Cisco 350-201 Practice Test 10
Question 90
For an original CBRCOR educational scenario, consider: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Declare every system out of scope because the merchant uses a third-party payment page with no network review.
- Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
- Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
Explanation
Correct Answer
A:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. Acceptance: Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service.
E:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. Required intervention: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
Incorrect Answers
B:Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
Question 91
A SOC analyst is examining this cybersecurity operations situation: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context. A proposed shortcut is: Treat any generic company compliance badge as proof of federal cloud authorization without checking service scope. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
- Treat any generic company compliance badge as proof of federal cloud authorization without checking service scope.
- Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy.
- Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context.
Incorrect Answers
A:Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
B:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
Question 92
A Cisco cybersecurity incident response review finds: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context. The team proposes: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Explanation
Correct Answer
B:Demonstrable success requires: The selected evidence actually covers the system and government cloud service before acceptance. This principle explains the proposed technical approach, which is: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
Incorrect Answers
A:Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
C:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
D:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
Question 93
The SOC team has not yet approved changes. Current evidence indicates: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
Explanation
Correct Answer
D:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Applied case: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context.
Incorrect Answers
A:Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
B:Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
C:This option addresses a different security operations topic (Asset threat vulnerability risk analysis) rather than the documented Government compliance mapping decision.
Question 94
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
- The case can be audited from initial alert through validated recovery and documented corrective action.
- Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails.
- The selected evidence actually covers the system and government cloud service before acceptance.
Explanation
Correct Answer
D:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. The approved implementation step was: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
Incorrect Answers
A:The site serves validated trusted content and the unauthorized change path is closed without losing investigative records. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
B:The case can be audited from initial alert through validated recovery and documented corrective action. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
C:This option addresses a different security operations topic (Playbook branching and exception handling) rather than the documented Government compliance mapping decision.
Question 95
An implementation sign-off request identifies the following problem: A federal agency system is being assessed using only a retailer's payment-card checklist with no federal security authorization context. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Verify: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Verify: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Verify: Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
Explanation
Correct Answer
B:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. The change is successful only when: The selected evidence actually covers the system and government cloud service before acceptance.
Incorrect Answers
A:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
C:This option addresses a different security operations topic (Playbook triggers and owners) rather than the documented Government compliance mapping decision.
D:Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
Question 96
A SOC analyst is examining this cybersecurity operations situation: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload. A proposed shortcut is: Treat any generic company compliance badge as proof of federal cloud authorization without checking service scope. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy.
- Treat any generic company compliance badge as proof of federal cloud authorization without checking service scope.
- Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload.
Incorrect Answers
A:Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy. A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload.
B:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Use this instead: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
C:Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
Question 97
A Cisco cybersecurity incident response review finds: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload. The team proposes: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
- Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
Explanation
Correct Answer
D:Demonstrable success requires: The selected evidence actually covers the system and government cloud service before acceptance. Applied case: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload.
Incorrect Answers
A:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload.
B:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
C:Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
Question 98
The SOC team has not yet approved changes. Current evidence indicates: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
Explanation
Correct Answer
C:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Applied case: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload.
Incorrect Answers
A:Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
B:Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
D:Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
Question 99
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
- The selected evidence actually covers the system and government cloud service before acceptance.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
Explanation
Correct Answer
B:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
C:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
D:This option addresses a different security operations topic (PaaS runtime and data-governance responsibility) rather than the documented Government compliance mapping decision.
Question 100
For an original CBRCOR educational scenario, consider: A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Result: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
- Result: The selected evidence actually covers the system and government cloud service before acceptance.
- Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
Explanation
Correct Answer
A:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Required intervention: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
B:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Evidence: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
E:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Result: The selected evidence actually covers the system and government cloud service before acceptance.
Incorrect Answers
C:Result: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
D:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. A cloud vendor claims its commercial ISO certificate automatically grants a FedRAMP authorization for a government workload.
F:Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
