A playbook for a ransomware response requires the incident responder to block the command-and-control (C2) domain at the network perimeter and also identify which internal hosts attempted to connect to it. Which combination of tools should the responder use?

Threat intelligence platform and packet capture

NAC and web application firewall

During a phishing incident playbook, the analyst must inspect the attachment in a sandbox to determine if it contains malware. Which tool category should the analyst use?

Security information and event management (SIEM) system

Malware sandbox / dynamic analysis tool

Network access control (NAC) solution

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 2

1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 3)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

4concepts

20%of the exam

Questions 11–15

11foundation · easy
A playbook step requires collecting and analyzing threat intelligence feeds to enrich an ongoing investigation. Which tool category is most appropriate?
Select an answer first
12application · medium
An incident response playbook for a data exfiltration scenario requires the analyst to identify which internal hosts sent large amounts of data to an external IP address over the past 24 hours. The organization has a SIEM, an EDR, a network traffic analyzer, and a threat intelligence platform. Which tool category is most appropriate for this task?
Select an answer first
13foundation · easy
In a playbook step, the analyst needs to block a malicious IP address at the network perimeter. Which tool category should be used?
Select an answer first
14application · medium
A playbook for a ransomware response requires the incident responder to block the command-and-control (C2) domain at the network perimeter and also identify which internal hosts attempted to connect to it. Which combination of tools should the responder use?
Select an answer first
15application · medium
During a phishing incident playbook, the analyst must inspect the attachment in a sandbox to determine if it contains malware. Which tool category should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 3)

Questions 11–15

A playbook step requires collecting and analyzing threat intelligence feeds to enrich an ongoing investigation. Which tool category is most appropriate?

In a playbook step, the analyst needs to block a malicious IP address at the network perimeter. Which tool category should be used?

A playbook for a ransomware response requires the incident responder to block the command-and-control (C2) domain at the network perimeter and also identify which internal hosts attempted to connect to it. Which combination of tools should the responder use?

During a phishing incident playbook, the analyst must inspect the attachment in a sandbox to determine if it contains malware. Which tool category should the analyst use?

Keep studying — Fundamentals