is incomplete and doesn't address the specific missing technical components needed for risk calculation.
Question 4
According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?
Show answer and explanation
Correct answer: B. Conduct a data protection impact assessment
GDPR requires organizations to conduct a Data Protection Impact Assessment (DPIA) to ensure data security and compliance. The DPIA is the formal process mandated by GDPR for evaluating how personal data is processed, identifying risks to confidentiality, integrity, and availability, and implementing appropriate safeguards. This assessment is the specific GDPR mechanism for ensuring the three pillars of data security. Vulnerability assessments, penetration testing, and awareness testing are security activities but are not the GDPR-specific requirement for ensuring data protection.
Why the other options are wrong
- A. Vulnerability assessments are security practices but not the specific GDPR requirement for data protection.
- C. Penetration testing is a security testing method but not the GDPR-mandated approach for ensuring data confidentiality, integrity, and availability.
- D. Awareness testing addresses user training but is not the formal mechanism GDPR specifies for protecting data.
Question 5
A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?
Show answer and explanation
Correct answer: C. Classify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited
At the detection and analysis phase of incident response, the team must focus on understanding what happened: classifying the attack vector (how the attack occurred), understanding the scope (how many systems are affected), and identifying what vulnerabilities are being exploited. These actions allow the team to contain and assess the incident properly. Option A focuses on attacker research which is secondary. Option B relates to damage assessment and evidence collection which occur in later phases. Option D addresses risk evaluation and communication which are broader organizational responses that follow initial analysis.
Why the other options are wrong
- A. Researching attacker motives and identifying missing patches are secondary activities that follow understanding the immediate attack vector and scope.
- B. Determining business damage and extracting reports are part of the documentation and damage assessment phase, not the initial analysis phase.
- D. Evaluating risks and communicating escalation are important but occur after the technical analysis of what occurred and how it occurred.
Question 6
A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?
Show answer and explanation
Correct answer: D. Fix applications according to the risk scores
When an organization discovers multiple vulnerabilities across applications, the proper remediation approach is to prioritize patching based on risk scores. Risk scores account for vulnerability severity, exploitability, asset criticality, and business impact. By fixing applications according to risk scores, the organization ensures that the most dangerous vulnerabilities are addressed first with limited resources. Option A is inventory management rather than patching strategy. Option B addresses third-party software but the audit found vulnerabilities in the organization's own applications. Option C involves testing existing vulnerabilities rather than planning remediation.
Why the other options are wrong
- A. Identifying applications is an inventory step, not a patching recommendation.
- B. This addresses third-party patching but the audit found issues in the company's hosted applications.
- C. Validating CSRF through exploitation is a testing activity, not a patching recommendation.
Question 7
An engineer is analyzing a possible compromise that happened a week ago when the company database servers unexpectedly went down. The analysis reveals that attackers tampered with Microsoft SQL Server Resolution Protocol and launched a DDoS attack. The engineer must act quickly to ensure that all systems are protected. Which two tools should be used to detect and mitigate this type of future attack? (Choose two.)
Show answer and explanation
Correct answer: A, E. firewall; IPS
To detect and mitigate DDoS attacks in the future, an organization needs both a firewall and an Intrusion Prevention System (IPS). A firewall can block traffic from known malicious sources and filter suspicious packets attempting to exploit protocols like Microsoft SQL Server Resolution Protocol. An IPS can actively detect and block malicious traffic patterns characteristic of DDoS attacks in real-time. Together, these tools provide both preventive filtering and active threat blocking. Wireshark is a passive network analysis tool suitable for investigation but not mitigation. Autopsy is a forensic tool for analyzing compromised systems. SHA512 is a hashing algorithm unrelated to DDoS protection.
Why the other options are wrong
- B. Wireshark is a passive packet analyzer used for investigation, not for actively detecting or mitigating DDoS attacks.
- C. Autopsy is a forensic analysis tool for examining compromised systems, not for preventing DDoS attacks.
- D. SHA512 is a cryptographic hash function with no direct role in DDoS detection or mitigation.
Question 8
A European-based advertisement company collects tracking information from partner websites and stores it on a local server to provide tailored ads. Which standard must the company follow to safeguard the resting data?
Show answer and explanation
Correct answer: D. GDPR
GDPR (General Data Protection Regulation) is the European Union's data protection standard that applies to any organization collecting and storing personal data from EU residents. Since this is a European-based company collecting tracking information from partner websites and storing it locally, GDPR is the applicable standard. GDPR specifically mandates how personal data must be safeguarded, including requirements for data protection, consent, and security of resting data. HIPAA applies to healthcare organizations in the United States. PCI-DSS applies to payment card data. Sarbanes-Oxley applies to financial reporting and corporate governance.
Why the other options are wrong
- A. HIPAA is the US healthcare data protection standard, not applicable to advertisement companies or European operations.
- B. PCI-DSS applies specifically to payment card data, not general tracking information.
- C. Sarbanes-Oxley addresses financial reporting and corporate governance, not personal data protection.
Question 9
An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?
