A security analyst is documenting an attack where the adversary used a known exploit to gain initial access, then used PowerShell to execute commands, and finally established persistence via a scheduled task. Which of the following best represents the 'techniques' in this attack?

The attacker's motivation and skill level

Initial access, execution, persistence

Exploit public-facing application, PowerShell, scheduled task

The specific commands run in PowerShell

An analyst is reviewing a network flow log. The log shows a series of connections from an internal host to an external IP address on port 443, with a consistent pattern of small outbound packets followed by larger inbound packets. The internal host also made a DNS query for a domain that is not on any allowlist. Which TTP is most likely indicated by this traffic pattern?

Command and Control – Application Layer Protocol

Exfiltration – Data Compressed

Lateral Movement – Remote Services

Initial Access – Exploit Public-Facing Application

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 25

2.25 Determine the Tactics, Techniques, and Procedures (TTPs) from an Attack 350-201 Practice Questions (Page 4)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

30%of the exam

Questions 16–20

16foundation · easy
A security analyst is documenting an attack where the adversary used a known exploit to gain initial access, then used PowerShell to execute commands, and finally established persistence via a scheduled task. Which of the following best represents the 'techniques' in this attack?
Select an answer first
17foundation · easy
Which framework is specifically designed to categorize adversary behaviors into tactics and techniques, and is widely used for mapping TTPs?
Select an answer first
18application · medium
An analyst is reviewing a network flow log. The log shows a series of connections from an internal host to an external IP address on port 443, with a consistent pattern of small outbound packets followed by larger inbound packets. The internal host also made a DNS query for a domain that is not on any allowlist. Which TTP is most likely indicated by this traffic pattern?
Select an answer first
19application · medium
A security team is documenting an attack where the attacker used a valid user's credentials to log into a VPN, then used a PowerShell script to enumerate Active Directory, and finally used SMB to copy files from a file server. Which MITRE ATT&CK technique is most appropriate for the use of valid credentials?
Select an answer first
20foundation · easy
An analyst is examining a compromised host and finds a scheduled task that runs a script every 5 minutes. Which tactic is this evidence most directly associated with?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.25 Determine the Tactics, Techniques, and Procedures (TTPs) from an Attack 350-201 Practice Questions (Page 4)

Questions 16–20

A security analyst is documenting an attack where the adversary used a known exploit to gain initial access, then used PowerShell to execute commands, and finally established persistence via a scheduled task. Which of the following best represents the 'techniques' in this attack?

Which framework is specifically designed to categorize adversary behaviors into tactics and techniques, and is widely used for mapping TTPs?

An analyst is examining a compromised host and finds a scheduled task that runs a script every 5 minutes. Which tactic is this evidence most directly associated with?

Keep studying — Techniques