Get ready to pass the 350-201 Exam right now using our CyberOps Professional Exam Package
A fully updated 2021 350-201 Exam Dumps exam guide from training expert ITCertMagic
NEW QUESTION 76
An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?
- A. statistical
- B. diagnostic
- C. qualitative
- D. predictive
Answer: D
NEW QUESTION 77
Refer to the exhibit.
An engineer received multiple reports from employees unable to log into systems with the error: The Group Policy Client service failed to logon - Access is denied. Through further analysis, the engineer discovered several unexpected modifications to system settings. Which type of breach is occurring?
- A. malware break
- B. elevation of privileges
- C. denial-of-service
- D. data theft
Answer: B
NEW QUESTION 78
Refer to the exhibit.
Which indicator of compromise is represented by this STIX?
- A. web server vulnerability exploited by malware
- B. website redirecting traffic to ransomware server
- C. cross-site scripting vulnerability to backdoor server
- D. website hosting malware to download files
Answer: A
NEW QUESTION 79
Refer to the exhibit.
IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?
- A. Tune the count and seconds threshold of the rule
- B. Set the rule to track the source IP
- C. Block list of internal IPs from the rule
- D. Change the rule content match to case sensitive
Answer: D
NEW QUESTION 80
Refer to the exhibit.
Cisco Rapid Threat Containment using Cisco Secure Network Analytics (Stealthwatch) and ISE detects the threat of malware-infected 802.1x authenticated endpoints and places that endpoint into a Quarantine VLAN using Adaptive Network Control policy. Which telemetry feeds were correlated with SMC to identify the malware?
- A. SNMP and syslog data
- B. NetFlow and event data
- C. event data and syslog data
- D. NetFlow and SNMP
Answer: C
NEW QUESTION 81
A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days.
Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?
- A. Create a rule triggered by 1 successful VPN connection from any nondestination country
- B. Analyze the logs from all countries related to this user during the traveling period
- C. Create a rule triggered by multiple successful VPN connections from the destination countries
- D. Create a rule triggered by 3 failed VPN connection attempts in an 8-hour period
Answer: B
NEW QUESTION 82
Drag and drop the function on the left onto the mechanism on the right.
Answer:
Explanation:
NEW QUESTION 83
Drag and drop the threat from the left onto the scenario that introduces the threat on the right. Not all options are used.
Answer:
Explanation:
NEW QUESTION 84
An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?
- A. Analyze environmental threats and causes
- B. Inform the product security incident response team to investigate further
- C. Inform the computer security incident response team to investigate further
- D. Analyze the precursors and indicators
Answer: D
NEW QUESTION 85
The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?
- A. Install IPS software
- B. Perform vulnerability assessment
- C. Contain the malware
- D. Determine the escalation path
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION 86
How is a SIEM tool used?
- A. To collect security data from authentication failures and cyber attacks and forward it for analysis
- B. To collect and analyze security data from network devices and servers and produce alerts
- C. To search and compare security data against acceptance standards and generate reports for analysis
- D. To compare security alerts against configured scenarios and trigger system responses
Answer: B
NEW QUESTION 87
Refer to the exhibit. What is occurring in this packet capture?
- A. DNS tunneling
- B. TCP flood
- C. TCP port scan
- D. DNS flood
Answer: B
NEW QUESTION 88
A security architect in an automotive factory is working on the Cyber Security Management System and is implementing procedures and creating policies to prevent attacks. Which standard must the architect apply?
- A. IEC62439-3
- B. IEC62446
- C. IEC62443
- D. IEC62439-2
Answer: C
NEW QUESTION 89
Refer to the exhibit.
Which data format is being used?
- A. HTML
- B. XML
- C. JSON
- D. CSV
Answer: A
NEW QUESTION 90
What is a benefit of key risk indicators?
- A. improved mitigation techniques for unknown threats
- B. improved visibility on quantifiable information
- C. clear perspective into the risk position of an organization
- D. clear procedures and processes for organizational risk
Answer: A
NEW QUESTION 91
......
Master 2021 Latest The Questions CyberOps Professional and Pass 350-201 Real Exam!: https://www.itcertmagic.com/Cisco/real-350-201-exam-prep-dumps.html
Practice To 350-201 - ITCertMagic Remarkable Practice On your Performing CyberOps Using Cisco Security Technologies Exam: https://drive.google.com/open?id=1sckEInuFCD08kDwaniZg2iyyBoADBls9