Which investigation step is unique to mobile devices compared to desktop systems?

Extracting data from the device's SIM card

Checking the system's BIOS settings

During an investigation of a macOS laptop, the analyst finds a suspicious launch agent in /Library/LaunchAgents. The analyst wants to determine if the launch agent is malicious and what it does. Which analysis technique would be most effective?

Delete the launch agent and observe if the system behaves normally.

Run the launch agent in a virtual machine to see what it does.

Check the user's email for any suspicious attachments.

Examine the plist file for the program path and arguments, then check the binary's code signature and hash against threat intelligence.

A security analyst is investigating a suspected intrusion on a company-issued Android smartphone. The device is enrolled in the corporate MDM and is currently powered on. The analyst needs to collect volatile data and preserve evidence while maintaining chain of custody. Which step should the analyst take first?

Power off the device to prevent remote access and then remove the SIM card.

Connect the device to a forensic workstation and perform a full logical extraction immediately.

Perform a factory reset to ensure any malware is removed before collecting logs.

Place the device in airplane mode and record the device's serial number, IMEI, and current time.

An organization needs to investigate a potential intrusion on a fleet of IoT cameras. The cameras have limited logging capabilities and no local storage. What is the most effective evidence source for the investigation?

Network traffic captures from the cameras' VLAN

User interviews with the camera operators

Physical memory dumps from each camera

Forensic images of the cameras' SD cards

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 5

3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 10)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

6concepts

30%of the exam

Questions 46–49

46foundation · easy
Which investigation step is unique to mobile devices compared to desktop systems?
Select an answer first
47application · medium
During an investigation of a macOS laptop, the analyst finds a suspicious launch agent in /Library/LaunchAgents. The analyst wants to determine if the launch agent is malicious and what it does. Which analysis technique would be most effective?
Select an answer first
48application · medium
A security analyst is investigating a suspected intrusion on a company-issued Android smartphone. The device is enrolled in the corporate MDM and is currently powered on. The analyst needs to collect volatile data and preserve evidence while maintaining chain of custody. Which step should the analyst take first?
Select an answer first
49application · medium
An organization needs to investigate a potential intrusion on a fleet of IoT cameras. The cameras have limited logging capabilities and no local storage. What is the most effective evidence source for the investigation?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 10)

Questions 46–49

Which investigation step is unique to mobile devices compared to desktop systems?

During an investigation of a macOS laptop, the analyst finds a suspicious launch agent in /Library/LaunchAgents. The analyst wants to determine if the launch agent is malicious and what it does. Which analysis technique would be most effective?

An organization needs to investigate a potential intrusion on a fleet of IoT cameras. The cameras have limited logging capabilities and no local storage. What is the most effective evidence source for the investigation?

Keep studying — Processes