Cisco 350-201 CBRCOR case studies
Cisco 350-201 CBRCOR · Put your knowledge to work in context.
The Cisco 350-201 CBRCOR exam sits in Cisco's cybersecurity certification track and is aimed at security operations practitioners - analysts, incident responders, and SOC engineers - who want to demonstrate that they can investigate activity, detect threats, and drive an incident to closure rather than merely configure devices. This page is an independent study resource. The Cisco 350-201 CBRCOR case studies are 5 cases and about 3,121 words.
1Ransomware Across Two VLANs With One Immutable Backup
At 02:14 on a Tuesday, the SOC receives 43 EDR alerts for shadow-copy deletion across 11 servers in two VLANs. File shares on three servers now contain files with a new extension and ransom notes.
643 words, about 3 min2OAuth Consent and MFA Fatigue in Microsoft 365
On Monday at 09:05 the helpdesk receives 14 reports of unexpected Microsoft 365 MFA prompts. Azure AD sign-in logs show six users approved a push notification, and four of those users subsequently granted an OAuth application named 'eM Client Sync' the Mail.Read and offline access scopes.
620 words, about 3 min3Beaconing Developer Workstation and a Shared Build Server
At 11:40, Zeek and proxy logs show workstation 10.20.4.77 making HTTPS POSTs every 63 seconds with about 1.2 KB of jittered payload to a domain registered 11 days ago. EDR reports node.exe , which is signed and expected on developer machines, spawning powershell.exe -enc with a base64 command line; the parent process is a scheduled task created at 02:10.
653 words, about 3 min4Sector ISAC Report on Silent Borealis
Your sector ISAC publishes a report on 'Silent Borealis,' a financially motivated actor targeting logistics firms. The report rates confidence as moderate and lists five IPs and three domains, some 90 days old, plus TTPs: phishing with ISO attachments, certutil -urlcache for download, bitsadmin for persistence, C2 over legitimate cloud storage, and Kerberoasting.
604 words, about 3 min5Cloud IAM Key Exfiltration and the 72-Hour Clock
At 03:22, GuardDuty raises UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS for role svc-reporting , used from an IP in the Netherlands. CloudTrail shows 14,000 S3 GetObject calls on fin-reports-prod in nine minutes, then a DeleteTrail attempt that failed.
601 words, about 3 min