Free Cisco 350-201 Practice Exam with Questions & Answers | Set: 3

 One of the principles of Infrastructure as Code (IaC) is that system maintenance tasks, which were traditionally performed manually, are now automated and managed bysoftware systems567. This allows for consistent, repeatable routines for provisioning and changing systems and their configuration, with changes made to definitions and then rolled out to systems through unattended processes that include thorough validation7.

Automation refers to the configuration of a single process or a small number of related tasks to run without human intervention. Orchestration, on the other hand, involves managing multiple automated tasks to create a dynamic workflow. While automation focuses on making individual tasks more efficient, orchestration looks at the bigger picture to optimize a series of tasks that make up a process

To calculate the risk as part of a risk assessment, it is essential to consider the event severity and likelihood. This involves evaluating how severe the impact of a threat event could be and the probability of its occurrence1. These factors help in determining the level of risk associated with a particular asset or event. While the assessment scope, incident response playbook, and risk model framework are important elements of risk management, they do not directly contribute to the calculation of risk in the same way that understanding the severity and likelihood of an event does234.

Threat intelligence tools primarily search the Internet to identify potential malicious IP addresses, domain names, and URLs. They scour various online sources, including databases of known threats, security forums, and other cyber threat intelligence feeds to gather information. This data is then used to update their internal databases and protect against known and emerging threats.

The indicator of compromise (IoC) for the malware in question is that it has routines for encryption and decryption, which are used to conceal URLs/IP addresses. Additionally, it is capturing keystrokes and webcam events, and storing this data in encrypted files locally on the company server. This behavior is indicative of malware that is designed to stealthily collect and exfiltrate sensitive information without being easily detected. The use of encryption helps to hide the data and the destination to which it may be sent, making it more challenging for security systems to identify and block the malicious activity.

The behavior analytics tool was likely triggered by the action of downloading more than 10 files. Behavior analytics tools, such as User and Entity Behavior Analytics (UEBA), are designed to detect anomalous behavior that deviates from a user’s normal activity patterns. In this scenario, the downloading of a large number of files in a short period is an unusual activity that could indicate a data exfiltration attempt. This is especially true if the baseline or normal behavior for the administrator account does not include frequent bulk file downloads. The sudden spike in file download activity would be flagged by the behavior analytics tool as potentially malicious, leading to the disconnection of the session and the disabling of the administrator’s account to prevent further unauthorized access or data loss.

After a remote code execution attack, it is crucial to determine which systems were involved in the incident and to deploy any available patches to those systems. This step is part of the recovery stage, where the focus is on restoring the integrity of the systems and preventing the same vulnerability from being exploited again. Patching the systems helps to close the security gaps that the threat actor exploited and is a key measure in the process of recovering from such an attack

If management decides not to prioritize fixing the vulnerabilities and accepts them, the next step for the engineer is to acknowledge the vulnerabilities and document the risk. This involves recording the decision and the rationale behind it, assessing the potential impact, and ensuring that there is a clear understanding of the risks being accepted. This documentation is crucial for future reference and accountability, and it may also include recommendations for mitigating the risk where possible

Platform as a Service (PaaS) is the cloud environment type that allows cloud engineers to deploy applications without managing and controlling the server operating system. PaaS provides a platform with tools to test, develop, and host applications in the same environment