After a malware outbreak, the incident response team restored systems from backups and cleaned the infected hosts. However, the same malware reappeared two weeks later. Which step should the team take to determine the root cause of the recurrence?

Reimage all affected systems with the latest OS build

Disable all external network access until the issue is resolved

Increase the frequency of antivirus scans on all endpoints

Analyze the initial infection vector and identify the persistence mechanism

After a prolonged investigation, an analyst has gathered evidence that points to an insider threat. The evidence includes login times, file access logs, and email communications. The analyst must present the findings to HR and legal. What is the most important consideration when preparing the report?

Include all raw log data so the reader can verify every detail.

Recommend immediate termination of the employee based on the evidence.

Focus only on the technical aspects and avoid mentioning the employee's name.

Ensure the evidence chain of custody is documented and the report is written in clear, non-technical language.

During an investigation, an analyst has collected a large volume of network traffic logs. The analyst needs to identify patterns of communication with a known command-and-control (C2) server. Which analysis technique would be most efficient for this task?

Use a SIEM to correlate the logs with threat intelligence indicators

Delete logs that do not contain the C2 server's IP address

Run a packet capture on the network to collect new traffic

Manually review each log entry for the C2 server's IP address

A company experienced a data breach. The investigation shows that the attacker used a compromised service account to access a database. The service account had administrative privileges and was not monitored. The breach went undetected for three months. Which combination of factors is the most likely root cause?

The database software had a known vulnerability that was not patched.

Lack of monitoring and excessive privileges on the service account.

The service account password was stored in plaintext in a configuration file.

The company did not have a disaster recovery plan.

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 3Objective 2

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 9)

Part of the Processes domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 2–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

5concepts

30%of the exam

Questions 41–45

41application · medium
An incident responder is documenting a case for potential litigation. The documentation must show that the evidence was handled properly from collection to presentation. Which documentation element is essential to include?
Select an answer first
42application · medium
After a malware outbreak, the incident response team restored systems from backups and cleaned the infected hosts. However, the same malware reappeared two weeks later. Which step should the team take to determine the root cause of the recurrence?
Select an answer first
43expert · hard
After a prolonged investigation, an analyst has gathered evidence that points to an insider threat. The evidence includes login times, file access logs, and email communications. The analyst must present the findings to HR and legal. What is the most important consideration when preparing the report?
Select an answer first
44expert · hard
During an investigation, an analyst has collected a large volume of network traffic logs. The analyst needs to identify patterns of communication with a known command-and-control (C2) server. Which analysis technique would be most efficient for this task?
Select an answer first
45expert · hard
A company experienced a data breach. The investigation shows that the attacker used a compromised service account to access a database. The service account had administrative privileges and was not monitored. The breach went undetected for three months. Which combination of factors is the most likely root cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 9)

Questions 41–45

An incident responder is documenting a case for potential litigation. The documentation must show that the evidence was handled properly from collection to presentation. Which documentation element is essential to include?

After a malware outbreak, the incident response team restored systems from backups and cleaned the infected hosts. However, the same malware reappeared two weeks later. Which step should the team take to determine the root cause of the recurrence?

During an investigation, an analyst has collected a large volume of network traffic logs. The analyst needs to identify patterns of communication with a known command-and-control (C2) server. Which analysis technique would be most efficient for this task?

Keep studying — Processes