A security analyst discovers that an employee's laptop was used to access a competitor's confidential data. The laptop is currently running and the user is still logged in. The analyst must preserve evidence for a potential legal case. What should the analyst do first?

Ask the user to log out so the system is idle for imaging.

Power off the laptop immediately to prevent further data changes.

Copy all files from the hard drive to an external USB drive.

Capture a live memory image using a forensically sound tool.

A security team is investigating a series of failed login attempts followed by a successful login from an unusual IP address. The team has access to authentication logs, firewall logs, and endpoint logs. Which data analysis technique would be most effective to correlate these events and identify the attack path?

Hash analysis of the log files to verify integrity

Time-based correlation of logs from multiple sources

String searching for the IP address in each log individually

Statistical analysis of login frequency per user

An analyst is investigating a possible data exfiltration incident. The analyst has collected network flow logs, proxy logs, and DNS logs. The analyst needs to determine whether sensitive data was actually transmitted. Which combination of data sources would provide the most conclusive evidence?

Network flow logs and proxy logs

An incident response team has completed an investigation and must present the findings to the board of directors. The board is concerned about the financial impact and legal implications. Which report format would best address the board's concerns?

Operational report focusing on the technical steps taken during the response

Legal brief outlining potential liabilities and defenses

Technical report with detailed log analysis and malware signatures

Executive summary with a focus on business impact and risk mitigation

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 2

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 5)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

30%of the exam

Questions 21–25

21application · medium
A security analyst discovers that an employee's laptop was used to access a competitor's confidential data. The laptop is currently running and the user is still logged in. The analyst must preserve evidence for a potential legal case. What should the analyst do first?
Select an answer first
22application · medium
A security team is investigating a series of failed login attempts followed by a successful login from an unusual IP address. The team has access to authentication logs, firewall logs, and endpoint logs. Which data analysis technique would be most effective to correlate these events and identify the attack path?
Select an answer first
23expert · hard
An analyst is investigating a possible data exfiltration incident. The analyst has collected network flow logs, proxy logs, and DNS logs. The analyst needs to determine whether sensitive data was actually transmitted. Which combination of data sources would provide the most conclusive evidence?
Select an answer first
24expert · hard
An incident response team has completed an investigation and must present the findings to the board of directors. The board is concerned about the financial impact and legal implications. Which report format would best address the board's concerns?
Select an answer first
25application · medium
An incident response team has completed the investigation of a data breach. The legal department requires a report that explains the technical findings to a non-technical audience, including the timeline, impact, and recommendations. Which type of report should the team produce?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 5)

Questions 21–25

A security analyst discovers that an employee's laptop was used to access a competitor's confidential data. The laptop is currently running and the user is still logged in. The analyst must preserve evidence for a potential legal case. What should the analyst do first?

An analyst is investigating a possible data exfiltration incident. The analyst has collected network flow logs, proxy logs, and DNS logs. The analyst needs to determine whether sensitive data was actually transmitted. Which combination of data sources would provide the most conclusive evidence?

An incident response team has completed an investigation and must present the findings to the board of directors. The board is concerned about the financial impact and legal implications. Which report format would best address the board's concerns?

An incident response team has completed the investigation of a data breach. The legal department requires a report that explains the technical findings to a non-technical audience, including the timeline, impact, and recommendations. Which type of report should the team produce?

Keep studying — Processes