350-201(NEW-127Q) Exam Questions

Which action should be taken when the HTTP response code 301 is received from a web application?

Amid a critical cybersecurity incident, a multinational corporation has a suspected breach involving an advanced and evasive strain of malware. The cybersecurity team is under imme...

A multinational corporation, with a complex network infrastructure comprising a central data center, several remote offices, and cloud-based services, faces challenges in managing...

The incident response team of an organization detects a compromised endpoint being used by a malicious actor who is encrypting and exfiltrating data. The incident response team sto...

A security analyst detected that a group of internal hosts are initiating periodic port scanning activities to different network segments and that connections are then being initia...

An organization's Linux server hosts a sensitive configuration file, and the system administrator wants to adjust the file permissions to meet security requirements. The organizati...

A company has budget constraints that prevent it from buying dedicated DDoS prevention solutions, and a security engineer must strengthen the organization's security. The specific...

During a routine security audit, a cybersecurity team at a multinational corporation discovers a complex security breach involving exfiltration of sensitive data. The threat has af...

An organization's security team identified a potential security incident that involves an unusual file found on a critical server. The file appears to have been injected by an unkn...

A software development team is integrating an external payment processing API that has strict limits on request rates and a defined payload size. The API is crucial for handling re...

Refer to the exhibit. The rule is configured to alert any TCP traffic to or from port 80. However, it is causing false positives because it is also triggering legitimate traffic, s...

Refer to the exhibit. An engineer is investigating several messages about undelivered emails and is reviewing cross-correlated data from different sources. It appears that the date...

How are cyber threat intelligence platforms used?

A company is considering moving from an IaaS cloud deployment to a PaaS deployment model. Which challenge would this introduce to the incident response process?

What describes the primary purpose of the SOAR tool in the field of cybersecurity?

A security engineer discovered an unusual network activity that repeats weekly, only on weekends. Further analysis shows that the activity spreads to countries where the organizati...

Which action must be taken during the process of hardening machine images?

In a corporate environment, a security analyst must refine an intrusion detection system rule that erroneously flags secure file transfer protocol (SFTP) traffic as suspicious duri...

A data center that manages sensitive government data must enhance its system hardening procedures to counter advanced cyber threats and adhere to federal security regulations. The...

The organization that provides payment processing services is working on contracts with multiple banks. The organization has four branches with public and internal networks and two...

In a large financial institution, a cybersecurity analyst is responsible for monitoring network traffic patterns for any signs of cyberattacks. During routine analysis, the analyst...

In a corporate environment, a cybersecurity analyst is responsible for investigating a potential intrusion on laptop endpoints. Abnormally detection systems have raised concerns ab...

A security analyst is reviewing a playbook scenario that describes the steps to be taken in response to a phishing attack targeting the organization. The scenario includes the iden...

A security analyst received an alert from a SIEM platform that one of their organization's servers with the serial number 34E93G0947LBJK60, has been compromised by a malicious acto...

Refer to the exhibit. A SOC engineer attempts to automate a recurring log analysis task. Which modification in the Python code must be made to the provided script to automatically...

A security analyst monitors an organization's network using UEBA tools to detect potential threats. During the analysis, the analyst notices unusual activities, such as a user from...

Which DevOps practice is used when automating an operations environment to automatically adjust in scale with the demands of users?

Which tool prevents data loss and defends against phishing attacks?

Refer to the exhibit. An engineer is investigating a case with several employees who cannot access their files on network shares, followed by almost simultaneous delivery of a susp...

An organization must automate the provisioning of infrastructure required for software releases. Developers must apply infrastructure code from within existing development tools. W...

A cybersecurity team is building a cloud-based storage system in a multinational corporation. Which approaches should be undertaken in line with the concept of "data at rest" to pr...

A system administrator must organize files, navigate directories, and set environment variables to optimize the development environment on a Linux server. The administrator must pe...

The compliance team is working to implement standards according to European organizational needs. An organization has a segmented network, a customer data zone, a critical zone whe...

A security team received an alert from a vulnerability scanner about a zero-day vulnerability affecting a company-owned, SSL-based remote access VPN concentrator. Using this vulner...

The incident response team of an organization identifies an ongoing cyber attack that involves a highly sophisticated threat actor, multiple compromised endpoints, and a custom-bui...

Refer to the exhibit. Which two Indicators of Attack are present on this alert? (Choose two.)

An analyst is investigating a potentially malicious program. Static analysis showed suspicious header details, hashes, and strings embedded within the executable file. The analyst...

An engineer is conducting a forensic investigation on a host system in the company network. The system was compromised by an advanced persistent threat group. The engineer identifi...

A security analyst receives an alert concerning an iOS device belonging to the CFO. The device pings a high-risk country daily because this executive visited that country. Which st...

Refer to the exhibit. Which lines must be added to the script to list the ports that are open?

Refer to the exhibit. An engineer must analyze the packet capture from Wireshark. What is occurring?

A network security administrator must strengthen the security posture of a university's research network, which handles sensitive academic data across various operating systems and...

Security Engineer noticed that a new strain of malware packs the file to increase its size to avoid being sandboxed. A forensic script is required to be uploaded to an endpoint rem...

A company's legal office was notified by a law enforcement agency that anomalous traffic was detected during a separate investigation that was not directly related to the company....

An organization plans to implement an incident response strategy that includes orchestration and automation. The security team must understand the key differences between these con...

An incident responder must mitigate a DDoS attack on a company web server. Which step from the playbook must the responder apply first to counteract this threat effectively?

An engineer notices that every Sunday night, there is a two-hour period with a large load of network activity. Upon further investigation, the engineer finds that the activity is f...

Refer to the exhibit. Where is the MIME type that should be followed indicated?

What is a benefit of key risk indicators?

A SIEM tool triggers an alert event due to multiple failed login attempts. The same user tried to access multiple servers within 10 minutes. Further analysis showed a specific work...