Show answer and explanation
Correct answer: B. Update the IDS/IPS signatures and reimage the affected hosts
The recovery phase of incident response focuses on restoring systems to normal operations after containment and eradication are complete. Updating IDS/IPS signatures addresses the attack vector to prevent recurrence, while reimaging affected hosts removes all traces of compromise and ensures a clean state. Discovery meetings and policy updates occur in the post-incident phase, traffic analysis occurs during investigation, and identifying affected systems occurs during detection/analysis phases.
Why the other options are wrong
- A. Policy updates and configuration reviews are post-incident activities, not recovery phase actions.
- C. Identifying affected systems and attack tools occurs during the detection and analysis phases, before recovery.
- D. Network traffic analysis and email filter review are investigative activities that occur before the recovery phase.
Question 10
An engineer is going through vulnerability triage with company management because of a recent malware outbreak from which 21 affected assets need to be patched or remediated. Management decides not to prioritize fixing the assets and accepts the vulnerabilities. What is the next step the engineer should take?
Show answer and explanation
Correct answer: B. Acknowledge the vulnerabilities and document the risk
When management accepts the risk and decides not to remediate vulnerabilities, the engineer must document this decision and acknowledge the accepted vulnerabilities. This creates a formal record of the risk acceptance, establishes accountability, and ensures the organization understands the exposure it is assuming. Investigation, patching, and isolation are contraindicated when management has explicitly chosen acceptance.
Why the other options are wrong
- A. Investigation is appropriate before management decides, not after risk acceptance.
- C. Applying patches contradicts the management decision to accept the vulnerabilities without remediation.
- D. Isolating assets contradicts the management decision to accept and not remediate the vulnerabilities.
What people say about the full 350-201 pack 5.0 from 2
These practice files worked really well for me, they were actually not bad at all. The explanations were short and easy to understand. I liked the layout; it was simple but effective. They helped me clear my exam calmly and confidently.
I wasn’t sure what to expect with the 350-201 exam, but the practice questions helped clarify things. The practice questions were useful and gave me confidence going into the test.
Question 11
A customer is using a central device to manage network devices over SNMPv2. A remote attacker caused a denial of service condition and can trigger this vulnerability by issuing a GET request for the ciscoFlashMIB OID on an affected device. Which should be disabled to resolve the issue?
Show answer and explanation
Correct answer: A. SNMPv2
The vulnerability described, a denial of service condition triggered by a GET request for a specific MIB OID using SNMPv2, is inherent to SNMPv2 itself. SNMPv2 lacks the security features present in SNMPv3 and is known for multiple vulnerabilities including those affecting MIB object access. Disabling SNMPv2 and upgrading to SNMPv3 (or using SNMPv3 exclusively) eliminates this attack vector. Disabling TCP or UDP small services and blocking ports 161/162 are less precise mitigations that would also disable legitimate SNMP management functions.
Why the other options are wrong
- B. TCP small services are unrelated to SNMPv2 vulnerabilities and this action would not resolve the specific ciscoFlashMIB OID vulnerability.
- C. Blocking UDP ports 161/162 would disable SNMP entirely, but disabling the vulnerable SNMPv2 protocol specifically is the more targeted solution.
- D. UDP small services are unrelated to SNMPv2; the vulnerability stems from the protocol version itself, not small services.
Question 12
An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?
Show answer and explanation
Correct answer: C. predictive
Predictive analytics uses historical data patterns and trends to forecast future events. By analyzing six months of cyberattack data, an engineer can identify patterns that indicate where and how future attacks may occur, enabling proactive mitigation. Diagnostic analytics explains why attacks happened, qualitative analysis focuses on non-numerical data, and statistical analysis describes data without prediction.
Why the other options are wrong
- A. Diagnostic analytics explains past events but does not predict future attacks.
- B. Qualitative analysis examines non-numerical characteristics and does not provide predictive forecasting.
- D. Statistical analysis describes and summarizes data but does not inherently predict future attack patterns.
Question 13
A security architect is working in a processing center and must implement a DLP solution to detect and prevent any type of copy and paste attempts of sensitive data within unapproved applications and removable devices. Which technical architecture must be used?
Show answer and explanation
Correct answer: C. DLP for data in use
DLP for data in use is the correct architecture because the scenario requires detecting and preventing copy and paste attempts within applications and to removable devices in real-time. Data in use refers to information actively being processed, accessed, or manipulated by users and applications. This is when users are performing actions like copying sensitive data to unapproved applications or removable media, making it the appropriate DLP category to monitor and control these endpoint activities.
Why the other options are wrong
- A. DLP for data in motion protects information traveling across networks, not local copy and paste operations.
- B. DLP for removable data focuses on removable media management but doesn't specifically address in-application copy and paste prevention.
- D. DLP for data at rest protects stored information on servers and storage systems, not actively used data in applications.
Question 14
How is a SIEM tool used?
Show answer and explanation
Correct answer: D. To collect and analyze security data from network devices and servers and produce alerts
A SIEM tool's primary function is to collect security data from various network devices and servers, then analyze that data to produce actionable alerts. The collection phase gathers logs from firewalls, intrusion detection systems, authentication systems, and other security infrastructure. The analysis phase correlates this data to identify security events and generate alerts. Option D accurately describes this complete process from data collection through analysis and alert generation, which is the fundamental purpose of SIEM systems.
