After a phishing incident, the incident response team conducts a post-incident review. The review reveals that the security awareness training was outdated and the email gateway rules were not updated after a previous similar incident. The team must decide which improvements to implement. Which action is most likely to prevent recurrence?

Replace the email gateway with a more expensive next-generation product.

Update the email gateway rules and revise the security awareness training to include the latest phishing techniques.

Document the incident in the lessons-learned report and close the review.

Increase the frequency of simulated phishing campaigns without changing the training content.

An organization is preparing its incident response capability. Management wants to ensure that the team can respond effectively to a security incident. Which preparatory activity is most critical?

Establishing an incident response team with defined roles and responsibilities.

Creating a public relations statement in advance.

Purchasing the most expensive security tools available.

Conducting regular backups of all systems.

During a ransomware incident, the incident response team needs to communicate with multiple stakeholders, including executives, legal counsel, and affected customers. The team must balance transparency with legal and operational constraints. Which communication approach is most effective?

Limit communication to executives only until the incident is resolved.

Send the same detailed update to all stakeholders to ensure transparency.

Delay all communication until the incident is fully resolved.

Provide tailored updates to each stakeholder group based on their need to know and legal requirements.

During an investigation, an analyst discovers a malicious executable on a compromised server. The incident response plan requires preserving evidence for potential litigation. The analyst needs to collect the executable for offline analysis. Which step is essential to maintain the chain of custody?

Copy the file to a USB drive and label it with the analyst's name.

Delete the file after copying it to prevent further infection.

Calculate a cryptographic hash of the file, record the hash and collection details in a log, and store the original in a secure evidence bag.

Run the executable in a sandbox to observe its behavior before collecting it.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 7

1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 4)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

20%of the exam

Questions 16–20

16expert · hard
After a phishing incident, the incident response team conducts a post-incident review. The review reveals that the security awareness training was outdated and the email gateway rules were not updated after a previous similar incident. The team must decide which improvements to implement. Which action is most likely to prevent recurrence?
Select an answer first
17application · medium
An organization is preparing its incident response capability. Management wants to ensure that the team can respond effectively to a security incident. Which preparatory activity is most critical?
Select an answer first
18expert · hard
During a ransomware incident, the incident response team needs to communicate with multiple stakeholders, including executives, legal counsel, and affected customers. The team must balance transparency with legal and operational constraints. Which communication approach is most effective?
Select an answer first
19foundation · easy
During which phase of the incident response workflow does the team focus on removing the root cause of the incident from affected systems?
Select an answer first
20application · medium
During an investigation, an analyst discovers a malicious executable on a compromised server. The incident response plan requires preserving evidence for potential litigation. The analyst needs to collect the executable for offline analysis. Which step is essential to maintain the chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.7 Apply the Incident Response Workflow 350-201 Practice Questions (Page 4)

Questions 16–20

An organization is preparing its incident response capability. Management wants to ensure that the team can respond effectively to a security incident. Which preparatory activity is most critical?

During a ransomware incident, the incident response team needs to communicate with multiple stakeholders, including executives, legal counsel, and affected customers. The team must balance transparency with legal and operational constraints. Which communication approach is most effective?

During which phase of the incident response workflow does the team focus on removing the root cause of the incident from affected systems?

During an investigation, an analyst discovers a malicious executable on a compromised server. The incident response plan requires preserving evidence for potential litigation. The analyst needs to collect the executable for offline analysis. Which step is essential to maintain the chain of custody?

Keep studying — Fundamentals