A security analyst is reviewing an alert that combines a known malicious IP address (IOC) with a pattern of unusual outbound connections (IOA). The analyst must decide whether to block the IP and investigate the host. Which action is most appropriate?

Ignore the alert because the IP is known and the behavior is expected

Only investigate the host and do not block the IP

Block the IP and investigate the host for further compromise

Only block the IP and take no further action

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 6

3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 11)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

11concepts

30%of the exam

Questions 51–51

51expert · hard
A security analyst is reviewing an alert that combines a known malicious IP address (IOC) with a pattern of unusual outbound connections (IOA). The analyst must decide whether to block the IP and investigate the host. Which action is most appropriate?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.6 Determine Known Indicators of Compromise (IOCs) and Indicators of Attack (IOAs) 350-201 Practice Questions (Page 11)

Questions 51–51

A security analyst is reviewing an alert that combines a known malicious IP address (IOC) with a pattern of unusual outbound connections (IOA). The analyst must decide whether to block the IP and investigate the host. Which action is most appropriate?

Keep studying — Processes