Why the other options are wrong
- A. This describes log collection only, omitting the analysis and alert generation components that are central to SIEM.
- B. This describes a compliance or audit function comparing against standards, not the core SIEM function of collecting and analyzing security data.
- C. This describes automated incident response triggering, which is beyond SIEM's primary role of data collection and analysis.
Question 15
A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?
Show answer and explanation
Correct answer: B. event severity and likelihood
To calculate risk, the analyst needs event severity and likelihood in addition to threat sources, events, and vulnerabilities. Risk is fundamentally calculated as the combination of the probability that a threat will occur and the impact if it does. Severity represents impact, and likelihood represents probability. Together these elements enable the quantitative or qualitative risk formula.
Why the other options are wrong
- A. Assessment scope defines what is included in the assessment but does not contribute to the risk calculation itself.
- C. The incident response playbook is relevant to response, not to calculating the risk value.
- D. A risk model framework provides methodology but is not an additional element needed beyond threat, event, and vulnerability data.
Question 16
A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?
Show answer and explanation
Correct answer: C. Identify systems or services at risk
After confirming the attacker has credentials and remote access tools, the immediate priority is to identify which systems and services are at risk from the compromised credentials. This assessment determines the scope of potential compromise and guides containment and remediation priorities. Blocking the IP is premature without knowing the threat scope, antivirus scanning addresses only the laptop, and lateral movement investigation occurs after understanding the systems at risk.
Why the other options are wrong
- A. Blocking the IP may disrupt investigation and does not address the compromised credentials or systems at risk.
- B. Scanning the laptop for malware is reactive and doesn't address the immediate threat to network systems using the stolen credentials.
- D. Identifying lateral movement is an investigative step that should follow assessment of which systems are at risk.
Question 17
An engineer received an alert of a zero-day vulnerability affecting desktop phones through which an attacker sends a crafted packet to a device, resets the credentials, makes the device unavailable, and allows a default administrator account login. Which step should an engineer take after receiving this alert?
Show answer and explanation
Correct answer: B. Determine company usage of the affected products
When a zero-day vulnerability alert is received, the first critical step is to determine whether the organization actually uses the affected products and to what extent. This asset inventory and impact assessment enables proper prioritization and resource allocation. Without knowing if your company uses affected desktop phones, all other actions are premature. Once scope is understood, the team can then decide on patches, mitigations, or other responses.
Why the other options are wrong
- A. While triage meetings are important, they occur after establishing whether the vulnerability affects your environment.
- C. Searching for patches is premature before confirming the company uses the affected products.
- D. Implementing VoIP VLAN restrictions assumes affected devices are in use and may not be the appropriate mitigation strategy without full assessment.
Question 18
What is a limitation of cyber security risk insurance?
Show answer and explanation
Correct answer: C. It does not cover the costs of damage done by third parties as a result of a cyber attack
Cyber security risk insurance typically does not cover damages caused by third parties resulting from the insured organization's cyber attack. This is a common exclusion because it represents liability extending beyond the organization's direct losses, shifting responsibility to third-party victims. Insurance policies focus on the organization's own incident response and recovery costs rather than liabilities to external parties.
Why the other options are wrong
- A. Identity theft restoration is often covered under cyber insurance policies as part of breach response and notification services.
- B. Forensic analysis costs are typically covered expenses under cyber insurance as part of incident investigation and remediation.
- D. Public relations and crisis management services related to cyber incidents are commonly included in cyber insurance coverage.
Question 19
Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?
Show answer and explanation
Correct answer: D. chmod 777
The chmod 777 command sets read (4), write (2), and execute (1) permissions for everyone: owner (7), group (7), and others (7). This grants full rwx access to all users who access the resource. chmod 666 lacks execute permission, chmod 774 restricts group and others from writing and executing, and chmod 775 restricts others from writing.
Why the other options are wrong
- A. chmod 666 grants read and write but not execute permission to all users.
- B. chmod 774 restricts execute access for group and write/execute for others.
- C. chmod 775 restricts write permission for others while allowing execute.
Question 20
An analyst is alerted for a malicious file hash. After analysis, the analyst determined that an internal workstation is communicating over port 80 with an external server and that the file hash is associated with Duqu malware. Which tactics, techniques, and procedures align with this analysis?
Show answer and explanation
Correct answer: A. Command and Control, Application Layer Protocol, Duqu
A workstation communicating with an external server over port 80 using the HTTP application layer protocol indicates Command and Control (C2) communication. The malware hash is identified as Duqu, which is known for establishing command and control channels over standard HTTP ports. This activity represents the Command and Control tactic using the Application Layer Protocol technique.
Why the other options are wrong
- B. Discovery and SMB/Windows Admin Shares techniques do not match the described behavior of external communication over port 80 via HTTP.
- C. Lateral Movement and SMB techniques are not indicated by communication to an external server over port 80; this is characteristic of C2 activity.
- D. Discovery and System Network Configuration Discovery techniques do not align with the described external communication pattern, which is indicative of C2 command retrieval.
