Easy 350-201 practice questions
Direct recall — confirm you know the core facts and definitions. 8 easy questions available — no sign-up, always free.
During an investigation, a SOC analyst needs to identify all files larger than 100 MB inside the /var/log directory tree so they can archive and clear excessive log data that is filling a disk. Which Bash command correctly accomplishes this?
A security engineer has been tasked with hardening a fleet of newly deployed Ubuntu Linux servers before they enter production. Management wants the configuration baselines to follow an industry-recognized, consensus-developed standard that provides specific, prescriptive configuration settings and is freely available for reference. Which resource should the engineer use to obtain these prescriptive hardening guidelines?
A retail company processes credit card transactions through its e-commerce platform and stores cardholder data in a backend database. During an audit, the security team is asked to identify the compliance standard that specifically governs how this data must be protected. Which standard applies to this scenario?
A SOC analyst writes a script that queries a threat intelligence platform's REST API using the endpoint /api/v2/indicators/{id}. For most indicator IDs the script works correctly, but for one specific ID the server consistently returns an HTTP 404 response with a JSON body of {"error": "resource not found"}. The analyst has confirmed the API token is valid and other endpoints respond normally. What is the MOST likely cause of the 404 response?
A SOC analyst is writing a parser for threat feed data. When inspecting one feed's payload, they observe records structured with angle-bracket element tags, nested child elements, and metadata expressed as name="value" pairs inside the opening tags. Which data format is this feed using?
A SOC analyst receives the following API response body while integrating a threat intelligence feed into a SOAR playbook: { "indicators": [ { "value": "198.51.100.5", "type": "ipv4", "confidence": 85 }, { "value": "evil.example.com", "type": "domain", "confidence": 60 } ], "count": 2 } Based on the structure of this data, which statement most accurately describes the format so the analyst can select the correct parsing approach in the playbook?
A SOC analyst receives a threat intelligence feed export and needs to identify its format before writing a parser. The file contains the following content: indicator,type,confidence,first_seen 185.220.101.5,ip,90,2024-01-15 malware.example.com,domain,75,2024-01-16 d41d8cd98f00b204,hash,60,2024-01-17 Which data format is this, and what characteristic confirms it?
A SOC engineer is building an integration that must ingest threat intelligence feeds. One vendor returns data that begins with '<?xml version="1.0"?>' and organizes fields using opening and closing angle-bracket tags such as <indicator><type>domain</type><value>bad.example.com</value></indicator>. The engineer must write a parser appropriate to this structure. Which data format is the feed using?