A company's incident response metrics for the last quarter are: MTTD = 10 hours, MTTR (response) = 2 hours, MTTC = 4 hours, and MTTR (resolution) = 30 hours. The team has limited budget and must choose one area to improve. Which area should they prioritize, and what improvement would have the most impact?

Resolution; improve recovery procedures and post-incident analysis to reduce MTTR (resolution).

Containment; deploy automated isolation playbooks to reduce MTTC.

Detection; invest in advanced monitoring and correlation rules to reduce MTTD.

Response; automate alert routing to reduce MTTR (response).

If the repeat incident rate for a specific attack type is high, what area of improvement is most likely needed?

Eradication and recovery processes

A security operations center (SOC) has a high false positive rate, causing analysts to ignore alerts. As a result, a real incident went undetected for 12 hours. The SOC manager wants to improve the effectiveness of the detection process. Which combination of metrics should the SOC track to address this issue?

Containment success rate and repeat incident rate

Time to triage and time to investigate

After containing a worm outbreak by isolating affected segments, the team spends 4 hours removing the worm from all systems and verifying that no traces remain. Which metric does this 4-hour effort represent, and what improvement would most directly reduce it?

TTE; use automated eradication tools and endpoint detection and response (EDR) to clean systems faster.

TTR; restore systems from backups to normal operations.

MTTC; improve the isolation procedures to contain the worm faster.

MTTD; improve detection capabilities to find the worm sooner.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 8

1.8 Describe Characteristics and Areas of Improvement Using Common Incident Response Metrics 350-201 Practice Questions (Page 2)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

15concepts

20%of the exam

Questions 6–10

6foundation · easy
Which metric specifically measures the average time to restore systems and services after an incident?
Select an answer first
7expert · hard
A company's incident response metrics for the last quarter are: MTTD = 10 hours, MTTR (response) = 2 hours, MTTC = 4 hours, and MTTR (resolution) = 30 hours. The team has limited budget and must choose one area to improve. Which area should they prioritize, and what improvement would have the most impact?
Select an answer first
8foundation · easy
If the repeat incident rate for a specific attack type is high, what area of improvement is most likely needed?
Select an answer first
9expert · hard
A security operations center (SOC) has a high false positive rate, causing analysts to ignore alerts. As a result, a real incident went undetected for 12 hours. The SOC manager wants to improve the effectiveness of the detection process. Which combination of metrics should the SOC track to address this issue?
Select an answer first
10application · medium
After containing a worm outbreak by isolating affected segments, the team spends 4 hours removing the worm from all systems and verifying that no traces remain. Which metric does this 4-hour effort represent, and what improvement would most directly reduce it?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.8 Describe Characteristics and Areas of Improvement Using Common Incident Response Metrics 350-201 Practice Questions (Page 2)

Questions 6–10

Which metric specifically measures the average time to restore systems and services after an incident?

If the repeat incident rate for a specific attack type is high, what area of improvement is most likely needed?

After containing a worm outbreak by isolating affected segments, the team spends 4 hours removing the worm from all systems and verifying that no traces remain. Which metric does this 4-hour effort represent, and what improvement would most directly reduce it?

Keep studying — Fundamentals