350-201 Performing CyberOps Using Core Security Technologies (CBRCOR) Question and Answers

Refer to the exhibit.

Which asset has the highest risk value?

Refer to the exhibit.

Which command was executed in PowerShell to generate this log?

Which action should be taken when the HTTP response code 301 is received from a web application?

An engineer is going through vulnerability triage with company management because of a recent malware outbreak from which 21 affected assets need to be patched or remediated. Management decides not to prioritize fixing the assets and accepts the vulnerabilities. What is the next step the engineer should take?

Drag and drop the NIST incident response process steps from the left onto the actions that occur in the steps on the right.

After a recent malware incident, the forensic investigator is gathering details to identify the breach and causes. The investigator has isolated the affected workstation. What is the next step that should be taken in this investigation?

An engineer is investigating several cases of increased incoming spam emails and suspicious emails from the HR and service departments. While checking the event sources, the website monitoring tool showed several web scraping alerts overnight. Which type of compromise is indicated?

How is a SIEM tool used?

Refer to the exhibit.

Based on the detected vulnerabilities, what is the next recommended mitigation step?

An engineer is analyzing a possible compromise that happened a week ago when the company ? (Choose two.)

An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

An analyst wants to upload an infected file containing sensitive information to a hybrid-analysis sandbox. According to the NIST.SP 800-150 guide to cyber threat information sharing, what is the analyst required to do before uploading the file to safeguard privacy?

Refer to the exhibit.

What is the connection status of the ICMP event?

Refer to the exhibit.

An engineer must tune the Cisco IOS device to mitigate an attack that is broadcasting a large number of ICMP packets. The attack is sending the victim’s spoofed source IP to a network using an IP broadcast address that causes devices in the network to respond back to the source IP address. Which action does the engineer recommend?

Refer to the exhibit.

An organization is using an internal application for printing documents that requires a separate registration on the website. The application allows format-free user creation, and users must match these required conditions to comply with the company’s user creation policy:

• minimum length: 3
• usernames can only use letters, numbers, dots, and underscores
• usernames cannot begin with a number

The application administrator has to manually change and track these daily to ensure compliance. An engineer is tasked to implement a script to automate the process according to the company user creation policy. The engineer implemented this piece of code within the application, but users are still able to create format-free usernames. Which change is needed to apply the restrictions?

An engineer received an alert of a zero-day vulnerability affecting desktop phones through which an attacker sends a crafted packet to a device, resets the credentials, makes the device unavailable, and allows a default

administrator account login. Which step should an engineer take after receiving this alert?

Refer to the exhibit.

Which indicator of compromise is represented by this STIX?