A security analyst is investigating a potential data loss incident where sensitive files were sent to an external email address. The analyst has collected the email logs and the endpoint logs. Which step should the analyst take next in the investigation workflow?

Notify the external recipient to ask them to delete the email.

Correlate the email logs with the endpoint logs to identify the user and the files that were attached.

Preserve the email logs by exporting them to a secure location.

Block the external email address in the email gateway to prevent further sends.

A database administrator suspects that a SQL injection vulnerability led to the unauthorized export of customer records. The database is in production and cannot be taken offline. Which evidence collection method is most appropriate?

Disable the database and copy the data files to an external drive.

Run a SELECT * FROM customers query to verify the data is still present.

Take a full forensic image of the database server's hard drive.

Collect database audit logs, application logs, and network captures of the SQL traffic.

During a data loss investigation, an analyst collects a hard drive image from a compromised server. What is the most important practice to maintain the chain of custody?

Documenting who handled the evidence and when

Making multiple copies of the evidence

Storing the evidence in a secure locker

When correlating logs from multiple sources, which technique is most effective for identifying a data exfiltration pattern?

Sorting logs alphabetically by source

Counting the total number of log entries

Matching timestamps and IP addresses across logs

Deleting duplicate logs to reduce noise

An analyst is investigating a data loss incident and has collected logs from the firewall, endpoint, and database. What is the primary purpose of correlating these logs?

To comply with data retention policies

To identify the full scope and impact of the incident

To reduce the storage space used by logs

To encrypt the logs for secure transmission

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 8

3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 6)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

30%of the exam

Questions 26–30

26application · medium
A security analyst is investigating a potential data loss incident where sensitive files were sent to an external email address. The analyst has collected the email logs and the endpoint logs. Which step should the analyst take next in the investigation workflow?
Select an answer first
27application · medium
A database administrator suspects that a SQL injection vulnerability led to the unauthorized export of customer records. The database is in production and cannot be taken offline. Which evidence collection method is most appropriate?
Select an answer first
28foundation · easy
During a data loss investigation, an analyst collects a hard drive image from a compromised server. What is the most important practice to maintain the chain of custody?
Select an answer first
29foundation · easy
When correlating logs from multiple sources, which technique is most effective for identifying a data exfiltration pattern?
Select an answer first
30foundation · easy
An analyst is investigating a data loss incident and has collected logs from the firewall, endpoint, and database. What is the primary purpose of correlating these logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.