Cisco CyberOps Professional 350-201 Questions & Answers

• Question 71:

  How is a SIEM tool used?

  A. To collect security data from authentication failures and cyber attacks and forward it for analysis

  B. To search and compare security data against acceptance standards and generate reports for analysis

  C. To compare security alerts against configured scenarios and trigger system responses

  D. To collect and analyze security data from network devices and servers and produce alerts

  Correct Answer: D

  Reference: https://www.varonis.com/blog/what-is-siem/

• Question 72:

  

  Refer to the exhibit. An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?

  A. a DOS MZ executable format

  B. a MS-DOS executable archive

  C. an archived malware

  D. a Windows executable file

  Correct Answer: D

  Reference: https://stackoverflow.com/questions/2577545/why-is-this-program-cannot-be-run-in-dos-mode-text-present-in-dll-files#:~:text=The%20linker%20places%20a%20default,using%20the%20%2FSTUB%20linker%20option.andtext=This %20information%20enables%20Windows%20to,has%20an%20MS-DOS%20stub.

• Question 73:

  What is a principle of Infrastructure as Code?

  A. System maintenance is delegated to software systems

  B. Comprehensive initial designs support robust systems

  C. Scripts and manual configurations work together to ensure repeatable routines

  D. System downtime is grouped and scheduled across the infrastructure

  Correct Answer: B

• Question 74:

  

  Refer to the exhibit. An engineer configured this SOAR solution workflow to identify account theft threats and privilege escalation, evaluate risk, and respond by resolving the threat. This solution is handling more threats than Security analysts have time to analyze. Without this analysis, the team cannot be proactive and anticipate attacks.

  Which action will accomplish this goal?

  A. Exclude the step "BAN malicious IP" to allow analysts to conduct and track the remediation

  B. Include a step "Take a Snapshot" to capture the endpoint state to contain the threat for analysis

  C. Exclude the step "Check for GeoIP location" to allow analysts to analyze the location and the associated risk based on asset criticality

  D. Include a step "Reporting" to alert the security department of threats identified by the SOAR reporting engine

  Correct Answer: A

• Question 75:

  

  Refer to the exhibit. Where does it signify that a page will be stopped from loading when a scripting attack is detected?

  A. x-frame-options

  B. x-content-type-options

  C. x-xss-protection

  D. x-test-debug

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs

• Question 76:

  What is the HTTP response code when the REST API information requested by the authenticated user cannot be found?

  A. 401

  B. 402

  C. 403

  D. 404

  E. 405

  Correct Answer: A

  Reference: https://airbrake.io/blog/http-errors/401-unauthorized-error#:~:text=The%20401%20Unauthorized%20Error%20is,client%20could%20not%20be%20authenticated.

• Question 77:

  An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials.

  How should the workflow be improved to resolve these issues?

  A. Meet with privileged users to increase awareness and modify the rules for threat tags and anomalous behavior alerts

  B. Change the SOAR configuration flow to remove the automatic remediation that is increasing the false positives and triggering threats

  C. Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts

  D. Increase incorrect login tries and tune anomalous user behavior not to affect privileged accounts

  Correct Answer: B

• Question 78:

  How does Wireshark decrypt TLS network traffic?

  A. with a key log file using per-session secrets

  B. using an RSA public key

  C. by observing DH key exchange

  D. by defining a user-specified decode-as

  Correct Answer: A

  Reference: https://wiki.wireshark.org/TLS

• Question 79:

  

  Refer to the exhibit. An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company's user creation policy: minimum length: 3 usernames can only use letters, numbers, dots, and underscores usernames cannot begin with a number

  The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames.

  Which change is needed to apply the restrictions?

  A. modify code to return error on restrictions def return false_user(username, minlen)

  B. automate the restrictions def automate_user(username, minlen)

  C. validate the restrictions, def validate_user(username, minlen)

  D. modify code to force the restrictions, def force_user(username, minlen)

  Correct Answer: B

• Question 80:

  

  Refer to the exhibit. IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?

  A. Block list of internal IPs from the rule

  B. Change the rule content match to case sensitive

  C. Set the rule to track the source IP

  D. Tune the count and seconds threshold of the rule

  Correct Answer: B