Question 21
A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?
Show answer and explanation
Correct answer: A. Determine the systems involved and deploy available patches
During the recovery stage of incident response, the engineer must focus on restoring systems to normal operations. After a remote code execution attack via phishing, the priority is to identify which systems were compromised and apply available patches to prevent reinfection and close the vulnerability that was exploited. This directly addresses remediation and restoration of the infrastructure.
Why the other options are wrong
- B. Analysis and network restriction occur during containment and investigation phases, not the recovery phase.
- C. Password complexity changes are preventive measures but do not address recovery of already-compromised systems.
- D. Updating IDS signatures is a detection improvement but is not part of the recovery stage; it occurs in post-incident hardening.
Question 22
An engineer has created a bash script to automate a complicated process. During script execution, this error occurs: permission denied. Which command must be added to execute this script?
Show answer and explanation
Correct answer: A. chmod +x ex.sh
The 'permission denied' error occurs when a bash script lacks execute permissions. The chmod +x command adds execute permissions to the file, allowing it to run as an executable script. This is the standard method to grant execution rights to a script file.
Why the other options are wrong
- B. source ex.sh executes the script in the current shell but does not change file permissions, so it will still fail with permission denied.
- C. chroot changes the root directory and is unrelated to making a script executable.
- D. sh ex.sh runs the script through the sh interpreter, but this still requires the file to have appropriate permissions or will fail with permission denied.
Question 23
A security expert is investigating a breach that resulted in a $32 million loss from customer accounts. Hackers were able to steal API keys and two-factor codes due to a vulnerability that was introduced in a new code a few weeks before the attack. Which step was missed that would have prevented this breach?
Show answer and explanation
Correct answer: D. use of SecDevOps to detect the vulnerability during development
SecDevOps (Secure Development Operations) is the step that was missed because the vulnerability was introduced in new code and should have been detected during the development phase before deployment. SecDevOps integrates security testing, code analysis, and vulnerability scanning into the development pipeline, catching flaws like the API key exposure and insecure two-factor code handling before code reaches production. This proactive approach at development time would have prevented the vulnerability from ever being deployed.
Why the other options are wrong
- A. Nmap is a network scanning tool designed for external network reconnaissance, not for analyzing source code vulnerabilities in newly developed applications.
- B. Firewalls and intrusion detection systems are perimeter defenses that cannot detect code-level vulnerabilities within trusted applications.
- C. Endpoint protection systems detect and prevent malware execution but cannot identify application-level vulnerabilities in legitimate code.
Question 24
An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?
Show answer and explanation
Correct answer: C. Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts
Adding a confirmation step where SOAR notifies affected users and requests verification directly addresses the root cause of false positives harming legitimate users. This human-in-the-loop approach prevents automatic remediation from incorrectly blocking legitimate activities while maintaining security. User confirmation provides immediate feedback on whether suspicious behavior is actually malicious, allowing the workflow to learn and improve detection rules over time.
Why the other options are wrong
- A. Awareness meetings and rule modification address symptoms but do not prevent immediate damage to legitimate users from automatic remediation.
- B. Removing automatic remediation defeats the purpose of SOAR automation and leaves threats unaddressed.
- D. Tuning rules for privileged accounts leaves other users vulnerable and does not solve the false positive problem.
Question 25
A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?
Show answer and explanation
Correct answer: A. Isolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack
Isolating the server and performing forensic analysis is the correct next step because the indicators present, PowerShell execution, WMI tool invocation, and a PE file in the system directory following an unidentified connection, strongly suggest active malware or unauthorized code execution. Immediate isolation prevents further lateral movement or data exfiltration, and forensic analysis of the PE file determines the exact threat. This follows proper incident response protocol by containing the threat before investigation, which takes precedence over verification of legitimacy or risk assessment.
Why the other options are wrong
- B. Contacting the server owner first wastes critical time and risks the attacker having time to cover tracks or spread laterally.
- C. Reviewing backups and assessing data criticality is important but secondary to isolating an active suspected compromise.
- D. Performing behavioral analysis on an isolated workstation delays containment and is less definitive than analyzing the actual system where the breach occurred.
Question 26
An audit is assessing a small business that is selling automotive parts and diagnostic services. Due to increased customer demands, the company recently started to accept credit card payments and acquired a POS terminal. Which compliance regulations must the audit apply to the company?
Show answer and explanation
Correct answer: D. PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) is the compliance regulation that applies specifically to organizations that accept, process, store, or transmit credit card payments. The company's recent acquisition of a POS terminal and acceptance of credit card payments directly triggers PCI DSS compliance requirements. HIPAA applies to healthcare organizations handling protected health information. FISMA applies to U.S. federal government agencies and their contractors. COBIT is a governance framework, not a compliance regulation.
Why the other options are wrong
- A. HIPAA applies to healthcare providers and health plans, not automotive parts retailers.
- B. FISMA applies to U.S. federal agencies and contractors, not private commercial businesses.
- C. COBIT is an IT governance framework and best practices guide, not a compliance regulation mandated for payment processors.
Question 27
Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system's startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?
