Free 350-201 Practice Test

According to the General Data Protection Regulation (GDPR), a Data Protection Impact Assessment (DPIA) is a formal process designed to identify and minimize the data protection risks of a project or plan. Article 35 of the GDPR mandates a DPIA for processing that is "likely to result in a high risk to the rights and freedoms of natural persons." This assessment systematically evaluates the potential impact on data subjects and ensures that appropriate measures are in place to protect personal data, thereby addressing its confidentiality, integrity, and availability (CIA).

A. A vulnerability assessment is a technical activity that can be part of implementing security measures, but the DPIA is the overarching GDPR process for risk assessment.
C. Penetration testing is a specific method for testing security controls; it is not the comprehensive assessment process required by GDPR to ensure CIA.
D. Awareness testing focuses on the human element of security and is only one component of the broader technical and organizational measures evaluated in a DPIA.

1. European Parliament and Council of the European Union, "Regulation (EU) 2016/679 (General Data Protection Regulation)," Article 35, "Data protection impact assessment." This article explicitly defines the requirement and purpose of a DPIA.

2. European Parliament and Council of the European Union, "Regulation (EU) 2016/679 (General Data Protection Regulation)," Article 32, "Security of processing." This article requires implementing measures to ensure security, which a DPIA helps to define and verify.

3. Information Commissioner's Office (UK), "Data protection impact assessments (DPIAs)." This official guidance explains that a DPIA is a key part of accountability obligations under the GDPR, helping to assess and demonstrate how an organization will comply with data protection principles.

The incident was caused by a spike in API calls and a high number of inactive sessions, leading to resource exhaustion and a crash. To prevent this, two key controls are necessary. First, implementing API rate limiting (B) directly addresses the "spike of API call requests" by setting thresholds on how many requests a client can make in a given time frame. Second, configuring shorter timeout periods (A) for sessions addresses the "high number of inactive sessions" by closing them more quickly, which frees up server resources like memory and connection slots, preventing exhaustion.

C. API key maintenance is a good security practice for authentication and authorization but does not directly prevent a volume-based resource exhaustion attack.
D. Automating error reporting is a reactive measure that informs about a problem after it has occurred; it does not prevent the incident itself.
E. Decreasing simultaneous API responses would likely worsen the user experience by creating a larger request queue, potentially exacerbating the unresponsiveness.

1. OWASP Foundation, "OWASP API Security Top 10 2019," API4: Lack of Resources & Rate Limiting. "APIs do not always impose restrictions on the size or number of resources that can be requested by the client/user... This can lead to Denial of Service (DoS)... To prevent this: Implement rate limiting... define proper timeouts on the server side." (This directly supports options B and A).

2. Cisco, "Cisco Application Policy Infrastructure Controller (APIC) Security Configuration Guide," Section on Contracts and Filters. While not a direct quote, the principles of applying filters and policies to control traffic flow and prevent resource exhaustion are fundamental to Cisco's application-centric security models, aligning with the concept of rate limiting.

3. Cisco, "Denial of Service Attack," Official Documentation. "DoS attacks typically function by overwhelming a target machine with requests until normal traffic is unable to be processed, resulting in denial-of-service to users... Mitigation techniques include rate limiting." (This supports rate limiting as a primary DoS defense).

The issue is device malfunction due to memory exhaustion. To prevent this, a proactive monitoring and alerting mechanism is required. Enabling memory threshold notifications configures the device to send an alert (like an SNMP trap or syslog message) when memory usage crosses a predefined critical level. This allows network engineers to intervene and troubleshoot the high memory usage before it leads to a system crash or malfunction, directly addressing the prevention of future incidents.

A. Disable memory limit: This would likely accelerate memory exhaustion and cause the device to malfunction faster, not prevent it.
B. Disable CPU threshold trap toward the SNMP server: This action is irrelevant as it relates to CPU monitoring, not the identified memory issue.
C. Enable memory tracing notifications: Memory tracing is a deep diagnostic tool for finding the root cause of a leak, not a proactive alerting mechanism to prevent a crash.

1. Cisco IOS XE System Management Configuration Guide, Release 3S. "Memory Threshold Notifications" section. This feature allows setting thresholds for processor memory and generating notifications when usage exceeds these levels.

2. Cisco IOS Configuration Fundamentals Command Reference. The memory free low-watermark command is detailed, which sets a low-watermark for available free memory to trigger notifications, serving as a preventative alert mechanism.

Default accounts pose the most immediate threat in newly deployed systems. When an application server is first installed, it often comes with default administrative accounts that are well-known to attackers. Since this server automatically fetches AD credentials and has access to multiple environments, compromising a default account would give attackers immediate access to sensitive credentials and broad network access. This threat exists from the moment of installation and should be addressed before considering other security measures.

