[Q49-Q64] Pass 350-201 Exam in First Attempt Guaranteed 100% Cover Real Exam Questions [Jul-2022] : Exam for engine : http://blog.test4engine.com

Q49. An engineer is investigating several cases of increased incoming spam emails and suspicious emails from the HR and service departments. While checking the event sources, the website monitoring tool showed several web scraping alerts overnight. Which type of compromise is indicated?

phishing

dumpster diving

social engineering

privilege escalation

Q50. An engineer detects an intrusion event inside an organization’s network and becomes aware that files that contain personal data have been accessed. Which action must be taken to contain this attack?

Disconnect the affected server from the network.

Analyze the source.

Access the affected server to confirm compromised files are encrypted.

Determine the attack surface.

Q51. A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days.
Having the names of the 3 destination countries and the user’s working hours, what must the analyst do next to detect an abnormal behavior?

Create a rule triggered by 3 failed VPN connection attempts in an 8-hour period

Create a rule triggered by 1 successful VPN connection from any nondestination country

Create a rule triggered by multiple successful VPN connections from the destination countries

Analyze the logs from all countries related to this user during the traveling period

Q52. Refer to the exhibit.

An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible

The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information

There is a possible data leak because payloads should be encoded as UTF-8 text

There is a malware that is communicating via encrypted channels to the command and control server

Q53. According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?

Perform a vulnerability assessment

Conduct a data protection impact assessment

Conduct penetration testing

Perform awareness testing

Q54. An engineer received multiple reports from users trying to access a company website and instead of landing on the website, they are redirected to a malicious website that asks them to fill in sensitive personal dat a. Which type of attack is occurring?

Address Resolution Protocol poisoning

session hijacking attack

teardrop attack

Domain Name System poisoning

Q55. Drag and drop the mitigation steps from the left onto the vulnerabilities they mitigate on the right.

Q56. An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?

Modify the alert rule to “output alert_syslog: output log”

Modify the output module rule to “output alert_quick: output filename”

Modify the alert rule to “output alert_syslog: output header”

Modify the output module rule to “output alert_fast: output filename”

Q57. Refer to the exhibit.

For IP 192.168.1.209, what are the risk level, activity, and next step?

high risk level, anomalous periodic communication, quarantine with antivirus

critical risk level, malicious server IP, run in a sandboxed environment

critical risk level, data exfiltration, isolate the device

high risk level, malicious host, investigate further

Q58. Drag and drop the components from the left onto the phases of the CI/CD pipeline on the right.

Q59. An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

Host a discovery meeting and define configuration and policy updates

Update the IDS/IPS signatures and reimage the affected hosts

Identify the systems that have been affected and tools used to detect the attack

Identify the traffic with data capture using Wireshark and review email filters

Q60. A logistic company must use an outdated application located in a private VLAN during the migration to new technologies. The IPS blocked and reported an unencrypted communication. Which tuning option should be applied to IPS?

Allow list only authorized hosts to contact the application’s IP at a specific port.

Allow list HTTP traffic through the corporate VLANS.

Allow list traffic to application’s IP from the internal network at a specific port.

Allow list only authorized hosts to contact the application’s VLAN.

Q61. Refer to the exhibit.

Which indicator of compromise is represented by this STIX?

website redirecting traffic to ransomware server

website hosting malware to download files

web server vulnerability exploited by malware

cross-site scripting vulnerability to backdoor server

Q62. A security engineer discovers that a spreadsheet containing confidential information for nine of their employees was fraudulently posted on a competitor’s website. The spreadsheet contains names, salaries, and social security numbers. What is the next step the engineer should take in this investigation?

Determine if there is internal knowledge of this incident.

Check incoming and outgoing communications to identify spoofed emails.

Disconnect the network from Internet access to stop the phishing threats and regain control.

Engage the legal department to explore action against the competitor that posted the spreadsheet.

Q63. How does Wireshark decrypt TLS network traffic?

with a key log file using per-session secrets

using an RSA public key

by observing DH key exchange

by defining a user-specified decode-as

Q64. What is needed to assess risk mitigation effectiveness in an organization?

analysis of key performance indicators

compliance with security standards

cost-effectiveness of control measures

updated list of vulnerable systems

[Q49-Q64] Pass 350-201 Exam in First Attempt Guaranteed 100% Cover Real Exam Questions [Jul-2022]

Conclusion

Understanding helpful and specific pieces of 350-201 CISCO Performing CyberOps Using Cisco Security

Techniques – 30%