CiscoCertified Network Professional Cybersecurity (CBRCOR)
Domain 1Objective 2
1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 1)
Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)
28questions here
6free pages
4concepts
20%of the exam
Questions 1–5
- 1
A playbook scenario describes a security analyst receiving an alert about a suspicious executable running on a user's workstation. The playbook instructs the analyst to isolate the workstation, collect a memory dump, and analyze the executable's behavior in a sandbox. Which tool should the analyst use to isolate the workstation?
Select an answer first - 2
A playbook scenario requires correlating logs from multiple sources to detect a multi-stage attack pattern. Which tool capability is most important for this scenario?
Select an answer first - 3
A playbook for a malicious insider threat requires the analyst to review the user's activity logs across the network and identify any unusual data transfers. Which tool should the analyst use to collect and review these logs?
Select an answer first - 4
A playbook scenario describes a security operations center (SOC) analyst investigating a potential data exfiltration. The playbook instructs the analyst to review all outbound network connections from a specific server over the past 24 hours. Which tool should the analyst use to obtain this information?
Select an answer first - 5
A playbook for a network intrusion requires the analyst to identify which network connections were established to a suspicious external IP. Which tool category should the analyst use to review the network flow data?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.