Cisco

350-201

Performing CyberOps Using Core Security Technologies (CBRCOR)

https://killexams.com/pass4sure/exam-detail/350-201

Question: 90 Section 1

A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?

Run the sudo sysdiagnose command
Run the sh command
Run the w command
Run the who command

Answer: A Reference:

https://eclecticlight.co/2016/02/06/the-ultimate-diagnostic-tool-sysdiagnose/

Question: 91 Section 1

A SOC analyst is investigating a recent email delivered to a high-value user for a customer whose network their organization monitors. The email includes a suspicious attachment titled "Invoice RE: 0004489". The hash of the file is gathered from the Cisco Email Security Appliance. After searching Open Source

Intelligence, no available history of this hash is found anywhere on the web. What is the next step in analyzing this attachment to allow the analyst to gather indicators of compromise?

Run and analyze the DLP Incident Summary Report from the Email Security Appliance
Ask the company to execute the payload for real time analysis
Investigate further in open source repositories using YARA to find matches
Obtain a copy of the file for detonation in a sandbox

Answer: D

Question: 92 Section 1

A SOC analyst is notified by the network monitoring tool that there are unusual types of internal traffic on IP subnet 103.861.2117.0/24. The analyst discovers unexplained encrypted data files on a computer system that belongs on that specific subnet. What is the cause of the issue?

DDoS attack
phishing attack
virus outbreak
malware outbreak

Answer: D

Question: 93 Section 1

Refer to the exhibit. An employee is a victim of a social engineering phone call and installs remote access software to allow an "MS Support" technician to check his machine

for malware. The employee becomes suspicious after the remote technician requests payment in the form of gift cards. The employee has copies of multiple, unencrypted database files, over 400 MB each, on his system and is worried that the scammer copied the files off but has no proof of it. The remote technician was connected sometime between 2:00 pm and 3:00 pm over https. What should be determined regarding data loss between the employee's laptop and the remote technician's system?

No database files were disclosed
The database files were disclosed
The database files integrity was violated
The database files were intentionally corrupted, and encryption is possible

Answer: C

Question: 94 Section 1

Refer to the exhibit. Which asset has the highest risk value?

servers
website
payment process
secretary workstation

Answer: C

Question: 95 Section 1 DRAG DROP -

Refer to the exhibit. The Cisco Secure Network Analytics (Stealthwatch) console alerted with "New Malware Server Discovered" and the IOC indicates communication from an

end-user desktop to a Zeus C&C Server. Drag and drop the actions that the analyst should take from the left into the order on the right to investigate and remediate this IOC. Select and Place:

Answer:

Question: 96 Section 1

What is the purpose of hardening systems?

to securely configure machines to limit the attack surface
to create the logic that triggers alerts when anomalies occur
to identify vulnerabilities within an operating system
to analyze attacks to identify threat actors and points of entry

Answer: A

Question: 97 Section 1

A company launched an e-commerce website with multiple points of sale through internal and external e-stores. Customers access the stores from the public website, and employees access the stores from the intranet with an SSO. Which action is needed to comply with PCI standards for hardening the systems?

Mask PAN numbers
Encrypt personal data
Encrypt access
Mask sales details

Answer: B

Question: 98 Section 1

An organization installed a new application server for IP phones. An automated process fetched user credentials from the Active Directory server, and the application will have access to on-premises and cloud services. Which security threat should be mitigated first?

aligning access control policies
exfiltration during data transfer
attack using default accounts
data exposure from backups

Answer: B

Question: 99 Section 1

A threat actor has crafted and sent a spear-phishing email with what appears to be a trustworthy link to the site of a conference that an employee recently attended. The employee clicked the link and was redirected to a malicious site through which the employee downloaded a PDF attachment infected with ransomware. The employee opened the attachment, which exploited vulnerabilities on the desktop. The ransomware is now installed and is calling back to its command and control server. Which security solution is needed at this stage to mitigate the attack?

web security solution
email security solution
endpoint security solution
network security solution

Answer: D

Question: 100 Section 1

Refer to the exhibit. An engineer is investigating a case with suspicious usernames within the active directory. After the engineer investigates and cross-correlates events from other sources, it appears that the 2 users are privileged, and their creation date matches suspicious network traffic that was initiated from the internal network 2 days prior. Which type of compromise is occurring?

compromised insider
compromised root access
compromised database tables
compromised network