A. Aligning access control policies - Important but secondary to eliminating default accounts which provide immediate attack vectors.
B. Exfiltration during data transfer - Relevant for operational security but not the first priority during initial deployment.
D. Data exposure from backups - Backups wouldn't exist yet for a newly installed server.

1. NIST SP 800-123 "Guide to General Server Security" Section 4.1.2 - Default account management

2. CIS Controls v8, Control 5.2 "Use Unique Passwords for All Enterprise Assets"

3. RFC 2196 "Site Security Handbook" Section 4.3 - System configuration guidelines

4. ISO/IEC 27002:2022 Section 8.5 - Secure authentication

5. SANS Institute "Securing New System Deployments" - Initial hardening procedures

The Wireshark capture clearly shows a stream of packets where the protocol is TCP and the "Info" column indicates that the SYN flag is set ([SYN]). All the packets originate from a single source IP address (10.0.0.5) and are directed to a single destination IP address (10.0.0.150). The timestamps are very close, indicating a high transmission rate. This behavior—a high-rate flood of TCP SYN packets from a single source to a single destination—is the classic signature of a TCP SYN flood, a common Denial of Service (DoS) attack.

A. This describes a Distributed Denial of Service (DDoS) attack. The capture shows only a single source IP, not multiple sources.
B. The packets shown are TCP SYN packets, not ACK packets. Also, the traffic is directed to a single destination, not multiple destinations.
C. This describes a SYN scan or a flood targeting multiple hosts. The capture shows all traffic is directed to a single destination IP.

1. Cisco. (2018). Understanding and Mitigating DDoS Attacks. White Paper. "TCP-based Attacks" section. This document describes a TCP SYN flood as an attack where an attacker sends a succession of SYN requests to a target's system in an attempt to consume server resources.

2. Cisco. (2020). Cisco IOS Flexible Packet Matching Configuration Guide. "Mitigating a SYN Flood Attack" section. This guide provides an example of a SYN flood attack and describes its characteristics, matching the pattern seen in the exhibit.

3. Cisco Press. (2015). CCNA Cyber Ops SECFND 210-250 Official Cert Guide. Chapter 11, "Attacking the Network". This chapter details various network attacks, including SYN floods, and explains how to identify them by observing a high volume of SYN packets from a source without corresponding ACKs.

Cyber security insurance policies, while broad, have specific limitations and exclusions. A common limitation relates to third-party damages. While policies often cover liability for damages to an insured's direct customers (e.g., from a data breach), they may exclude or limit coverage for damages caused to other third parties, such as business partners in the supply chain, as a cascading result of an attack. This area is complex and often subject to sub-limits or specific exclusions, making it a significant limitation compared to more standard coverages like forensics or PR costs.

A. Costs to restore stolen identities and provide credit monitoring for affected customers are a common and standard feature of first-party cyber insurance coverage.
B. Hiring forensic experts to investigate a breach is a fundamental component of cyber insurance, typically covered under incident response expenses.
D. Public relations and crisis management costs are frequently included in policies to help manage reputational damage following a public incident.

1. Cisco, "Cybersecurity and privacy insurance: What you need to know," Cisco Trust Center White Paper, 2021. This paper discusses the scope of cyber insurance, noting that "Third-party liability coverage... protects you from claims by customers, partners, or vendors." However, it also highlights the importance of understanding exclusions, which often involve complex third-party scenarios.

2. National Association of Insurance Commissioners (NAIC), "Cybersecurity," Section on "What Does Cyber Insurance Cover?". The NAIC notes that third-party coverage is for "damages or settlements" but also states policies have "specific perils that are covered and have exclusions," with complex supply-chain (third-party) incidents being a common area of dispute or limitation.

3. Woods, T. (2020). "The Challenges of Underwriting Cyber Risk." Geneva Association Report. This report discusses systemic risk and supply chain incidents as major challenges for insurers, often leading to coverage limitations or exclusions for damages involving multiple third parties. (A representative academic/industry source on insurance limitations).

According to the NIST incident response lifecycle (SP 800-61), after an incident is detected and analyzed (validated), the next critical step is to understand its scope. The attacker has valid user credentials, meaning the threat is not limited to the initial laptop or source IP. The immediate priority is to determine the "blast radius" by identifying which other systems, services, and data the compromised credentials have access to. This scoping activity is essential for planning an effective containment strategy and preventing further compromise or lateral movement.

A: Blocking a single source IP is an insufficient containment measure because the attacker has valid credentials and can connect from anywhere. B: An antivirus scan is part of a deeper analysis or eradication, but the immediate priority is understanding the scope of potential access. D: Identifying lateral movement is part of scoping, but you must first identify what systems are at risk (C) before you can effectively look for movement to them.

1. Cisco, "Incident Response: A Proactive Approach to Handling Security Breaches," White Paper (2016). This paper emphasizes the importance of scoping an incident, stating, "The team must determine the extent of the incident... Which systems were affected? What information was compromised?" (p. 4).

