350-201 Practice Test

350-201 Practice Test practice questions, page 6 of 9, with answer review and explanations.

Question 26

Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?

  1. chmod 666
  2. chmod 774
  3. chmod 775
  4. chmod 777

Question 27

A SIEM tool fires an alert about a VPN connection attempt from an unusual location. The incident response team validates that an attacker has installed a remote access tool on a user's laptop while traveling. The attacker has the user's credentials and is attempting to connect to the network. What is the next step in handling the incident?

  1. Block the source IP from the firewall
  2. Perform an antivirus scan on the laptop
  3. Identify systems or services at risk
  4. Identify lateral movement

Question 28

A threat actor used a phishing email to deliver a file with an embedded macro. The file was opened, and a remote code execution attack occurred in a company's infrastructure. Which steps should an engineer take at the recovery stage?

  1. Determine the systems involved and deploy available patches
  2. Analyze event logs and restrict network access
  3. Review access lists and require users to increase password complexity
  4. Identify the attack vector and update the IDS signature list

Question 29

A patient views information that is not theirs when they sign in to the hospital's online portal. The patient calls the support center at the hospital but continues to be put on hold because other patients are experiencing the same issue. An incident has been declared, and an engineer is now on the incident bridge as the CyberOps Tier 3 Analyst. There is a concern about the disclosure of PII occurring in real-time. What is the first step the analyst should take to address this incident?

  1. Evaluate visibility tools to determine if external access resulted in tampering
  2. Contact the third-party handling provider to respond to the incident as critical
  3. Turn off all access to the patient portal to secure patient records
  4. Review system and application logs to identify errors in the portal code

Question 30

Refer to the exhibit. What results from this script?

  1. Seeds for existing domains are checked
  2. A search is conducted for additional seeds
  3. Domains are compared to seed rules
  4. A list of domains as seeds is blocked