350-201 Practice Test

350-201 Practice Test practice questions, page 9 of 9, with answer review and explanations.

Question 41

An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?

  1. Analyze environmental threats and causes
  2. Inform the product security incident response team to investigate further
  3. Analyze the precursors and indicators
  4. Inform the computer security incident response team to investigate further

Question 42

An employee abused PowerShell commands and script interpreters, which lead to an indicator of compromise (IOC) trigger. The IOC event shows that a known malicious file has been executed, and there is an increased likelihood of a breach. Which indicator generated this IOC event?

  1. ExecutedMalware.ioc
  2. Crossrider.ioc
  3. ConnectToSuspiciousDomain.ioc
  4. W32.AccesschkUtility.ioc

Question 43

Refer to the exhibit. Which command was executed in PowerShell to generate this log?

  1. Get-EventLog -LogName*
  2. Get-EventLog -List
  3. Get-WinEvent -ListLog* -ComputerName localhost
  4. Get-WinEvent -ListLog*

Question 44

Refer to the exhibit. Cisco Rapid Threat Containment using Cisco Secure Network Analytics (Stealthwatch) and ISE detects the threat of malware-infected 802.1x authenticated endpoints and places that endpoint into a Quarantine VLAN using Adaptive Network Control policy. Which telemetry feeds were correlated with SMC to identify the malware?

  1. NetFlow and event data
  2. event data and syslog data
  3. SNMP and syslog data
  4. NetFlow and SNMP

Question 45

A security architect is working in a processing center and must implement a DLP solution to detect and prevent any type of copy and paste attempts of sensitive data within unapproved applications and removable devices. Which technical architecture must be used?

  1. DLP for data in motion
  2. DLP for removable data
  3. DLP for data in use
  4. DLP for data at rest