2. National Institute of Standards and Technology (NIST), "Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide" (August 2012). Section 3.2.3, "Containment," notes that a major prerequisite is "obtaining management approval," which requires a clear understanding of the incident's scope and potential impact on business operations.

3. Stanford University, "Information Security Incident Response Procedure". The procedure outlines that after initial analysis, the next step is to "Assess the scope and potential impact of the incident," which aligns with identifying systems at risk.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Since the small business has started accepting credit card payments and acquired a Point of Sale (POS) terminal, it now handles cardholder data. Therefore, it is mandatory for the business to comply with PCI DSS to protect this sensitive payment information and avoid penalties.

A. HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that regulates protected health information (PHI). It is not applicable to an automotive business.
B. FISMA (Federal Information Security Management Act) is a U.S. federal law that requires federal agencies to implement information security programs. It does not apply to private businesses.
C. COBIT (Control Objectives for Information and Related Technologies) is an IT management and governance framework. It is a set of best practices and is adopted voluntarily, not a mandatory compliance regulation.

1. PCI Security Standards Council. (n.d.). PCI Security Standards Overview. Retrieved from https://www.pcisecuritystandards.org/pcisecurity/. (The official source states that PCI DSS applies to "any organization that accepts, transmits or stores cardholder data").

2. Cisco. (2016). Cisco PCI Solution 3.2 Design and Implementation Guide. Document ID: 118894. Chapter: "Introduction to PCI DSS," states, "The PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers...".

3. National Institute of Standards and Technology (NIST). (2010). An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (Special Publication 800-66 Revision 1). Section 2.1, "Applicability of the Security Rule," clarifies its scope is limited to covered entities dealing with electronic PHI.

Automation refers to the execution of a single, specific task without human intervention (e.g., blocking an IP address). Orchestration, in a security context, is the coordination and management of multiple automated tasks and tools into a cohesive, end-to-end workflow or process. For example, an orchestration playbook might take a SIEM alert, trigger an automation script to enrich the data, another to quarantine an endpoint, and a third to create a help desk ticket. Orchestration connects and directs the individual automated components.

B. This is an oversimplification. Both can involve tasks and processes; the key difference is the scope (single task vs. multi-task workflow).
C. Both can help minimize redundancies, but this is a potential outcome, not the fundamental difference between their definitions.
D. Orchestration coordinates multiple automated tasks into a process. Automation makes a single task repeatable. This option incorrectly reverses the concepts.

1. Cisco. (n.d.). What Is SOAR (Security Orchestration, Automation, and Response)?. Cisco Official Documentation. The document explains, "Automation is about making a machine do a single, repetitive task... Orchestration is about making all your security tools—automated and not—work together."

2. Gartner. (2020). Market Guide for Security Orchestration, Automation and Response Solutions. This guide defines SOAR, distinguishing between the task-focused nature of automation and the process-coordination role of orchestration. (Gartner reports are widely used in academic and professional settings).

3. Ja prathap, B. R., & Bhasin, H. (2021). A Comprehensive Survey on Security Orchestration Automation and Response (SOAR). International Journal of Communication Networks and Information Security, 13(1), 106-121. Section II.A defines automation and orchestration, highlighting that orchestration combines automated tasks into a workflow.

In any malware analysis process, efficiency is critical. Before dedicating significant time to manual, in-depth analysis like debugging or disassembly, the first operational step after securing the environment is to determine if the sample is already known. Researching the malware's hash, strings, or other indicators online (e.g., in threat intelligence portals like VirusTotal) can provide immediate identification, existing analysis reports, and indicators of compromise. This initial reconnaissance saves time and resources, and it informs the subsequent steps of the analysis if a deeper dive is still required.

A. Running the program through a debugger is an advanced, time-consuming step of reverse engineering, performed after initial triage and behavioral analysis.
B. Unpacking the file is a part of dynamic analysis, but researching the file first may reveal its nature and the correct unpacking tools or methods.
D. Disassembling the malware is a form of static code analysis that is complex and typically follows initial identification and behavioral observation.

1. Cisco, "The Cisco Malware Analysis and Reverse-Engineering Playbook," 2016, Page 4, Section "Malware Analysis Process." The playbook outlines the process starting with "Basic static analysis" which includes generating hashes and "querying sources such as...VirusTotal" before proceeding to more advanced steps.

2. National Institute of Standards and Technology (NIST), "Special Publication 800-83: Guide to Malware Incident Prevention and Handling for Desktops and Laptops," July 2005, Section 4.2 "Creating a Malware Analysis Capability." The guide emphasizes a phased approach, where initial characterization (which includes searching for known information) precedes in-depth analysis.

3. Sikorski, M., & Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. Chapter 1, "Basic Analysis," details that a key initial step is to search for the malware's hash online to see if it has been previously analyzed.