Cisco (350-201-CBRCOR) Exam Questions And Answers page 9

A SOC analyst detected a ransomware outbreak in the organization coming from a malicious email attachment. Affected parties are notified, and the incident response team is assigned to the case. According to the NIST incident response handbook, what is the next step in handling the incident?

Refer to the exhibit. A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?

Refer to the exhibit. Which command was executed in PowerShell to generate this log?

An organization had an incident with the network availability during which devices unexpectedly malfunctioned. An engineer is investigating the incident and found that the memory pool buffer usage reached a peak before the malfunction. Which action should the engineer take to prevent this issue from reoccurring?

A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?

A security engineer discovers that a spreadsheet containing confidential information for nine of their employees was fraudulently posted on a competitor s website. The spreadsheet contains names, salaries, and social security numbers. What is the next step the engineer should take in this investigation?

Refer to the exhibit. What is occurring in this packet capture?

Refer to the exhibit. An engineer is reverse engineering a suspicious file by examining its resources. What does this file indicate?

Which bash command will print all lines from the colors.txt file containing the non case-sensitive pattern Yellow ?

An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?