Show answer and explanation
Correct answer: C. Identify affected systems
When an analyst discovers evidence of malware (malicious shortcuts) on one system and multiple employees have reported system crashes within the same week, the next logical investigation step is to identify all affected systems across the organization. This scope expansion is critical for understanding the full extent of the incident and preventing further damage. After identifying the scope of affected systems, the analyst can then investigate root causes, check logs, and take remediation actions. Removing files should not occur before establishing the full scope of the incident, and investigating individual URLs should follow after understanding the breadth of the compromise.
Why the other options are wrong
- A. Removing the shortcut files prematurely could destroy evidence needed for full investigation and prevent understanding the complete scope of the incident.
- B. While audit logs provide valuable investigative data, first establishing how many systems are affected is necessary before deep-diving into log analysis.
- D. Investigating specific malicious URLs is useful for understanding the threat, but should occur after determining how many systems are compromised.
Question 28
A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?
Show answer and explanation
Correct answer: B. Isolate critical hosts from the network
After a malware outbreak is confirmed, the first action is to isolate critical hosts from the network to prevent lateral movement and further compromise. Containment must be the immediate priority to stop active threats. Network assessment, patching, and risk analysis are important but occur after the threat is contained.
Why the other options are wrong
- A. Assessing the network for unexpected behavior is an investigative step that should follow immediate containment.
- C. Patching is a remediation action that occurs after containment is established.
- D. Risk factor analysis is a post-incident review activity, not the first action during active mitigation.
Question 29
An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?
Show answer and explanation
Correct answer: C. Analyze the precursors and indicators
When an allegation of a possible incident is received, the analyst must first analyze the precursors and indicators, the observable signs and evidence that suggest whether an incident has actually occurred. This involves examining logs, communications, and data access patterns to determine if the reported suspicious activity actually constitutes a confirmed incident before escalation or formal investigation.
Why the other options are wrong
- A. Analyzing environmental threats and causes occurs after confirming an incident has occurred, not during initial determination.
- B. Informing product security is premature before establishing whether an actual incident has occurred.
- D. While the CSIRT may eventually investigate, the analyst must first determine if the precursors and indicators support an actual incident before escalation.
Question 30
What do 2xx HTTP response codes indicate for REST APIs?
Show answer and explanation
Correct answer: D. successful acceptance of the client's request
HTTP 2xx status codes indicate successful responses where the server has accepted, understood, and processed the client's request. These codes (200 OK, 201 Created, 202 Accepted, etc.) signify that the action requested by the client was received, understood, accepted, and processed successfully by the server.
Why the other options are wrong
- A. 3xx codes indicate redirection and require additional client action, not 2xx codes.
- B. 4xx codes indicate client errors and 5xx codes indicate server errors; 2xx codes indicate success, not error responsibility.
- C. 1xx codes communicate informational and protocol-level transfer information, not 2xx codes.
Question 31
An engineer receives an incident ticket with hundreds of intrusion alerts that require investigation. An analysis of the incident log shows that the alerts are from trusted IP addresses and internal devices. The final incident report stated that these alerts were false positives and that no intrusions were detected. What action should be taken to harden the network?
Show answer and explanation
Correct answer: B. Move the IPS to before the firewall facing the outside network
The alerts originated from trusted internal IP addresses and internal devices, indicating the IPS generated false positives on legitimate traffic. The IPS should be positioned before (outside of) the external firewall to inspect untrusted external traffic and prevent false alerts from known-good internal sources. Placement after the internal firewall means the IPS monitors already-filtered internal traffic, causing unnecessary alerts on trusted devices.
Why the other options are wrong
- A. Placing the IPS after the internal firewall would continue to generate false positives from trusted internal devices.
- C. Proxy services on the IPS do not address the root cause of false positives from internal traffic.
- D. Reverse port forwarding does not help reduce false positives or improve IPS accuracy.
Question 32
A patient views information that is not theirs when they sign in to the hospital's online portal. The patient calls the support center at the hospital but continues to be put on hold because other patients are experiencing the same issue. An incident has been declared, and an engineer is now on the incident bridge as the CyberOps Tier 3 Analyst. There is a concern about the disclosure of PII occurring in real-time. What is the first step the analyst should take to address this incident?
Show answer and explanation
Correct answer: C. Turn off all access to the patient portal to secure patient records
When a real-time privacy breach is occurring with active PII disclosure affecting multiple patients, the immediate priority is to stop the bleeding. Disabling access to the patient portal stops the ongoing unauthorized disclosure of sensitive information. This containment action must be taken before investigation or analysis to prevent further harm. Investigating the cause or contacting third parties does not stop current data exposure.
Why the other options are wrong
- A. Evaluating visibility tools takes time during ongoing exposure; containment must occur first.
- B. While escalation is important, it does not immediately stop the real-time data disclosure happening now.
- D. Reviewing logs for root cause analysis occurs after containment to prevent further compromise.
Question 33
An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?
Show answer and explanation
Correct answer: C. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.
