Online Access Free 350-201 Practice Test

Refer to the exhibit.

A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?

• A.Add restrictions on the edge router on how often a single client can access the API
• B.Reduce the amount of data that can be fetched from the total pool of active clients that call the API
• C.Increase the application cache of the total pool of active clients that call the API
• D.Limit the number of API calls that a single client is allowed to make

Refer to the exhibit.

IDS is producing an increased amount of false positive events about brute force attempts on the organization's mail server. How should the Snort rule be modified to improve performance?

• A.Block list of internal IPs from the rule
• B.Set the rule to track the source IP
• C.Tune the count and seconds threshold of the rule
• D.Change the rule content match to case sensitive

A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days.
Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?

• A.Analyze the logs from all countries related to this user during the traveling period
• B.Create a rule triggered by 3 failed VPN connection attempts in an 8-hour period
• C.Create a rule triggered by 1 successful VPN connection from any nondestination country
• D.Create a rule triggered by multiple successful VPN connections from the destination countries

Employees receive an email from an executive within the organization that summarizes a recent security breach and requests that employees verify their credentials through a provided link. Several employees report the email as suspicious, and a security analyst is investigating the reports. Which two steps should the analyst take to begin this investigation? (Choose two.)

• A.Check the email header to identify the sender and analyze the link in an isolated environment.
• B.Communicate with employees to determine who opened the link and isolate the affected assets.
• C.Evaluate the intrusion detection system alerts to determine the threat source and attack surface.
• D.Review the mail server and proxy logs to identify the impact of a potential breach.
• E.Examine the firewall and HIPS configuration to identify the exploited vulnerabilities and apply recommended mitigation.

What is the purpose of hardening systems?

• A.to identify vulnerabilities within an operating system
• B.to create the logic that triggers alerts when anomalies occur
• C.to analyze attacks to identify threat actors and points of entry
• D.to securely configure machines to limit the attack surface