Medium 350-201 practice questions

A SOC analyst is asked to detect previously unseen insider threats in authentication logs where no labeled examples of malicious behavior exist. Leadership wants an AI-powered analytic technique that can surface unusual login patterns without predefined signatures. Which technique should the analyst recommend?

A SOC lead wants to reduce the time analysts spend deciding which of thousands of daily alerts to investigate first. The team has years of historical incident data indicating which alerts previously led to confirmed incidents, along with contextual features (asset criticality, user role, time of day). Management asks the lead to recommend an AI-powered analytic technique that will automatically rank incoming alerts by their likelihood of being a genuine incident. Which technique best meets this need?

A SOC analytics team wants to predict the expected volume of authentication requests for each hour of the coming week so capacity and staffing can be planned, and so that unusual spikes can later be flagged against the forecast. Historical hourly authentication counts spanning two years are available. Which AI/ML technique should the team recommend to produce these numeric hourly predictions?

A financial services SOC has a large historical dataset of transactions, each already labeled by fraud analysts as either 'fraudulent' or 'legitimate.' Leadership wants an AI-powered analytic capability that can automatically assign one of these two categories to each new incoming transaction in real time. Which machine learning technique should you recommend to meet this specific need?

A SOC analyst at a large enterprise is overwhelmed by millions of unlabeled security events per day from firewalls, endpoints, and proxies. Leadership wants an AI-powered analytics approach that automatically groups related events into natural categories to surface previously unknown attack patterns and reduce alert volume — without requiring pre-defined labels or known signatures. Which AI-powered technique should the analyst recommend to meet this specific need?

A SOC lead is overwhelmed by the volume of unstructured threat intelligence reports, vendor advisories, and dark web forum posts arriving daily. She wants an AI-powered analytic technique that can automatically read this free-form text, extract key indicators and threat actor mentions, and produce concise summaries so analysts can triage faster. Which AI/ML technique best meets this specific need?

A SOC engineer is integrating a threat intelligence platform with an internal script. The vendor documentation shows that each request must include an 'Authorization' header containing a shared identifier plus a computed hash of the request body, timestamp, and a secret key that is never transmitted over the wire. Which authentication mechanism does this describe?

A SOC engineer is writing a Python integration against a threat intelligence vendor's REST API. The vendor documentation states that each request must include the header 'X-API-Key: <value>' and that no username or password is transmitted. The engineer's colleague suggests using Python's requests library with the auth=(user, pass) parameter instead. Which statement correctly describes the authentication mechanism required and why the colleague's approach is inappropriate?

A SOC engineer writes a script that submits a list of 5,000 suspicious file hashes to a threat intelligence REST API in a single POST request. The API repeatedly returns HTTP 413 responses, and the script fails. The API documentation states that each request body may not exceed 100 hashes. What is the MOST appropriate modification to the script to resolve this issue?

A SOC engineer writes a Python script that queries a threat-intelligence API to enrich indicators. For a batch of 500 IOCs the request consistently fails after about 30 seconds, even though smaller batches succeed. The API documentation states responses are returned synchronously and connections are dropped if a single request exceeds a fixed server-side processing limit. Which API constraint is the engineer most likely encountering, and what is the best remediation?

A SOC analyst is writing a Bash script that calls a threat intelligence REST API. The API key must be available to a Python script launched from the same shell session, but the analyst does not want the key hard-coded in either file or visible in the script's source. Which Bash command correctly makes the key available to the child Python process?

A SOC analyst is triaging a Linux authentication log at /var/log/auth.log during an incident. They need to quickly produce a count of how many distinct source IP addresses generated 'Failed password' entries. Which single Bash command pipeline accomplishes this most directly?

During incident response, an analyst must relocate 40 suspicious log files from /var/log/incoming/ into a quarantine directory at /secure/quarantine/ on the same Linux host. The chain-of-custody procedure requires that the files' original modification timestamps and content remain unchanged, and the source directory must be empty afterward. Which single Bash command best accomplishes this?

A SOC analyst receives an alert that a large volume of files from the company's SaaS-based file-sharing platform was downloaded and then shared externally by a single user account over a two-hour window. The security team suspects data exfiltration. Which action should the analyst take FIRST to investigate this potential cloud data loss event?

During a data-loss investigation, an analyst reviews CASB logs and finds that a departing employee shared a folder from the corporate cloud storage tenant to a personal Gmail address, then downloaded 4 GB of files to an unmanaged device over the following two days. The security team wants to characterize the exfiltration modality to scope the investigation correctly. Which modality of data loss best describes this event?

A consortium of five regional hospitals wants to share a common infrastructure to run electronic health record applications. They require that the environment be governed by a shared set of HIPAA-aligned security and compliance policies, and that access be restricted only to the member organizations rather than the general public. Which cloud deployment model best fits these requirements?

A vulnerability analyst is scoring a newly disclosed flaw in an internet-facing web application. The vulnerability can be exploited by an unauthenticated remote attacker sending a crafted HTTP request, requires no user interaction, and results in full compromise of confidentiality, integrity, and availability of the application. Which CVSS v3.1 Base metric assignment most accurately reflects that the attack can be launched from anywhere on the internet without local or adjacent access?

A mid-sized retailer's CISO is building the business case for purchasing a cyber risk insurance policy. During a board meeting, a director asks what the policy is fundamentally intended to accomplish for the organization, given that they already invest heavily in preventive controls. Which statement best describes the primary purpose of cyber risk insurance in this context?

A retail company has implemented layered defenses, an incident response plan, and regular vulnerability management. During a board meeting, the CISO recommends purchasing a cyber risk insurance policy despite these controls. A board member questions why insurance is necessary when strong security controls already exist. Which statement best explains the primary purpose of cyber risk insurance in this context?

A SOC analyst is executing the organization's volumetric DDoS response playbook after monitoring shows a 40 Gbps UDP flood saturating the internet-facing links, causing the public web application to become unreachable. The on-premises firewall and IPS are already overwhelmed and dropping legitimate traffic along with attack traffic. The playbook step reads: 'Mitigate the attack volume before it reaches the enterprise edge.' Which tool or service should the analyst engage to satisfy this playbook step?

A SOC analyst responds to a suspected intrusion on a Windows desktop that is still powered on and connected to the network. Management wants the investigation to preserve the maximum amount of forensic evidence. According to the order of volatility, which data should the analyst collect FIRST during the endpoint investigation?

During a hardening review of a production PostgreSQL database server, a SOC analyst discovers the host is also running an active SMTP relay, an FTP daemon, and the SNMP service with the default 'public' community string. The database application only requires inbound TCP 5432 from the application tier and outbound access to a patch repository. Following the principle of least functionality, which recommendation should the analyst make?

A security analyst is hardening a newly provisioned Linux web server that will only serve HTTPS traffic to the public internet. A port scan of the host reveals the following listening services: HTTPS (443), Telnet (23), FTP (21), SSH (22), and an unused SMTP relay (25). The organization requires remote administration to remain possible while eliminating unnecessary attack surface. Which services should the analyst disable to best harden this asset?

A SOC manager reviews the quarterly metrics report and notices that although the mean time to respond (MTTR) has steadily decreased, one attacker maintained access to a compromised server for 47 days before any alert was raised. The manager wants to select the single metric that best quantifies this specific problem and drive improvement toward closing the gap. Which metric most directly measures the length of time an adversary remained undetected inside the environment?

A financial analyst's laptop triggered a DLP alert indicating that a spreadsheet tagged as confidential was copied to an external device. As the SOC analyst assigned to investigate this potential endpoint data loss, which action should you take FIRST to confirm the exfiltration and preserve evidence?