A security analyst detects a workstation beaconing to a known command-and-control domain. The machine is a developer's primary system with active SSH sessions to a production jump host. The analyst must limit the attacker's ability to move laterally while preserving the forensic value of the local disk and memory. Which action should the analyst take first?

Disconnect the network cable and power off the workstation.

Kill the beaconing process from the task manager.

Isolate the workstation at the switch port while keeping it powered on.

Block the C2 domain at the firewall and continue monitoring.

A security analyst identifies a compromised user account that is being used to access sensitive files. The analyst needs to contain the incident while preserving evidence for investigation. Which action is the most appropriate short-term containment measure?

Disable the user account and revoke the user's active sessions.

Monitor the user's activity without taking any action.

Change the user's password and inform the user.

Delete the user's files to prevent further access.

A forensic investigator is collecting evidence from a compromised workstation. The investigator has already captured memory and made a forensic image of the hard drive. What additional step is required to maintain the chain of custody?

Store the evidence in a secure, locked room.

Make a second copy of the forensic image.

Document every person who handled the evidence and when.

Encrypt the forensic image with a strong password.

A forensic investigator is called to a scene where a compromised laptop is still running. The investigator must collect evidence that will be admissible in court. The laptop is connected to the corporate network, and the user is still logged in. Which action is the most appropriate first step?

Perform a live memory acquisition before disconnecting the laptop from the network.

Copy the hard drive using a write blocker while the system is running.

Disconnect the laptop from the network and then power it off immediately.

Ask the user to log off to preserve the user's files.

What is the main goal of the containment phase in incident response?

To limit the impact of the incident and prevent further damage

To identify the indicators of compromise associated with the incident

To remove the root cause of the incident from affected systems

To restore systems to their normal operational state

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 7

1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 10)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

20%of the exam

Questions 46–50

46application · medium
A security analyst detects a workstation beaconing to a known command-and-control domain. The machine is a developer's primary system with active SSH sessions to a production jump host. The analyst must limit the attacker's ability to move laterally while preserving the forensic value of the local disk and memory. Which action should the analyst take first?
Select an answer first
47application · medium
A security analyst identifies a compromised user account that is being used to access sensitive files. The analyst needs to contain the incident while preserving evidence for investigation. Which action is the most appropriate short-term containment measure?
Select an answer first
48application · medium
A forensic investigator is collecting evidence from a compromised workstation. The investigator has already captured memory and made a forensic image of the hard drive. What additional step is required to maintain the chain of custody?
Select an answer first
49expert · hard
A forensic investigator is called to a scene where a compromised laptop is still running. The investigator must collect evidence that will be admissible in court. The laptop is connected to the corporate network, and the user is still logged in. Which action is the most appropriate first step?
Select an answer first
50foundation · easy
What is the main goal of the containment phase in incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.