Question 1

An organization had an incident with the network availability during which devices unexpectedly malfunctioned. An engineer is investigating the incident and found that the memory pool buffer usage reached a peak before the malfunction. Which action should the engineer take to prevent this issue from reoccurring?

ADisable memory limit.

BDisable CPU threshold trap toward the SNMP server.

CEnable memory tracing notifications.

DEnable memory threshold notifications.

Answer : D

Question 2

A SOC analyst detected a ransomware outbreak in the organization coming from a malicious email attachment. Affected parties are notified, and the incident response team is assigned to the case. According to the NIST incident response handbook, what is the next step in handling the incident?

ACreate a follow-up report based on the incident documentation.

BPerform a vulnerability assessment to find existing vulnerabilities.

CEradicate malicious software from the infected machines.

DCollect evidence and maintain a chain-of-custody during further analysis.

Answer : D

Question 3

A security manager received an email from an anomaly detection service, that one of their contractors has downloaded 50 documents from the company's confidential document management folder using a company- owned asset al039-ice-4ce687TL0500. A security manager reviewed the content of downloaded documents and noticed that the data affected is from different departments. What are the actions a security manager should take?

AMeasure confidentiality level of downloaded documents.

BReport to the incident response team.

CEscalate to contractor's manager.

DCommunicate with the contractor to identify the motives.

Answer : B

Question 4

An engineer detects an intrusion event inside an organization's network and becomes aware that files that contain personal data have been accessed. Which action must be taken to contain this attack?

ADisconnect the affected server from the network.

BAnalyze the source.

CAccess the affected server to confirm compromised files are encrypted.

DDetermine the attack surface.

Answer : C

Question 5

Engineers are working to document, list, and discover all used applications within an organization. During the regular assessment of applications from the HR backup server, an engineer discovered an unknown application. The analysis showed that the application is communicating with external addresses on a non- secure, unencrypted channel. Information gathering revealed that the unknown application does not have an owner and is not being used by a business unit. What are the next two steps the engineers should take in this investigation? (Choose two.)

ADetermine the type of data stored on the affected asset, document the access logs, and engage the incident response team.

BIdentify who installed the application by reviewing the logs and gather a user access log from the HR department.

CVerify user credentials on the affected asset, modify passwords, and confirm available patches and updates are installed.

DInitiate a triage meeting with department leads to determine if the application is owned internally or used by any business unit and document the asset owner.

Answer : A, D

Free Practice Questions for Cisco 350-201 Exam

Question 1

Question 2

Question 3

Question 4

Question 5