CiscoCertified Network Professional Cybersecurity (CBRCOR)
Domain 1Objective 2
1.2 Determine the Tools Needed Based on a Playbook Scenario 350-201 Practice Questions (Page 5)
Part of the Fundamentals domain, which accounts for 20% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)
28questions here
6free pages
4concepts
20%of the exam
Questions 21–25
- 21
A playbook task requires checking the reputation of a file hash. Which tool should be used?
Select an answer first - 22
An incident response playbook for a compromised server requires the analyst to collect the server's memory dump for forensic analysis. Which tool should the analyst use?
Select an answer first - 23
A playbook scenario requires investigating a suspicious file that was downloaded from the internet. The analyst needs to determine the file's behavior without executing it on a production system. Which tool capability is most appropriate?
Select an answer first - 24
A playbook for a ransomware incident requires the analyst to identify the ransomware variant, determine the encryption method, and then determine if decryption is possible. The organization has a SIEM, an EDR, a threat intelligence platform, and a malware analysis sandbox. The analyst has collected a sample of the ransomware. Which tool should the analyst use to determine the encryption method?
Select an answer first - 25
A playbook for a web application vulnerability scan requires the analyst to verify that a newly discovered vulnerability is not present in the production environment, and if it is, to create a virtual patch. The organization has a vulnerability scanner, a web application firewall (WAF), and a SIEM. Which tool should the analyst use to verify the vulnerability?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.