Online Access Free 350-201 Practice Test

A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?

• A.Identify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities
• B.Perform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious
• C.Isolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack
• D.Review the server backup and identify server content and data criticality to assess the intrusion risk

Refer to the exhibit.

Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis. What should be concluded from this report?

• A.The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are low and indicate the likelihood that malicious ransomware has been detected.
• B.The prioritized behavioral indicators of compromise do not justify the execution of the "ransomware" because the scores are high and do not indicate the likelihood of malicious ransomware.
• C.The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are high and indicate the likelihood that malicious ransomware has been detected.
• D.The prioritized behavioral indicators of compromise do not justify the execution of the "ransomware" because the scores do not indicate the likelihood of malicious ransomware.

An engineer returned to work and realized that payments that were received over the weekend were sent to the wrong recipient. The engineer discovered that the SaaS tool that processes these payments was down over the weekend. Which step should the engineer take first?

• A.Utilize the SaaS tool team to gather more information on the potential breach
• B.Organize a meeting to discuss the services that may be affected
• C.Request that the purchasing department creates and sends the payments manually
• D.Contact the incident response team to inform them of a potential breach

An engineer receives a report that indicates a possible incident of a malicious insider sending company information to outside parties. What is the first action the engineer must take to determine whether an incident has occurred?

• A.Analyze environmental threats and causes
• B.Inform the computer security incident response team to investigate further
• C.Inform the product security incident response team to investigate further
• D.Analyze the precursors and indicators

Refer to the exhibit.

An engineer notices a significant anomaly in the traffic in one of the host groups in Cisco Secure Network Analytics (Stealthwatch) and must analyze the top data transmissions. Which tool accomplishes this task?

• A.Top Conversations
• B.Top Ports
• C.Top Hosts
• D.Top Peers