Cisco 350-201 Practice Test 1
Question 1
A SOC analyst is examining this cybersecurity operations situation: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner. A proposed shortcut is: Let every analyst independently choose severity and shut down production without recording an approval. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Let every analyst independently choose severity and shut down production without recording an approval.
- Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
- Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner.
Incorrect Answers
A:Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
B:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 2
A Cisco cybersecurity incident response review finds: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner. The team proposes: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
- A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
- Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Explanation
Correct Answer
B:Relevant validation before approval: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals. Applied case: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner.
Incorrect Answers
A:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
D:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 3
The SOC team has not yet approved changes. Current evidence indicates: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service.
- Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
Explanation
Correct Answer
D:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Applied case: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner.
Incorrect Answers
A:Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
B:Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Review control test evidence, exception scope, business-owner authorization and review date against the documented threat. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 4
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Each test incident enters the right workflow and has one accountable owner with a traceable escalation path.
- Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report.
- The case can be audited from initial alert through validated recovery and documented corrective action.
- The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
Explanation
Correct Answer
A:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:The case can be audited from initial alert through validated recovery and documented corrective action. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
D:The site serves validated trusted content and the unauthorized change path is closed without losing investigative records. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 5
An implementation sign-off request identifies the following problem: A SOC analyst receives a suspicious administrator login alert but the runbook lacks a severity trigger and an incident owner. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Verify: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Verify: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Verify: Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Verify: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
Explanation
Correct Answer
B:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. The change is successful only when: Each test incident enters the right workflow and has one accountable owner with a traceable escalation path.
Incorrect Answers
A:Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
D:Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
Question 6
A SOC analyst is examining this cybersecurity operations situation: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment. A proposed shortcut is: Let every analyst independently choose severity and shut down production without recording an approval. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
- Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook.
- Let every analyst independently choose severity and shut down production without recording an approval.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment.
Incorrect Answers
A:Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
B:Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
D:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Applied case: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment.
Question 7
A Cisco cybersecurity incident response review finds: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment. The team proposes: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
Explanation
Correct Answer
B:Relevant validation before approval: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals. Applied case: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment.
Incorrect Answers
A:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
D:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 8
The SOC team has not yet approved changes. Current evidence indicates: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
Explanation
Correct Answer
A:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
B:Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
D:Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 9
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
- Each test incident enters the right workflow and has one accountable owner with a traceable escalation path.
Explanation
Correct Answer
D:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. The approved implementation step was: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook.
Incorrect Answers
A:Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
B:The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 10
For an original CBRCOR educational scenario, consider: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook.
- Let every analyst independently choose severity and shut down production without recording an approval.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Check: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Check: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
Explanation
Correct Answer
A:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Evidence: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
D:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
E:Check: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
