Which of the following is a common type of cybersecurity case that an incident responder might investigate?

Network performance degradation

A security team is investigating a case of unauthorized access to a database. The team has identified the source IP address and the time of access. Which next step is most appropriate to continue the investigation?

Correlate the source IP with other logs to identify the user and method of access

Delete the database logs to prevent further exposure

Immediately block the source IP address

Notify the database administrator to change all passwords

An analyst has completed an investigation into a phishing campaign that compromised several user accounts. The analyst must document the findings. What should be included in the report?

A timeline of events, affected accounts, and recommended security improvements.

Only the technical indicators of compromise (IoCs) for the IT team.

The names of the users who clicked the phishing link.

A summary of the phishing email's content and the sender's address.

A company suspects that an employee is selling customer data. The security team needs to investigate without alerting the employee. Which type of case is this, and what is the first step in the investigation?

External attack case; immediately block the employee's network access.

Policy violation case; confront the employee with the evidence.

Data breach case; notify law enforcement immediately.

Insider threat case; begin by collecting and preserving evidence from logs and systems.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 2

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 1)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

30%of the exam

Questions 1–5

1foundation · easy
Which of the following is a common type of cybersecurity case that an incident responder might investigate?
Select an answer first
2foundation · easy
Which technique is commonly used in root cause analysis to visually map out the potential causes of an incident?
Select an answer first
3application · medium
A security team is investigating a case of unauthorized access to a database. The team has identified the source IP address and the time of access. Which next step is most appropriate to continue the investigation?
Select an answer first
4application · medium
An analyst has completed an investigation into a phishing campaign that compromised several user accounts. The analyst must document the findings. What should be included in the report?
Select an answer first
5application · medium
A company suspects that an employee is selling customer data. The security team needs to investigate without alerting the employee. Which type of case is this, and what is the first step in the investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.