The optimal solution identifies assets outside the PKI management zone, segments them by responsibility owner, and automates alerting for needed updates. This addresses the core problem of tracking certificates outside PKI and manually searching for server owners by automating both discovery and owner notification. Option A creates tickets but doesn't solve the tracking problem for out-of-scope certificates. Option B attempts to duplicate PKI functionality within SOAR rather than improve workflow. Option D relies on Active Directory integration but doesn't capture assets that may not be in AD or adequately track certificates outside PKI.
Why the other options are wrong
- A. Creating tickets in the incident response system doesn't address the fundamental problem of identifying and tracking problematic certificates outside PKI.
- B. Duplicating PKI certificate creation and management within SOAR is redundant and doesn't improve the existing PKI-SOAR integration.
- D. Email alerts to server owners don't solve the problem of identifying which assets are outside PKI management or automating certificate tracking.
Question 34
What is a principle of Infrastructure as Code?
Show answer and explanation
Correct answer: A. System maintenance is delegated to software systems
Infrastructure as Code delegates system maintenance to software systems by defining infrastructure through code and automation rather than manual processes. This enables repeatable, version-controlled, and auditable infrastructure deployments. Software systems handle provisioning, configuration, and updates automatically, reducing manual overhead and human error.
Why the other options are wrong
- B. Comprehensive initial designs are not a core IaC principle; IaC emphasizes iterative and incremental infrastructure changes.
- C. IaC specifically replaces manual configurations with scripts and automation, not combines them together.
- D. Scheduled system downtime is not a principle of IaC; IaC aims for continuous deployment and minimal disruption.
Question 35
How does Wireshark decrypt TLS network traffic?
Show answer and explanation
Correct answer: A. with a key log file using per-session secrets
Wireshark decrypts TLS traffic using a key log file containing per-session secrets (typically from the SSLKEYLOGFILE environment variable). Modern TLS implementations export session secrets to a log file that Wireshark can consume, allowing decryption without access to long-term keys. This works because the per-session secrets are sufficient to decrypt the recorded traffic.
Why the other options are wrong
- B. RSA public keys alone cannot decrypt TLS traffic; only the private key could theoretically do so, and modern TLS uses forward secrecy making this impossible.
- C. Observing DH key exchange does not provide the session secrets needed for decryption.
- D. decode-as is a Wireshark feature for protocol selection, not for TLS decryption.
Question 36
An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)
Show answer and explanation
Correct answer: B, D. log in during non-working hours; log in from a first-seen country
UEBA (User and Entity Behavior Analytics) detects anomalies based on deviations from established user behavior patterns. Login from a first-seen country represents a geographical anomaly that deviates from the employee's normal pattern. Logging in during non-working hours is a temporal anomaly that indicates unusual access timing. These two factors together represent behavioral deviations that UEBA systems are designed to flag. While the external domain belonging to a competitor provides context for the security incident, it is not itself a behavioral trigger. The increased number of sent mails and email forwarding to external domains are activities that occur after the behavioral anomalies have already been detected.
Why the other options are wrong
- A. Domain ownership is investigative context, not a behavioral anomaly that UEBA detects.
- C. Email forwarding is the malicious action taken, but not the behavioral pattern deviation that triggered the initial alert.
- E. Increased email volume is suspicious activity content, but the behavioral triggers are the login anomalies that occurred first.
Question 37
An engineer is developing an application that requires frequent updates to close feedback loops and enable teams to quickly apply patches. The team wants their code updates to get to market as often as possible. Which software development approach should be used to accomplish these goals?
Show answer and explanation
Correct answer: A. continuous delivery
Continuous delivery is the approach that emphasizes frequent code updates with the capability to release to production at any time, enabling teams to get updates to market as often as needed. Continuous delivery maintains a codebase in a releasable state and automates testing and staging processes while still requiring manual approval for production release. This approach directly addresses the requirements of closing feedback loops quickly and applying patches frequently. Continuous integration focuses on automated testing of code merges. Continuous deployment automatically releases to production after passing tests. Continuous monitoring oversees system operations.
Why the other options are wrong
- B. Continuous integration automates testing and merging of code changes, but does not address getting updates to market frequently.
- C. Continuous deployment automatically releases every build to production, which may be too aggressive for an organization that wants control over release timing.
- D. Continuous monitoring tracks operational metrics and system health, but does not address software development and delivery approaches.
Question 38
An employee abused PowerShell commands and script interpreters, which lead to an indicator of compromise (IOC) trigger. The IOC event shows that a known malicious file has been executed, and there is an increased likelihood of a breach. Which indicator generated this IOC event?
Show answer and explanation
Correct answer: A. ExecutedMalware.ioc
ExecutedMalware.ioc is the correct indicator because the question explicitly states that a known malicious file has been executed, which directly triggered the IOC event. The indicator name matches the observable artifact, actual execution of malware on the system. This is the most straightforward indicator for detecting when malicious code has been run, which is exactly what occurred when the employee abused PowerShell and script interpreters.
Why the other options are wrong
- B. Crossrider.ioc refers to a specific malware family but doesn't directly indicate the execution of any malicious file.
- C. ConnectToSuspiciousDomain.ioc indicates network-based suspicious activity, not local file execution.
