QUESTION: 53

Refer to the exhibit. An engineer received a report that an attacker has compromised a workstation and gained access to sensitive customer data from the network using insecure protocols. Which action prevents this type of attack in the future?

Use VLANs to segregate zones and the firewall to allow only required services and secured protocols
Deploy a SOAR solution and correlate log alerts from customer zones
Deploy IDS within sensitive areas and continuously update signatures
Use syslog to gather data from multiple sources and detect intrusion logs for timely responses

Answer(s): A

Reveal Solution Next Question

QUESTION: 54

How does Wireshark decrypt TLS network traffic?

with a key log file using per-session secrets
using an RSA public key
by observing DH key exchange
by defining a user-specified decode-as

Answer(s): A

Reference:

https://wiki.wireshark.org/TLS

Reveal Solution Next Question

QUESTION: 55

Refer to the exhibit. An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company’s user creation policy:
-minimum length: 3
-usernames can only use letters, numbers, dots, and underscores
-usernames cannot begin with a number

The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames. Which change is needed to apply the restrictions?

modify code to return error on restrictions def return false_user(username, minlen)
automate the restrictions def automate_user(username, minlen)
validate the restrictions, def validate_user(username, minlen)
modify code to force the restrictions, def force_user(username, minlen)

Answer(s): B

Reveal Solution Next Question

QUESTION: 56

An engineer implemented a SOAR workflow to detect and respond to incorrect login attempts and anomalous user behavior. Since the implementation, the security team has received dozens of false positive alerts and negative feedback from system administrators and privileged users. Several legitimate users were tagged as a threat and their accounts blocked, or credentials reset because of unexpected login times and incorrectly typed credentials. How should the workflow be improved to resolve these issues?

Meet with privileged users to increase awareness and modify the rules for threat tags and anomalous behavior alerts
Change the SOAR configuration flow to remove the automatic remediation that is increasing the false positives and triggering threats
Add a confirmation step through which SOAR informs the affected user and asks them to confirm whether they made the attempts
Increase incorrect login tries and tune anomalous user behavior not to affect privileged accounts

Answer(s): B

Reveal Solution Next Question

Free 350-201 Exam Braindumps (page: 15)

QUESTION: 53

QUESTION: 54

Reference:

QUESTION: 55

QUESTION: 56

350-201 Discussions & Posts