A playbook for a DDoS attack requires the analyst to identify the attack source IPs from the firewall logs and then block them at the edge router. Which tool should the analyst use to query the firewall logs?

Endpoint detection and response (EDR) platform

An organization's playbook for a web application attack requires the analyst to review raw HTTP traffic to identify the attack payload. Which tool should the analyst use to capture and inspect the network traffic?

Packet capture tool such as Wireshark

Web application firewall (WAF) log viewer

Endpoint detection and response (EDR) console

An incident response team is responding to a ransomware outbreak. The playbook requires the team to (1) isolate infected endpoints, (2) identify the ransomware variant, and (3) block the ransomware's command-and-control (C2) domain at the DNS layer. The team has access to an EDR, a malware sandbox, a DNS sinkhole, and a SIEM. Which combination of tools should the team use to complete all three playbook steps?

SIEM for isolation, malware sandbox for variant identification, EDR for C2 blocking

EDR for isolation, malware sandbox for variant identification, DNS sinkhole for C2 blocking

DNS sinkhole for isolation, EDR for variant identification, SIEM for C2 blocking

EDR for isolation, SIEM for variant identification, DNS sinkhole for C2 blocking

A playbook for a data exfiltration incident requires the analyst to correlate authentication logs from multiple servers and identify the source IP addresses that accessed sensitive files. Which tool category is best suited for this correlation task?

Network access control (NAC) solution

Security information and event management (SIEM) system

Endpoint detection and response (EDR) platform

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 1Objective 2

1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 4)

Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

4concepts

20%of the exam

Questions 16–20

16application · medium
A playbook for a DDoS attack requires the analyst to identify the attack source IPs from the firewall logs and then block them at the edge router. Which tool should the analyst use to query the firewall logs?
Select an answer first
17application · medium
An organization's playbook for a web application attack requires the analyst to review raw HTTP traffic to identify the attack payload. Which tool should the analyst use to capture and inspect the network traffic?
Select an answer first
18foundation · easy
A playbook task requires reviewing authentication logs to identify failed login attempts. Which tool should be used?
Select an answer first
19expert · hard
An incident response team is responding to a ransomware outbreak. The playbook requires the team to (1) isolate infected endpoints, (2) identify the ransomware variant, and (3) block the ransomware's command-and-control (C2) domain at the DNS layer. The team has access to an EDR, a malware sandbox, a DNS sinkhole, and a SIEM. Which combination of tools should the team use to complete all three playbook steps?
Select an answer first
20application · medium
A playbook for a data exfiltration incident requires the analyst to correlate authentication logs from multiple servers and identify the source IP addresses that accessed sensitive files. Which tool category is best suited for this correlation task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 4)

Questions 16–20

A playbook for a DDoS attack requires the analyst to identify the attack source IPs from the firewall logs and then block them at the edge router. Which tool should the analyst use to query the firewall logs?

An organization's playbook for a web application attack requires the analyst to review raw HTTP traffic to identify the attack payload. Which tool should the analyst use to capture and inspect the network traffic?

A playbook task requires reviewing authentication logs to identify failed login attempts. Which tool should be used?

A playbook for a data exfiltration incident requires the analyst to correlate authentication logs from multiple servers and identify the source IP addresses that accessed sensitive files. Which tool category is best suited for this correlation task?

Keep studying — Fundamentals