350-201 Exam Guide, Objectives & Preparation

Exam Overview

Exam Code	350-201
Exam Name	Cisco Performing CyberOps Using Core Security Technologies
Vendor	Cisco
Total Questions	139
Last Updated	26-Oct, 2026

Free 350-201 Questions Get Premium Access

Why CertsPoint?

Latest & Verified Questions
Detailed Explanations
Regular Updates
Full-Length Practice Tests
Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent

4.6 (398 Up Votes)

Secure Payment Privacy Protected Money Back Guarantee

Free 350-201 Practice Questions

Explore 4 free practice questions for the Cisco 350-201 exam and review the answers and explanations to support your preparation.

Question 1
Single answer

A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end user community
- Option A:
  Limit the number of API calls that a single client is allowed to make
  Correct
- Option B:
  Add restrictions on the edge router on how often a single client can access the API
  Correct
- Option C:
  Reduce the amount of data that can be fetched from the total pool of active clients that call the API
  Correct
- Option D:
  Increase the application cache of the total pool of active clients that call the API
  Correct
Show Answer & Explanation Hide Answer & Explanation

Correct Answer: A

Question 2

Drag & Drop

DRAG DROP An organization lost connectivity to critical servers, and users cannot access business applications and internal websites. An engineer checks the network devices to investigate the outage and determines that all devices are functioning. Drag and drop the steps from the left into the sequence on the right to continue investigating this issue. Not all options are used.

Show Answer & Explanation Hide Answer & Explanation

Correct Answer

Available Actions (Blue Blocks)Sequence Slots (Yellow Blocks)
* run show access-list
* run show config
* validate the file MD5
* generate the core file
* verify the image file hash
* check the memory logs
* verify the memory state
* Step 1
* Step 2
* Step 3
* Step 4

Explanation

Source Actions (Left Column) Correct Ordered Sequence (Right Column)
* run show access-list

* run show config

* validate the file MD5

* generate the core file

* verify the image file hash

* check the memory logs

* verify the memory state
1. run show config

2. check the memory logs

3. verify the memory state

4. run show access-list

Question 3
Single answer

A threat actor attacked an organization’s Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator’s account was disabled. Which activity triggered the behavior analytics tool?
- Option A:
  accessing the Active Directory server
  Correct
- Option B:
  accessing the server with financial data
  Correct
- Option C:
  accessing multiple servers
  Correct
- Option D:
  downloading more than 10 files
  Correct
Show Answer & Explanation Hide Answer & Explanation

Correct Answer: C

Source Actions (Left Column)	Correct Ordered Sequence (Right Column)
* run show access-list * run show config * validate the file MD5 * generate the core file * verify the image file hash * check the memory logs * verify the memory state	1. run show config 2. check the memory logs 3. verify the memory state 4. run show access-list

Question 4

Single answer

A security analyst needs to investigate a security incident involving several suspicious connections with a possible attacker. Which tool should the analyst use to identify the source IP of the offender
Protocol Local Address Foreign Address State
TCP 192.168.1.8:54580 vk-in-f108:imaps ESTABLISHED
TCP 192.168.1.8:54583 132.245.61.50:https ESTABLISHED
TCP 192.168.1.8:54916 bay405-m:https ESTABLISHED
TCP 192.168.1.8:54978 vu-in-f188:5228 ESTABLISHED
TCP 192.168.1.8:55094 72.21.194.109:https ESTABLISHED
TCP 192.168.1.8:55401 wonderhowto:http ESTABLISHED
TCP 192.168.1.8:55730 mia07s34-in-f78:https TIME WAIT
Protocol Local Address Foreign Address State
TCP 192.168.1.8:55824 a23-40-191-15:https CLOSE_WAIT
TCP 192.168.1.8:55825 a23-40-191-15:https CLOSE_WAIT
TCP 192.168.1.8:55846 mia07s25-in-f14:https TIME_WAIT
TCP 192.168.1.8:55847 a184-51-150-89:http CLOSE_WAIT
TCP 192.168.1.8:55853 157.55.56.154:40028 ESTABLISHED
TCP 192.168.1.8:55879 atl14s38-in-f4:https ESTABLISHED
TCP 192.168.1.8:55884 208-46-117-174:https ESTABLISHED
TCP 192.168.1.8:55893 vx-in-f95:https TIME_WAIT
TCP 192.168.1.8:55947 stackoverflow:https ESTABLISHED
TCP 192.168.1.8:55966 stackoverflow:https ESTABLISHED
TCP 192.168.1.8:55970 mia07s34-in-f78:https TIME_WAIT
TCP 192.168.1.8:55972 191.238.241.80:https TIME_WAIT
TCP 192.168.1.8:55976 54.239.26.242:https ESTABLISHED
TCP 192.168.1.8:55979 mia07s35-in-f14:https ESTABLISHED
TCP 192.168.1.8:55986 server11:https TIME_WAIT
TCP 192.168.1.8:55988 104.16.118.182:http ESTABLISHED

