350-201(NEW-127Q) Exam Questions

A SOC team receives multiple alerts from a rule that detects requests to malicious URLs. The rule also informs the incident response team to block the malicious URLs requested on t...

A security analyst receives an escalation regarding an unidentified connection to the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a...

Refer to the exhibit. Where are the browser page rendering permissions displayed?

An engineer is analyzing a possible compromise that happened a week ago when the company database servers unexpectedly went down. The analysis reveals that attackers tampered with...

An organization has four quiet rooms and two meeting rooms. A security engineer must enhance network protection by separating employee access to internal resources and visitor acce...

An organization suffered a security breach in which the attacker exploited a Netlogon Remote Protocol vulnerability for further privilege escalation. Which two actions should the i...

A company was breached by phishing emails by a third-party partner email domain. Multiple employees were infected by ransomware. The incident response team detected the breach afte...

A cloud engineer needs a solution to deploy applications on a cloud without being able to manage and control the server OS. Which type of cloud environment should be used?

An organization had a recent breach with a man-in-the-middle attack. Attackers were able to intercept traffic and steal customer's data. The organization has asked a security engin...

An engineer detects an intrusion event inside an organization's network and becomes aware that files that contain personal data have been accessed. Which action must be taken to co...

An employee who frequently travels abroad connects to a company network from a first-seen country during nonworking hours. The SIEM tool generated an alert that the employee forwar...

Refer to the exhibit. ``` rule id 100 event type tcp event action alert source address any destination address any source port any destination port 80 protocol tcp ``` The rule is...

An engineer is examining alerts by an IDS that uses SNORT technology and notices many false positives. This rule is firing inside a "local rules" file. (10.10.x.x any -> $HOME_NET...

What is a core limitation of Network Intrusion Detection Systems?

An engineer receives multiple events on the Cisco Secure Firewall Threat Defense Manager (Firepower Management Center) showing that an 'Unknown' file was detected and caused an inc...

An employee in the credit branch department of a large bank reported a slowdown of software used for issuing and assigning credit cards to customers. According to bank policy, any...