Cisco 350-201 Practice Test 105
Question 1040
For an original CBRCOR educational scenario, consider: A response script prints the full Authorization bearer header whenever a token expires, leaving reusable credentials in its ticket system. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Embed permanent administrator API keys in scripts and print every header when debugging connectivity.
- Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context.
- Check: Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
- Change: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
- Change: Introduce labeled case feedback, domain-specific validation and confidence thresholds with override and audit trails.
Explanation
Correct Answer
C:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Required intervention: Use the provider-approved authentication scheme with protected headers, least-privilege token scope and redacted diagnostic logging.
D:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Evidence: Inspect a prepared request, secret storage, error logging and a revoked-token negative test in a sandbox.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
B:Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
E:Change: Introduce labeled case feedback, domain-specific validation and confidence thresholds with override and audit trails. Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
Question 1041
A SOC analyst is examining this cybersecurity operations situation: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption. A proposed shortcut is: Consider Base64 encoding sufficient transport security and grant administrator permissions to all API clients. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Consider Base64 encoding sufficient transport security and grant administrator permissions to all API clients.
- Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation.
- Inspect loops, variable scope and exception handling to ensure each indicator yields a distinct success or failure result.
- Build a detection-content pipeline with source review, syntax validation, positive and negative test fixtures and controlled promotion.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption.
Incorrect Answers
A:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Inspect loops, variable scope and exception handling to ensure each indicator yields a distinct success or failure result. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Build a detection-content pipeline with source review, syntax validation, positive and negative test fixtures and controlled promotion. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1042
A Cisco cybersecurity incident response review finds: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption. The team proposes: Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Shell word splitting and working directory context can change targets even when the visible command appears harmless.
- HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON.
- HTTP 401 generally concerns authentication, 403 access refusal and 404 missing resources, subject to the provider's documented contract.
- Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Explanation
Correct Answer
D:Demonstrable success requires: Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes. Applied case: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption.
Incorrect Answers
A:Shell word splitting and working directory context can change targets even when the visible command appears harmless. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
B:HTTP responses carry a status, headers and optional body; successful no-content responses need not contain JSON. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
C:HTTP 401 generally concerns authentication, 403 access refusal and 404 missing resources, subject to the provider's documented contract. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1043
The SOC team has not yet approved changes. Current evidence indicates: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context.
- Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
- Trace one rule change from commit to test results, approvals, artifact identity and observed production monitoring.
- Run test fixtures with whitespace, unset variables and controlled failures in a disposable directory.
Explanation
Correct Answer
B:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Applied case: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption.
Incorrect Answers
A:Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
C:Trace one rule change from commit to test results, approvals, artifact identity and observed production monitoring. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Run test fixtures with whitespace, unset variables and controlled failures in a disposable directory. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1044
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Tested detection logic is deployed with traceable results and failing rules remain blocked from promotion.
- Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes.
- Unauthorized actions fail clearly and the selected remediation matches the observed error rather than blind retries.
- The script fails safely on absent configuration and writes controlled evidence without exposing credentials.
Explanation
Correct Answer
B:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Tested detection logic is deployed with traceable results and failing rules remain blocked from promotion. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
C:Unauthorized actions fail clearly and the selected remediation matches the observed error rather than blind retries. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:The script fails safely on absent configuration and writes controlled evidence without exposing credentials. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1045
An implementation sign-off request identifies the following problem: A legacy service requires HTTP Basic credentials but the SOC sends them over unencrypted HTTP because Base64 is mistaken for encryption. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events. Verify: Compare parsed sample counts and fields for quoted CSV, nested JSON and namespaced XML reference records.
- Change: Introduce labeled case feedback, domain-specific validation and confidence thresholds with override and audit trails. Verify: Compare labeled outcomes and detection quality across representative source groups before automatic escalation.
- Change: Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow. Verify: Record request identity, token scope, endpoint path, exact code and error body in controlled test cases.
- Change: Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation. Verify: Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
Explanation
Correct Answer
D:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. The change is successful only when: Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes.
Incorrect Answers
A:Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
B:Change: Introduce labeled case feedback, domain-specific validation and confidence thresholds with override and audit trails. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
C:Change: Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1046
A SOC analyst is examining this cybersecurity operations situation: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access. A proposed shortcut is: Consider Base64 encoding sufficient transport security and grant administrator permissions to all API clients. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Consider Base64 encoding sufficient transport security and grant administrator permissions to all API clients.
- Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation.
- Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
- Trace the script's parsing, conditional logic and collection operations, using typed decoded event fields for reliable classification.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
Incorrect Answers
A:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Applied case: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
C:Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Trace the script's parsing, conditional logic and collection operations, using typed decoded event fields for reliable classification. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1047
A Cisco cybersecurity incident response review finds: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access. The team proposes: Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs.
- Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
- Python data structures and Boolean conditions determine which events contribute to an analytic; ambiguous text matching changes results.
- Network timeouts may hide a committed server action, while oversized requests can be rejected or partially processed.
Explanation
Correct Answer
B:Demonstrable success requires: Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes. Applied case: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
Incorrect Answers
A:Bearer and API-key credentials confer authority to holders and must not be exposed through URLs, source control or untrusted logs. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
C:Python data structures and Boolean conditions determine which events contribute to an analytic; ambiguous text matching changes results. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Network timeouts may hide a committed server action, while oversized requests can be rejected or partially processed. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1048
The SOC team has not yet approved changes. Current evidence indicates: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
- Emulate an accepted-then-failed action and a throttled lookup with Retry-After and inspect recorded states.
- Exercise malformed indicators, valid samples and an induced error while inspecting outbound requests and sanitized logging.
- Simulate 429 and timeouts against a mock enrichment provider and inspect retry intervals and result classification.
Explanation
Correct Answer
A:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Confirm afterward that: Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes.
Incorrect Answers
B:Emulate an accepted-then-failed action and a throttled lookup with Retry-After and inspect recorded states. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
C:Exercise malformed indicators, valid samples and an induced error while inspecting outbound requests and sanitized logging. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Simulate 429 and timeouts against a mock enrichment provider and inspect retry intervals and result classification. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
Question 1049
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes.
- Unauthorized actions fail clearly and the selected remediation matches the observed error rather than blind retries.
- Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs.
- Tested detection logic is deployed with traceable results and failing rules remain blocked from promotion.
Explanation
Correct Answer
A:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. The approved implementation step was: Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation.
Incorrect Answers
B:Unauthorized actions fail clearly and the selected remediation matches the observed error rather than blind retries. A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
C:Authorized calls succeed and no reusable credential appears in the recorded request URL or output logs. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Tested detection logic is deployed with traceable results and failing rules remain blocked from promotion. A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
Question 1050
For an original CBRCOR educational scenario, consider: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Consider Base64 encoding sufficient transport security and grant administrator permissions to all API clients.
- Check: Inspect mock 200, 202 and 204 responses with headers and query continuation metadata for all paths.
- Check: Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
- Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events.
- Change: Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation.
Explanation
Correct Answer
C:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Acceptance: Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes.
E:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Evidence: Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
B:Check: Inspect mock 200, 202 and 204 responses with headers and query continuation metadata for all paths. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events. A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
