An organization experienced a service outage caused by a misconfigured firewall rule. The change was made by a junior administrator who followed a runbook. The runbook was later found to contain an incorrect command. What is the root cause of the outage?

The incorrect command in the runbook

The lack of monitoring on the firewall

The firewall vendor's software bug

The junior administrator's lack of experience

What is the primary purpose of documenting the chain of custody for digital evidence?

To encrypt the evidence for secure storage

To speed up the investigation process

To identify the attacker's identity

To ensure that evidence is admissible in legal proceedings

A forensic investigator is handling a case that may go to court. The investigator has collected evidence from a compromised system, but the evidence was initially handled by a non-forensic IT staff member. What is the most important action to ensure the evidence is admissible in court?

Re-collect the evidence using forensic tools

Ask the IT staff member to sign a statement of what they did

Delete the evidence and start the investigation over

Document the chain of custody and the actions taken by the IT staff member

When documenting investigation findings for a non-technical executive audience, which approach is most appropriate?

Include detailed technical logs and code snippets

Focus on the attacker's identity and motives

Provide a list of all affected IP addresses

Use high-level summaries and business impact language

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 2

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 2)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

30%of the exam

Questions 6–10

6application · medium
An organization experienced a service outage caused by a misconfigured firewall rule. The change was made by a junior administrator who followed a runbook. The runbook was later found to contain an incorrect command. What is the root cause of the outage?
Select an answer first
7foundation · easy
What is the primary purpose of documenting the chain of custody for digital evidence?
Select an answer first
8expert · hard
A forensic investigator is handling a case that may go to court. The investigator has collected evidence from a compromised system, but the evidence was initially handled by a non-forensic IT staff member. What is the most important action to ensure the evidence is admissible in court?
Select an answer first
9foundation · easy
Which data analysis technique is used to identify the source of a malicious file by comparing its unique characteristics against known malware samples?
Select an answer first
10foundation · easy
When documenting investigation findings for a non-technical executive audience, which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.