Cisco 350-201 Practice Test 104
Question 1030
For an original CBRCOR educational scenario, consider: A threat intelligence API indicates pagination and rate limits in response headers but the enrichment code processes only the first result page. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context.
- Parse every HTTP response as a mandatory JSON document regardless of status or content type.
- Check: Inspect mock 200, 202 and 204 responses with headers and query continuation metadata for all paths.
- Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events.
- Change: Validate status and media type before decoding an optional body, and follow documented headers for limits and continuation.
Explanation
Correct Answer
C:HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON. Required intervention: Validate status and media type before decoding an optional body, and follow documented headers for limits and continuation.
E:HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON. Acceptance: The client recognizes success without body content and retrieves all permitted paginated intelligence results.
Incorrect Answers
A:Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context. HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON.
D:Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events. HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON.
Question 1031
A SOC analyst is examining this cybersecurity operations situation: A SOAR connector places a security vendor API token in a URL query string that is copied into proxy access logs. A proposed shortcut is: Embed permanent administrator API keys in scripts and print every header when debugging connectivity. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Embed permanent administrator API keys in scripts and print every header when debugging connectivity.
- Validate required environment values, handle missing variables explicitly and prevent secret values from entering command output or shell history.
- Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
- Automate deterministic enrichment and routing while reserving ambiguous or high-impact decisions for evidence-based human approval.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Incorrect Answers
A:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Validate required environment values, handle missing variables explicitly and prevent secret values from entering command output or shell history. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
D:Automate deterministic enrichment and routing while reserving ambiguous or high-impact decisions for evidence-based human approval. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1032
A Cisco cybersecurity incident response review finds: A SOAR connector places a security vendor API token in a URL query string that is copied into proxy access logs. The team proposes: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
- Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
- HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON.
- Retries and pagination must preserve logical event identity or the SOAR case will be duplicated or incomplete.
Explanation
Correct Answer
B:Demonstrable success requires: Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs. This principle explains the proposed technical approach, which is: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
Incorrect Answers
A:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
C:HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
D:Retries and pagination must preserve logical event identity or the SOAR case will be duplicated or incomplete. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1033
The SOC team has not yet approved changes. Current evidence indicates: A SOAR connector places a security vendor API token in a URL query string that is copied into proxy access logs. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Exercise malformed indicators, valid samples and an induced error while inspecting outbound requests and sanitized logging.
- Apply the same configuration twice in a sandbox and compare planned diffs, object counts and collection connectivity.
- Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs.
- Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
Explanation
Correct Answer
D:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Applied case: A SOAR connector places a security vendor API token in a URL query string that is copied into proxy access logs.
Incorrect Answers
A:This option addresses a different security operations topic (Modify IOC ingestion script with validation) rather than the documented API key and bearer token handling decision.
B:This option addresses a different security operations topic (Infrastructure as Code for SOC collection) rather than the documented API key and bearer token handling decision.
C:Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1034
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SOAR connector places a security vendor API token in a URL query string that is copied into proxy access logs. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Failed enrichments are visible while unaffected indicators continue according to documented policy.
- Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs.
- Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
- The team can distinguish individual automated jobs from a governed multi-step response with recoverable execution history.
Explanation
Correct Answer
B:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Failed enrichments are visible while unaffected indicators continue according to documented policy. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
C:Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
D:The team can distinguish individual automated jobs from a governed multi-step response with recoverable execution history. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1035
An implementation sign-off request identifies the following problem: A SOAR connector places a security vendor API token in a URL query string that is copied into proxy access logs. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging. Verify: Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
- Change: Handle asynchronous acceptance and throttling according to provider documentation, tracking final job status and deferred lookup results. Verify: Emulate an accepted-then-failed action and a throttled lookup with Retry-After and inspect recorded states.
- Change: Honor documented payload limits, timeouts, idempotency and asynchronous action confirmation in automation clients. Verify: Test the supported batch threshold and a lost-response case while reconciling actual device action IDs and outcomes.
- Change: Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow. Verify: Record request identity, token scope, endpoint path, exact code and error body in controlled test cases.
Explanation
Correct Answer
A:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. The change is successful only when: Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs.
Incorrect Answers
B:Change: Handle asynchronous acceptance and throttling according to provider documentation, tracking final job status and deferred lookup results. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
C:Change: Honor documented payload limits, timeouts, idempotency and asynchronous action confirmation in automation clients. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
D:Change: Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow.
Question 1036
A SOC analyst is examining this cybersecurity operations situation: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system. A proposed shortcut is: Embed permanent administrator API keys in scripts and print every header when debugging connectivity. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Handle asynchronous acceptance and throttling according to provider documentation, tracking final job status and deferred lookup results.
- Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
- Embed permanent administrator API keys in scripts and print every header when debugging connectivity.
- Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system.
Incorrect Answers
A:Handle asynchronous acceptance and throttling according to provider documentation, tracking final job status and deferred lookup results. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
C:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Use this instead: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
D:Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1037
A Cisco cybersecurity incident response review finds: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system. The team proposes: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Retries and pagination must preserve logical event identity or the SOAR case will be duplicated or incomplete.
- CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes.
- Presentation markup is not automatically a stable structured interchange format and may conceal context needed by incident logic.
- Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Explanation
Correct Answer
D:Demonstrable success requires: Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs. Applied case: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system.
Incorrect Answers
A:Retries and pagination must preserve logical event identity or the SOAR case will be duplicated or incomplete. A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system.
B:This option addresses a different security operations topic (JSON versus CSV and XML in security exports) rather than the documented API key and bearer token handling decision.
C:Presentation markup is not automatically a stable structured interchange format and may conceal context needed by incident logic. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1038
The SOC team has not yet approved changes. Current evidence indicates: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare running artifact hashes, pipeline history, monitoring results and recovery exercise for one staged playbook update.
- Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
- Exercise missing and set variable cases while checking permissions, output paths and redacted logs.
- Compare labeled outcomes and detection quality across representative source groups before automatic escalation.
Explanation
Correct Answer
B:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Applied case: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system.
Incorrect Answers
A:This option addresses a different security operations topic (DevOps collaboration and incident automation changes) rather than the documented API key and bearer token handling decision.
C:Exercise missing and set variable cases while checking permissions, output paths and redacted logs. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
D:Compare labeled outcomes and detection quality across representative source groups before automatic escalation. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1039
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs.
- Final case status reflects verified completion or failure, and delayed enrichments remain traceable.
- Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects.
- Automated fields are derived from documented machine-readable sources while analyst views escape untrusted content.
Explanation
Correct Answer
A:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. The approved implementation step was: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
Incorrect Answers
B:Final case status reflects verified completion or failure, and delayed enrichments remain traceable. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
C:This option addresses a different security operations topic (Bash log selection and safe file processing) rather than the documented API key and bearer token handling decision.
D:Automated fields are derived from documented machine-readable sources while analyst views escape untrusted content. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1040
For an original CBRCOR educational scenario, consider: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Embed permanent administrator API keys in scripts and print every header when debugging connectivity.
- Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context.
- Check: Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
- Change: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
- Change: Introduce labeled case feedback, domain-specific validation and confidence thresholds with override and audit trails.
Explanation
Correct Answer
C:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Required intervention: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
D:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Evidence: Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
B:Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
E:Change: Introduce labeled case feedback, domain-specific validation and confidence thresholds with override and audit trails. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
