Question 1

A company's web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?

Options :

A : assessment scope

B : event severity and likelihood

C : incident response playbook

D : risk model framework

Answer: D

Question 2

A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?

Options :

A : Create a rule triggered by 3 failed VPN connection attempts in an 8-hour period

B : Create a rule triggered by 1 successful VPN connection from any nondestination country

C : Create a rule triggered by multiple successful VPN connections from the destination countries

D : Analyze the logs from all countries related to this user during the traveling period

Answer: D

Question 3

Refer to the exhibit.

Which asset has the highest risk value?

Options :

A : servers

B : website

C : payment process

D : secretary workstation

Answer: C

Question 4

Refer to the exhibit.

At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?

Options :

A : exploitation

B : actions on objectives

C : delivery

D : reconnaissance

Answer: C

Question 5

An analyst received multiple alerts on the SIEM console of users that are navigating to malicious URLs. The analyst needs to automate the task of receiving alerts and processing the data for further investigations. Three variables are available from the SIEM console to include in an automation script: console_ip, api_token, and reference_set_name. What must be added to this script to receive a successful HTTP response?

#!/usr/bin/python import sys import requests

Options :

A : {1}, {2}

B : {1}, {3}

C : console_ip, api_token

D : console_ip, reference_set_name

Answer: C

Confidently Practice Online with Free 350-201 Exam Cram

Buying Options: