350-201 CBRCOR: Performing Cybersecurity Using Cisco Security TechnologiesDemo

Refer to the exhibit. An engineer is investigating a case involving suspicious usernames in Active Directory. After investigating and cross-correlating events from other sources, the engineer determines that the two users are privileged and that their creation date matches suspicious network traffic initiated from the internal network 2 days earlier. Which type of compromise is taking place?

Refer to the exhibit. Which header indicates that a page will be prevented from loading when a scripting attack is detected?

Under the GDPR, what action should be taken with data to ensure its confidentiality, integrity, and availability?

A company has launched an e-commerce website with multiple points of sale through internal and external e-stores. Customers access the stores through the public website, while employees access them from the intranet using SSO. Which action is required to comply with PCI standards for system hardening?

An employee misused PowerShell commands and script interpreters, resulting in an indicator of compromise (IOC) trigger. The IOC event indicates that a known malicious file was executed and that the likelihood of a breach is increased. Which indicator produced this IOC event?

Refer to the exhibit.

for log in logs:  
    if 'error' in log:  
        print(log)  

A SOC engineer is attempting to automate a recurring log-analysis task. What modification must be made to the provided Python script to automatically save the output to a file rather than display it?

Refer to the exhibit. Based on the identified vulnerabilities, what is the next recommended mitigation step?

An organization needs to automate provisioning of the infrastructure needed for software releases. Developers must apply infrastructure code from within their existing development tools. Which DevOps practice must be used?

Refer to the exhibit. A threat actor using a single computer exploited a cloud-based application by sending multiple concurrent API requests. The requests caused the application to become unresponsive. Which solution safeguards the application from overload and provides more equitable application access throughout the end-user community?

A company experienced a breach through phishing emails originating from a third-party partner email domain. Multiple employees became infected with ransomware. The incident-response team identified the breach only after data on the critical server was encrypted and web applications crashed. Security engineers requested recovery actions for the affected servers. According to incident-response processes, which two steps did the security staff miss?

The compliance team is working to implement standards that align with organizational needs. A U.S. company works closely with government organizations by supporting a federal program and providing recruitment and HR services. The organization uses cloud services and retains its sensitive data in cloud storage. Which two industry standards should the compliance team recommend implementing?

A company recently finished an internal audit and found a CSRF vulnerability in 20 of its hosted applications. Based on the audit, which patching recommendation should an engineer make?

Refer to the exhibit. Which asset has the greatest risk value?

An organization’s SOC team is notified of a host that is sharing a large volume of data outside normal business hours. After analyzing the results of the requested scan, the team discovers that files containing the Personally Identifiable Information of all employees have been compromised. Which two actions should the SOC team take next?

A security analyst is investigating an attack against an organization's database server and must establish the event sequence by analyzing traffic patterns. The following observations were made:

1. Multiple rapid connections to the database server from an external IP address were detected.
2. The database server began communicating with a known command-and-control server.
3. Numerous database records were accessed and modified in a short time.
4. A sudden rise in inbound traffic to the database server from various IP addresses was observed.

Based on this information, what is the correct sequence of events during the attack?

An organization is performing vulnerability triage and risk analysis. The security team wants to prioritize vulnerabilities effectively by using industry scoring systems. Which method should the team use to ensure a comprehensive assessment?

A security analyst is examining suspicious network-traffic patterns in a segmented environment. During a 2-hour period, the analyst identifies this event sequence: an external IP address scans multiple ports on a web server, followed by a surge of HTTP requests with unusually large payloads. Shortly afterward, the database server exhibits anomalous outbound traffic over an unencrypted channel to that same external IP. In addition, DNS queries resolving to previously unknown domains increase sharply. How should the analyst interpret this sequence of events?

DRAG DROP -

Drag and drop the type of attacks from the left onto the cyber kill chain stages at which the attacks are seen on the right.

Select and Place:

A security analyst is investigating a whaling attack by correlating events from a SIEM, a detailed proxy-session log, and EDR logs. During the investigation, the analyst determines that several executive endpoints are connecting to C&C servers. The analyst reports the details to the incident response team and requests endpoint quarantine and suspicious email-domain blacklisting actions. According to NIST SP 800-61, at which incident-response step is the analyst?

Drag the mitigation steps on the left to the vulnerabilities they mitigate on the right.

An organization recently experienced a man-in-the-middle attack. Attackers intercepted traffic and stole customer data. The organization has asked a security engineer to improve its systems’ ability to prevent similar attacks in the future. What recommendation should the security engineer provide to strengthen security and protect against future man-in-the-middle attacks?

A security operations center is developing an incident-response playbook to mitigate a DDoS attack aimed at the organization’s online banking platform. The attacks frequently include volumetric traffic surges from multiple geographic regions, causing service degradation.

Which combination of actions should the playbook include to effectively mitigate the attack while preserving legitimate user access?

An engineer is transferring data from NAS servers across different departments into a consolidated storage database so the organization can access and analyze the data on demand. Which data management process is in use?

Refer to the exhibit. What threat is shown in this Wireshark traffic capture?