A company experienced a data breach. Logs show that an attacker used a valid user account to access sensitive files at 3:00 AM. The user claims they were asleep. The analyst must determine the root cause. Which approach is most appropriate?

Disable the user's account and restore the files from backup.

Check if the user's account credentials were phished or if the account was compromised through a password reset.

Assume the user is lying and escalate to HR for disciplinary action.

Review the user's browser history to see if they visited a malicious website.

A security team is investigating a case of insider threat where an employee is suspected of stealing sensitive data. The team has access to the employee's workstation and network logs. The employee is still working and has not been notified. Which approach is most appropriate to investigate the case without alerting the employee?

Wait until the employee leaves and then seize the workstation

Perform a covert forensic acquisition of the workstation and monitor network activity

Suspend the employee's access immediately and then investigate

Confront the employee and ask for an explanation

A security analyst is triaging a new case. Which sequence best represents the general investigative process for a cybersecurity case?

Identification, preservation, analysis, documentation, and reporting

Analysis, identification, reporting, preservation, and documentation

Preservation, reporting, identification, analysis, and documentation

Documentation, analysis, preservation, identification, and reporting

An analyst is collecting evidence from a compromised workstation. The analyst has a write blocker and a forensic imaging tool. What is the correct procedure to create a forensically sound image?

Connect the hard drive to the forensic workstation using a write blocker and create a bit-for-bit image.

Boot the workstation normally and copy the files to an external drive.

Remove the hard drive and connect it directly to the forensic workstation without a write blocker.

Use the Windows built-in backup tool to create a system image.

A forensic investigator is collecting evidence from a compromised server. The server is a domain controller and cannot be taken offline. The investigator needs to collect the memory and the hard drive image while minimizing disruption. Which approach best balances the need for evidence preservation and system availability?

Copy the memory dump to a network share and skip the hard drive image

Use a remote forensic tool to image the hard drive over the network

Perform a live memory acquisition and a logical image of the hard drive

Take the server offline and perform a physical image of the hard drive

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 2

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 8)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

30%of the exam

Questions 36–40

36application · medium
A company experienced a data breach. Logs show that an attacker used a valid user account to access sensitive files at 3:00 AM. The user claims they were asleep. The analyst must determine the root cause. Which approach is most appropriate?
Select an answer first
37expert · hard
A security team is investigating a case of insider threat where an employee is suspected of stealing sensitive data. The team has access to the employee's workstation and network logs. The employee is still working and has not been notified. Which approach is most appropriate to investigate the case without alerting the employee?
Select an answer first
38foundation · easy
A security analyst is triaging a new case. Which sequence best represents the general investigative process for a cybersecurity case?
Select an answer first
39application · medium
An analyst is collecting evidence from a compromised workstation. The analyst has a write blocker and a forensic imaging tool. What is the correct procedure to create a forensically sound image?
Select an answer first
40expert · hard
A forensic investigator is collecting evidence from a compromised server. The server is a domain controller and cannot be taken offline. The investigator needs to collect the memory and the hard drive image while minimizing disruption. Which approach best balances the need for evidence preservation and system availability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 8)

Questions 36–40

A company experienced a data breach. Logs show that an attacker used a valid user account to access sensitive files at 3:00 AM. The user claims they were asleep. The analyst must determine the root cause. Which approach is most appropriate?

A security analyst is triaging a new case. Which sequence best represents the general investigative process for a cybersecurity case?

An analyst is collecting evidence from a compromised workstation. The analyst has a write blocker and a forensic imaging tool. What is the correct procedure to create a forensically sound image?

Keep studying — Processes