During an investigation of a phishing incident, the security team needs to collect the email headers and the attachment from the user's mailbox. What is the most forensically sound method to collect this evidence?

Take screenshots of the email and attachment details

Print the email and store the hard copy in evidence locker

Export the email as an .eml file and compute a SHA-256 hash

Copy the email content into a Word document

An analyst is investigating a case involving a laptop that was used to access illegal content. The laptop is encrypted with BitLocker. The analyst needs to collect evidence while preserving the chain of custody. What is the most appropriate approach?

Ask the user for their password and log in to the laptop.

Boot the laptop and copy the files to an external drive.

Obtain the BitLocker recovery key and create a forensic image of the drive while the system is powered off.

Remove the hard drive and attempt to image it without the recovery key.

A security analyst is investigating a suspected data exfiltration. The analyst has network flow logs and proxy logs. Which analysis technique would best identify the data that was exfiltrated?

Deep packet inspection of the network traffic

What is a key element of an effective incident investigation report?

The investigator's personal opinions

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 2

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 6)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

30%of the exam

Questions 26–30

26application · medium
During an investigation of a phishing incident, the security team needs to collect the email headers and the attachment from the user's mailbox. What is the most forensically sound method to collect this evidence?
Select an answer first
27expert · hard
An analyst is investigating a case involving a laptop that was used to access illegal content. The laptop is encrypted with BitLocker. The analyst needs to collect evidence while preserving the chain of custody. What is the most appropriate approach?
Select an answer first
28application · medium
A security analyst is investigating a suspected data exfiltration. The analyst has network flow logs and proxy logs. Which analysis technique would best identify the data that was exfiltrated?
Select an answer first
29foundation · easy
What is a key element of an effective incident investigation report?
Select an answer first
30foundation · easy
An investigator is analyzing a large volume of firewall logs to identify patterns of suspicious traffic. Which data analysis technique is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.