- D. W32.AccesschkUtility.ioc refers to a legitimate Windows utility often misused by attackers, but the IOC specifically mentions a known malicious file execution, not utility abuse.
Question 39
The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?
Show answer and explanation
Correct answer: A. Contain the malware
The NIST incident response lifecycle consists of four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activities. The scenario describes detection/analysis (malware identified), eradication (malware removed), recovery (functionality restored), and post-incident (meeting planned). However, containment, the critical step of limiting the scope and spread of the malware, was not mentioned and is a distinct required phase between detection and eradication.
Why the other options are wrong
- B. Installing IPS software is a preparatory or hardening measure, not part of the core NIST response phases.
- C. Determining escalation paths occurs during preparation, not as a missing step in an ongoing incident.
- D. Vulnerability assessment is a post-incident hardening activity, not a phase missing from the described incident response.
Question 40
What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?
Show answer and explanation
Correct answer: D. 404
HTTP 404 Not Found is the correct response when a requested resource cannot be found, regardless of user authentication status. This code indicates the resource does not exist on the server. It applies to authenticated users seeking information that simply is not available.
Why the other options are wrong
- A. 401 Unauthorized indicates authentication is required or has failed, not that a resource cannot be found.
- B. 402 Payment Required is rarely used and unrelated to resource availability.
- C. 403 Forbidden indicates the user is authenticated but lacks permission, not that the resource doesn't exist.
- E. 405 Method Not Allowed indicates the HTTP method is not supported for the resource.
Question 41
An engineer is investigating several cases of increased incoming spam emails and suspicious emails from the HR and service departments. While checking the event sources, the website monitoring tool showed several web scraping alerts overnight. Which type of compromise is indicated?
Show answer and explanation
Correct answer: A. phishing
The indicators described, increased spam, suspicious emails from trusted departments (HR and service), and web scraping alerts, are consistent with a phishing attack. Attackers commonly impersonate legitimate departments to harvest credentials or information. Web scraping alerts suggest automated data collection targeting the organization's web resources, which aligns with reconnaissance for phishing campaigns.
Why the other options are wrong
- B. Dumpster diving is a physical attack method involving searching through trash for sensitive information and would not trigger web scraping alerts.
- C. Social engineering is broader than phishing; while phishing is a form of social engineering, the specific technical indicators (web scraping alerts) point more directly to phishing.
- D. Privilege escalation involves gaining elevated access within a system and does not explain the email and web scraping activity patterns observed.
Question 42
An engineer is moving data from NAS servers in different departments to a combined storage database so that the data can be accessed and analyzed by the organization on-demand. Which data management process is being used?
Show answer and explanation
Correct answer: C. data ingestion
Data ingestion is the process of importing data from multiple sources into a centralized repository for storage and analysis. The engineer is moving data from distributed NAS servers in different departments to a combined storage database, which is the classic definition of data ingestion. This centralized approach enables organization-wide data access and analytics capabilities. Data clustering groups similar data items together. Data regression is a statistical analysis method. Data obfuscation masks sensitive data.
Why the other options are wrong
- A. Data clustering groups similar data together, but does not describe the process of moving data from multiple sources to a central repository.
- B. Data regression is a statistical technique for modeling relationships between variables, not a data movement or consolidation process.
- D. Data obfuscation masks or encrypts sensitive data to protect it, but does not describe collecting data from multiple sources into a central database.
Question 43
An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?
Show answer and explanation
Correct answer: D. Modify the output module rule to "output alert_fast: output filename"
The alert_fast output module produces minimal packet information without full headers, significantly reducing file size while preserving essential alert details. This is the appropriate configuration when file size is problematic. The alert_fast option provides packet overviews as needed while eliminating the overhead of complete packet headers that bloat the output file.
Why the other options are wrong
- A. alert_syslog sends alerts to syslog and does not reduce packet header output to files.
- B. alert_quick is not a standard SNORT output module.
- C. alert_syslog with output header would actually increase header information in the output.
Question 44
What is a benefit of key risk indicators?
Show answer and explanation
Correct answer: A. clear perspective into the risk position of an organization
Key Risk Indicators provide organizations with a clear perspective into their current risk position by measuring and monitoring factors that indicate the organization's exposure to various risks. KRIs enable leadership to understand the organization's risk landscape, track changes over time, and make informed decisions about risk acceptance or mitigation priorities. This clear visibility into risk position is the primary benefit of establishing and monitoring KRIs. While KRIs provide quantifiable information, this is a supporting feature rather than the primary benefit.
Why the other options are wrong
- B. While KRIs do provide quantifiable information, this is a secondary characteristic rather than the primary benefit of improved visibility.
- C. KRIs help manage known and emerging risks through better measurement, but do not specifically improve mitigation techniques for unknown threats.
- D. KRIs provide visibility into risk position, but organizational procedures and processes are defined through separate governance frameworks, not through KRIs.
Question 45
Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?
Show answer and explanation
Correct answer: D. Internet
Threat intelligence tools search the Internet to identify malicious IP addresses, domain names, and URLs. This includes monitoring public feeds, dark web sources, known malware repositories, botnet command-and-control infrastructure, phishing databases, and collaborative security platforms. Customer data, internal databases, and cloud resources are too limited in scope and lack the breadth of information needed to identify emerging threats that originate from external sources.
