350-201 Exam Questions and Answers | Exam-Dumps (Page: 5)

QUESTION: 21

An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?

diagnostic
qualitative
predictive
statistical

Answer(s): C

Reference:

https://insights.principa.co.za/4-types-of-data-analytics-descriptive-diagnostic-predictive-prescriptive

Reveal Solution Next Question

QUESTION: 22

A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

Assess the network for unexpected behavior
Isolate critical hosts from the network
Patch detected vulnerabilities from critical hosts
Perform analysis based on the established risk factors

Answer(s): B

Reveal Solution Next Question

QUESTION: 23

Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop automatically submitted a low prevalence file to the Threat Grid analysis engine. What should be concluded from this report?

Threat scores are high, malicious ransomware has been detected, and files have been modified
Threat scores are low, malicious ransomware has been detected, and files have been modified
Threat scores are high, malicious activity is detected, but files have not been modified
Threat scores are low and no malicious file activity is detected

Answer(s): B

Reveal Solution Next Question

QUESTION: 24

An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.
Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.
Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.
Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.

Answer(s): C

Reveal Solution Next Question

QUESTION: 25 DRAG DROP

Drag and drop the NIST incident response process steps from the left onto the actions that occur in the steps on the right.

Select and Place:

Exhibit A:

Exhibit B: