Cisco 350-201 Practice Test 106
Question 1050
For an original CBRCOR educational scenario, consider: A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Consider Base64 encoding sufficient transport security and grant administrator permissions to all API clients.
- Check: Inspect mock 200, 202 and 204 responses with headers and query continuation metadata for all paths.
- Check: Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
- Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events.
- Change: Enforce authenticated TLS, follow the documented authentication mechanism and scope credentials to the minimum operation.
Explanation
Correct Answer
C:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Acceptance: Credentials travel through encrypted channels and read-only enrichers cannot perform unapproved configuration writes.
E:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Evidence: Test TLS certificate validation and low-privilege access with intended reads and denied administrative operations.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
B:Check: Inspect mock 200, 202 and 204 responses with headers and query continuation metadata for all paths. Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
D:Change: Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events. A connector's token is valid but has global administrative scope even though the enrichment operation only needs read access.
Question 1051
A SOC analyst is examining this cybersecurity operations situation: A responder's Bash triage script uses an unquoted log directory variable and misreads files with spaces or wildcard characters. A proposed shortcut is: Run rm -rf on unvalidated shell variables in the live evidence directory to simplify cleanup. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
- Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events.
- Inspect loops, variable scope and exception handling to ensure each indicator yields a distinct success or failure result.
- Run rm -rf on unvalidated shell variables in the live evidence directory to simplify cleanup.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Incorrect Answers
B:Select parsers that match each format and preserve escaping, nested structure and field types before normalizing security events. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:Inspect loops, variable scope and exception handling to ensure each indicator yields a distinct success or failure result. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
D:Shell word splitting and working directory context can change targets even when the visible command appears harmless. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 1052
A Cisco cybersecurity incident response review finds: A responder's Bash triage script uses an unquoted log directory variable and misreads files with spaces or wildcard characters. The team proposes: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Shell word splitting and working directory context can change targets even when the visible command appears harmless.
- Python data structures and Boolean conditions determine which events contribute to an analytic; ambiguous text matching changes results.
- Retries and pagination must preserve logical event identity or the SOAR case will be duplicated or incomplete.
- Security automation must distinguish candidate input from approved action and avoid making logs a new credential exposure source.
Explanation
Correct Answer
A:Demonstrable success requires: Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects. This principle explains the proposed technical approach, which is: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
Incorrect Answers
B:Python data structures and Boolean conditions determine which events contribute to an analytic; ambiguous text matching changes results. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:Retries and pagination must preserve logical event identity or the SOAR case will be duplicated or incomplete. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
D:Security automation must distinguish candidate input from approved action and avoid making logs a new credential exposure source. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Question 1053
The SOC team has not yet approved changes. Current evidence indicates: A responder's Bash triage script uses an unquoted log directory variable and misreads files with spaces or wildcard characters. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Apply the same configuration twice in a sandbox and compare planned diffs, object counts and collection connectivity.
- Record request identity, token scope, endpoint path, exact code and error body in controlled test cases.
- Measure repetitive analyst effort, validation accuracy, false-positive rate and impact for each proposed automated step.
- Run test fixtures with whitespace, unset variables and controlled failures in a disposable directory.
Explanation
Correct Answer
D:Shell word splitting and working directory context can change targets even when the visible command appears harmless. Confirm afterward that: Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects.
Incorrect Answers
A:Apply the same configuration twice in a sandbox and compare planned diffs, object counts and collection connectivity. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
B:Record request identity, token scope, endpoint path, exact code and error body in controlled test cases. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:Measure repetitive analyst effort, validation accuracy, false-positive rate and impact for each proposed automated step. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Question 1054
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A responder's Bash triage script uses an unquoted log directory variable and misreads files with spaces or wildcard characters. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The playbook remains within quota and produces an explicit unavailable state rather than a fabricated malicious match.
- Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects.
- The workflow reduces toil without allowing uncertain classification to trigger unreviewed account or network disruption.
- Automated routing uses evaluated confidence thresholds and uncertain high-impact actions receive analyst review.
Explanation
Correct Answer
B:Shell word splitting and working directory context can change targets even when the visible command appears harmless. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The playbook remains within quota and produces an explicit unavailable state rather than a fabricated malicious match. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:The workflow reduces toil without allowing uncertain classification to trigger unreviewed account or network disruption. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
D:Automated routing uses evaluated confidence thresholds and uncertain high-impact actions receive analyst review. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Question 1055
An implementation sign-off request identifies the following problem: A responder's Bash triage script uses an unquoted log directory variable and misreads files with spaces or wildcard characters. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Trace the script's parsing, conditional logic and collection operations, using typed decoded event fields for reliable classification. Verify: Run the script against a fixture with successes, failures, missing fields and nested JSON values and compare expected counts.
- Change: Define desired collectors, roles and network policies in reviewed IaC with state, plans and idempotent convergence checks. Verify: Apply the same configuration twice in a sandbox and compare planned diffs, object counts and collection connectivity.
- Change: Use a SOAR case workflow that coordinates enrichments, decisions, tickets and authorized response actions with visible state and handoffs. Verify: Trace one incident through trigger ingestion, contextual enrichment, analyst approval, action outcome and case closure.
- Change: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence. Verify: Run test fixtures with whitespace, unset variables and controlled failures in a disposable directory.
Explanation
Correct Answer
D:Shell word splitting and working directory context can change targets even when the visible command appears harmless. The change is successful only when: Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects.
Incorrect Answers
A:Change: Trace the script's parsing, conditional logic and collection operations, using typed decoded event fields for reliable classification. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
B:Change: Define desired collectors, roles and network policies in reviewed IaC with state, plans and idempotent convergence checks. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:This option addresses a different security operations topic (SOAR orchestration versus isolated automation) rather than the documented Bash log selection and safe file processing decision.
Question 1056
A SOC analyst is examining this cybersecurity operations situation: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path. A proposed shortcut is: Run rm -rf on unvalidated shell variables in the live evidence directory to simplify cleanup. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow.
- Run rm -rf on unvalidated shell variables in the live evidence directory to simplify cleanup.
- Inspect loops, variable scope and exception handling to ensure each indicator yields a distinct success or failure result.
- Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path.
Incorrect Answers
A:Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
B:Shell word splitting and working directory context can change targets even when the visible command appears harmless. Applied case: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path.
C:Inspect loops, variable scope and exception handling to ensure each indicator yields a distinct success or failure result. An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path.
Question 1057
A Cisco cybersecurity incident response review finds: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path. The team proposes: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes.
- Environment variables can configure execution but are not automatically confidential or guaranteed to be present.
- DevOps collaboration improves reliability when code, runbooks and operations telemetry describe the same reviewed deployment.
- Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Explanation
Correct Answer
D:Demonstrable success requires: Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects. Applied case: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path.
Incorrect Answers
A:CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
B:Environment variables can configure execution but are not automatically confidential or guaranteed to be present. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:DevOps collaboration improves reliability when code, runbooks and operations telemetry describe the same reviewed deployment. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Question 1058
The SOC team has not yet approved changes. Current evidence indicates: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Apply the same configuration twice in a sandbox and compare planned diffs, object counts and collection connectivity.
- Run test fixtures with whitespace, unset variables and controlled failures in a disposable directory.
- Test the supported batch threshold and a lost-response case while reconciling actual device action IDs and outcomes.
- Exercise missing and set variable cases while checking permissions, output paths and redacted logs.
Explanation
Correct Answer
B:Shell word splitting and working directory context can change targets even when the visible command appears harmless. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Apply the same configuration twice in a sandbox and compare planned diffs, object counts and collection connectivity. An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path.
C:Test the supported batch threshold and a lost-response case while reconciling actual device action IDs and outcomes. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
D:Exercise missing and set variable cases while checking permissions, output paths and redacted logs. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Question 1059
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects.
- A repeat execution preserves one logical incident and retrieves all permitted enrichment pages.
- Alerts retain correct identifiers, timestamps and indicator attributes after parsing without silent row splitting.
- Every intended authorized device is processed once logically and partial or ambiguous outcomes are surfaced for review.
Explanation
Correct Answer
A:Shell word splitting and working directory context can change targets even when the visible command appears harmless. The approved implementation step was: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
Incorrect Answers
B:A repeat execution preserves one logical incident and retrieves all permitted enrichment pages. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
C:Alerts retain correct identifiers, timestamps and indicator attributes after parsing without silent row splitting. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
D:Every intended authorized device is processed once logically and partial or ambiguous outcomes are surfaced for review. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
Question 1060
For an original CBRCOR educational scenario, consider: An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
- Change: Define desired collectors, roles and network policies in reviewed IaC with state, plans and idempotent convergence checks.
- Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context.
- Check: Run test fixtures with whitespace, unset variables and controlled failures in a disposable directory.
- Run rm -rf on unvalidated shell variables in the live evidence directory to simplify cleanup.
Explanation
Correct Answer
A:Shell word splitting and working directory context can change targets even when the visible command appears harmless. Acceptance: Evidence collection reads the intended files only and rejects unsafe or ambiguous paths without destructive side effects.
D:Shell word splitting and working directory context can change targets even when the visible command appears harmless. Required intervention: Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
Incorrect Answers
B:Change: Define desired collectors, roles and network policies in reviewed IaC with state, plans and idempotent convergence checks. An evidence collection script changes directories implicitly and deletes a similarly named folder because it relies on a relative path.
C:Check: Simulate repeated responses and multiple pages and compare ticket identifiers, unique alert counts and collected context. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Shell word splitting and working directory context can change targets even when the visible command appears harmless.
