2026 Actual Cisco 350-201 Dumps, Updated Exam Questions for Guaranteed Pass

350-201 free sample questions and answers

Cisco 350-201 practice quiz with correct answers for search indexing.

1. Question 1

   The incident response team receives information about the abnormal behavior of a host. A malicious file is found being executed from an external USB flash drive. The team collects and documents all the necessary evidence from the computing resource. What is the next step?

   AConduct a risk assessment of systems and applications
   

   BIsolate the infected host from the rest of the subnet
   

   CInstall malware prevention software on the host
   

   DAnalyze network traffic on the host's subnet
   

   Correct answer: B

   
   

2. Question 2

   A logistic company must use an outdated application located in a private VLAN during the migration to new technologies. The IPS blocked and reported an unencrypted communication. Which tuning option should be applied to IPS?

   AAllow list only authorized hosts to contact the application's IP at a specific port.
   

   BAllow list HTTP traffic through the corporate VLANS.
   

   CAllow list traffic to application's IP from the internal network at a specific port.
   

   DAllow list only authorized hosts to contact the application's VLAN.
   

   Correct answer: D

   
   

3. Question 3

   A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?

   AIsolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack
   

   BIdentify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities
   

   CReview the server backup and identify server content and data criticality to assess the intrusion risk
   

   DPerform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious
   

   Correct answer: C

   
   

4. Question 4

   What is a benefit of key risk indicators?

   Aclear perspective into the risk position of an organization
   

   Bimproved visibility on quantifiable information
   

   Cimproved mitigation techniques for unknown threats
   

   Dclear procedures and processes for organizational risk
   

   Correct answer: C

   
   

5. Question 5

   A SOC team receives multiple alerts by a rule that detects requests to malicious URLs and informs the incident response team to block the malicious URLs requested on the firewall. Which action will improve the effectiveness of the process?

   ABlock local to remote HTTP/HTTPS requests on the firewall for users who triggered the rule.
   

   BInform the user by enabling an automated email response when the rule is triggered.
   

   CInform the incident response team by enabling an automated email response when the rule is triggered.
   

   DCreate an automation script for blocking URLs on the firewall when the rule is triggered.
   

   Correct answer: A