Cisco 350-201 Exam Questions
Performing CyberOps Using Core Security Technologies (CBRCOR) (Page 3 )

Updated On: 21-Feb-2026

The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

  1. Determine the assets to which the attacker has access
  2. Identify assets the attacker handled or acquired
  3. Change access controls to high risk assets in the enterprise
  4. Identify movement of the attacker in the enterprise

Answer(s): D



A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment. The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)

  1. incident response playbooks
  2. asset vulnerability assessment
  3. report of staff members with asset relations
  4. key assets and executives
  5. malware analysis report

Answer(s): B,E


Reference:

https://cloudogre.com/risk-assessment/



Refer to the exhibit. At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?

  1. exploitation
  2. actions on objectives
  3. delivery
  4. reconnaissance

Answer(s): C


Reference:

https://www2.deloitte.com/content/dam/Deloitte/sg/Documents/risk/sea-risk-cyber-101-july2017.pdf



Refer to the exhibit. How must these advisories be prioritized for handling?

  1. The highest priority for handling depends on the type of institution deploying the devices
  2. Vulnerability #2 is the highest priority for every type of institution
  3. Vulnerability #1 and vulnerability #2 have the same priority
  4. Vulnerability #1 is the highest priority for every type of institution

Answer(s): D



Refer to the exhibit. Which two steps mitigate attacks on the webserver from the Internet? (Choose two.)

  1. Create an ACL on the firewall to allow only TLS 1.3
  2. Implement a proxy server in the DMZ network
  3. Create an ACL on the firewall to allow only external connections
  4. Move the webserver to the internal network
  5. Move the webserver to the external network

Answer(s): B,D






Post your Comments and Discuss Cisco 350-201 exam dumps with other Community members:

Join the 350-201 Discussion