350-201 Practice Test

350-201 Practice Test practice questions, page 7 of 9, with answer review and explanations.

Question 31

Drag and drop the threat from the left onto the scenario that introduces the threat on the right. Not all options are used. Select and Place:

Question 32

Refer to the exhibit. Which data format is being used?

  1. JSON
  2. HTML
  3. XML
  4. CSV

Question 33

The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?

  1. Contain the malware
  2. Install IPS software
  3. Determine the escalation path
  4. Perform vulnerability assessment

Question 34

Refer to the exhibit. An engineer must tune the Cisco IOS device to mitigate an attack that is broadcasting a large number of ICMP packets. The attack is sending the victim's spoofed source IP to a network using an IP broadcast address that causes devices in the network to respond back to the source IP address. Which action does the engineer recommend?

  1. Use command ip verify reverse-path interface
  2. Use global configuration command service tcp-keepalives-out
  3. Use subinterface command no ip directed-broadcast
  4. Use logging trap 6

Question 35

Refer to the exhibit. An engineer is analyzing this Vlan0392-int12-239.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?

  1. The extension is not performing as intended because of restrictions since ports 80 and 443 should be accessible
  2. The traffic is legitimate as the google chrome extension is reaching out to check for updates and fetches this information
  3. There is a possible data leak because payloads should be encoded as UTF-8 text
  4. There is a malware that is communicating via encrypted channels to the command and control server