Protocol	Local Address	Foreign Address	State
TCP	192.168.1.8:54580	vk-in-f108:imaps	ESTABLISHED
TCP	192.168.1.8:54583	132.245.61.50:https	ESTABLISHED
TCP	192.168.1.8:54916	bay405-m:https	ESTABLISHED
TCP	192.168.1.8:54978	vu-in-f188:5228	ESTABLISHED
TCP	192.168.1.8:55094	72.21.194.109:https	ESTABLISHED
TCP	192.168.1.8:55401	wonderhowto:http	ESTABLISHED
TCP	192.168.1.8:55730	mia07s34-in-f78:https	TIME WAIT

Protocol	Local Address	Foreign Address	State
TCP	192.168.1.8:55824	a23-40-191-15:https	CLOSE_WAIT
TCP	192.168.1.8:55825	a23-40-191-15:https	CLOSE_WAIT
TCP	192.168.1.8:55846	mia07s25-in-f14:https	TIME_WAIT
TCP	192.168.1.8:55847	a184-51-150-89:http	CLOSE_WAIT
TCP	192.168.1.8:55853	157.55.56.154:40028	ESTABLISHED
TCP	192.168.1.8:55879	atl14s38-in-f4:https	ESTABLISHED
TCP	192.168.1.8:55884	208-46-117-174:https	ESTABLISHED
TCP	192.168.1.8:55893	vx-in-f95:https	TIME_WAIT
TCP	192.168.1.8:55947	stackoverflow:https	ESTABLISHED
TCP	192.168.1.8:55966	stackoverflow:https	ESTABLISHED
TCP	192.168.1.8:55970	mia07s34-in-f78:https	TIME_WAIT
TCP	192.168.1.8:55972	191.238.241.80:https	TIME_WAIT
TCP	192.168.1.8:55976	54.239.26.242:https	ESTABLISHED
TCP	192.168.1.8:55979	mia07s35-in-f14:https	ESTABLISHED
TCP	192.168.1.8:55986	server11:https	TIME_WAIT
TCP	192.168.1.8:55988	104.16.118.182:http	ESTABLISHED

Option A:
packet sniffer
Correct
Option B:
malware analysis
Correct
Option C:
SIEM
Correct
Option D:
firewall manage
Correct

Show Answer & Explanation Hide Answer & Explanation

Correct Answer: A

Free 350-201 Practice Questions

Question 1

Limit the number of API calls that a single client is allowed to make

Add restrictions on the edge router on how often a single client can access the API

Reduce the amount of data that can be fetched from the total pool of active clients that call the API

Increase the application cache of the total pool of active clients that call the API

Question 2

Available Actions (Blue Blocks)Sequence Slots (Yellow Blocks)* run show access-list* run show config* validate the file MD5* generate the core file* verify the image file hash* check the memory logs* verify the memory state* Step 1* Step 2* Step 3* Step 4

Question 3

accessing the Active Directory server

accessing the server with financial data

accessing multiple servers

downloading more than 10 files

Question 4

packet sniffer

malware analysis

SIEM

firewall manage

Available Actions (Blue Blocks)Sequence Slots (Yellow Blocks)
* run show access-list
* run show config
* validate the file MD5
* generate the core file
* verify the image file hash
* check the memory logs
* verify the memory state
* Step 1
* Step 2
* Step 3
* Step 4