Why the other options are wrong
- A. Customer data does not contain information about external malicious infrastructure.
- B. Internal databases lack the external threat context needed to identify new malicious entities.
- C. Internal cloud resources do not provide visibility into Internet-wide threat landscapes.
Question 46
The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive. The team collects and documents all the necessary evidence from the computing resource. What is the next step?
Show answer and explanation
Correct answer: B. Isolate the infected host from the rest of the subnet
After evidence collection and documentation are complete, the immediate next step is isolation to prevent further spread of the malware. The infected host must be removed from the network to contain the threat before other systems can be compromised. Risk assessment, malware prevention installation, and traffic analysis are either preventive measures or investigative steps that should not delay containment.
Why the other options are wrong
- A. Risk assessment is a post-incident analysis activity that comes after containment and recovery.
- C. Installing malware prevention software does not address the active threat; isolation must occur first.
- D. Network traffic analysis is part of investigation and should not delay the critical containment step.
Question 47
An engineer is utilizing interactive behavior analysis to test malware in a sandbox environment to see how the malware performs when it is successfully executed. A location is secured to perform reverse engineering on a piece of malware. What is the next step the engineer should take to analyze this malware?
Show answer and explanation
Correct answer: A. Run the program through a debugger to see the sequential actions
After securing a location for reverse engineering and identifying the malware in a sandbox, the next logical step is to run the program through a debugger to observe its sequential actions and behavior. This dynamic analysis allows the engineer to track execution flow, identify malicious routines, and understand the malware's functionality in real-time within the controlled sandbox environment.
Why the other options are wrong
- B. Unpacking is typically performed before dynamic analysis and is relevant if the malware is packed, but executing through a debugger is the more immediate next step.
- C. Online research may be helpful for context but does not constitute the engineer's own analysis and is typically supplementary rather than the primary investigative step.
- D. Disassembly is a static analysis technique that comes after or alongside dynamic analysis, not before running the debugger to observe behavior.
Question 48
An API developer is improving an application code to prevent DDoS attacks. The solution needs to accommodate instances of a large number of API requests coming for legitimate purposes from trustworthy services. Which solution should be implemented?
Show answer and explanation
Correct answer: D. Apply a limit to the number of requests in a given time interval for each API. If the rate is exceeded, block access from the API key temporarily and return a 429 HTTP error code.
Rate limiting with temporary blocks and HTTP 429 (Too Many Requests) is the standard approach for DDoS mitigation that accommodates legitimate high-volume traffic from trusted services. The 429 status code signals rate limit exceeded, allowing clients to implement backoff strategies. Temporary blocking permits legitimate services to resume after the rate limit window resets, distinguishing this from permanent account blocks. This solution scales across API keys rather than IP addresses, preventing legitimate multi-source traffic from being incorrectly flagged.
Why the other options are wrong
- A. Daily averages are too coarse for effective DDoS mitigation, and 402 Payment Required is semantically incorrect for rate limiting.
- B. REST API Security Essentials is not a standard mitigation pattern, and 409 Conflict is not the proper status code for rate limits.
- C. Permanent blocks destroy trust with legitimate services and 450 is not a valid HTTP status code.
Question 49
A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?
Show answer and explanation
Correct answer: B. Create a rule triggered by 1 successful VPN connection from any nondestination country
To detect abnormal behavior for a user known to be traveling between three specific countries, the analyst should flag any successful VPN connection originating from outside those three destination countries or during non-working hours. A rule triggered by successful VPN connections from non-destination countries identifies the specific anomaly: the user logging in from an unexpected location not aligned with their travel itinerary, which could indicate account compromise.
Why the other options are wrong
- A. Failed connection attempts are not indicators of successful unauthorized access or compromised credentials.
- C. Multiple successful connections from the destination countries are expected and normal given the travel plan.
- D. Retrospective log analysis after the fact does not proactively detect anomalous behavior in real-time.
Question 50
An engineer returned to work and realized that payments that were received over the weekend were sent to the wrong recipient. The engineer discovered that the SaaS tool that processes these payments was down over the weekend. Which step should the engineer take first?
Show answer and explanation
Correct answer: B. Contact the incident response team to inform them of a potential breach
When an engineer discovers that payments were misdirected due to a SaaS tool being down, and especially since payments went to wrong recipients, this indicates a potential security breach or unauthorized system manipulation. The first step is to contact the incident response team to formally initiate the incident response process, ensuring proper investigation, containment, and communication protocols are followed.
Why the other options are wrong
- A. While gathering information from the SaaS team is important, this should occur after notifying the incident response team to ensure proper escalation and coordination.
- C. Organizing a meeting to discuss affected services is premature before the incident response team has been engaged and can direct the investigation.
- D. Requesting manual payment processing bypasses the critical need to investigate the breach and determine what security measures must be taken to prevent recurrence.
That was 50 of 228.
The full Cisco 350-201 CBRCOR pack has all 228 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 77 free as one PDF by email. Get the Half Pack →