Exam 350-201 topic 1 question 119 discussion

Actual exam question from Cisco's 350-201

Question #: 119
Topic #: 1

A SOC engineer discovers that the organization had three DDOS attacks overnight. Four servers are reported offline, even though the hardware seems to be working as expected. One of the offline servers is affecting the pay system reporting times. Three employees, including executive management, have reported ransomware on their laptops. Which steps help the engineer understand a comprehensive overview of the incident?

A. Run and evaluate a full packet capture on the workloads, review SIEM logs, and define a root cause.
B. Run and evaluate a full packet capture on the workloads, review SIEM logs, and plan mitigation steps.
C. Check SOAR to learn what the security systems are reporting about the overnight events, research the attacks, and plan mitigation step.
D. Check SOAR to know what the security systems are reporting about the overnight events, review the threat vectors, and define a root cause.

Show Suggested Answer

Suggested Answer: D 🗳️

by germx at Dec. 18, 2021, 9:29 a.m.

Comments

Submit Cancel

marceus

2 months, 3 weeks ago

Selected Answer: D

ChatGPT: This multi-faceted attack suggests a coordinated cyber campaign against the organization. The best approach is to use SOAR to gather security event data, analyze threat vectors, and define the root cause. By doing so, the engineer can understand the full scope of the attack, contain ongoing threats, and develop a mitigation plan to restore operations and prevent recurrence.

upvoted 1 times

...

TrainingTeam

6 months, 2 weeks ago

Selected Answer: A

To gain a comprehensive overview of the incident involving DDOS attacks and ransomware, the SOC engineer should run and evaluate a full packet capture on the workloads, review Security Information and Event Management (SIEM) logs, and define a root cause. This will help in understanding the nature of the attacks, the extent of the damage, and the vulnerabilities that were exploited

upvoted 1 times

...