Cisco 350-201 Practice Test 12
Question 110
For an original CBRCOR educational scenario, consider: A procurement reviewer interprets a SOC 2 report as proof that the supplier has no legal data-privacy duties anywhere. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
- Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Apply a SOX financial signoff alone to all personal-data processing and omit privacy review.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
Explanation
Correct Answer
A:Acceptance: Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. Applied case: A procurement reviewer interprets a SOC 2 report as proof that the supplier has no legal data-privacy duties anywhere.
E:Acceptance: Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
Incorrect Answers
B:Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
C:Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM. GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
D:GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls. Distinguish the two approaches by checking: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
Question 111
A SOC analyst is examining this cybersecurity operations situation: Leadership proposes replacing endpoint detection and tested backups with a cyber insurance policy that might reimburse some losses. A proposed shortcut is: Disable monitoring and backups because having an insurance contract guarantees every incident cost will be paid. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
- Disable monitoring and backups because having an insurance contract guarantees every incident cost will be paid.
- Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
- Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Incorrect Answers
A:Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
B:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 112
A Cisco cybersecurity incident response review finds: Leadership proposes replacing endpoint detection and tested backups with a cyber insurance policy that might reimburse some losses. The team proposes: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
- Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- Deployment model describes hosting and governance boundaries, while multicloud describes use of more than one provider and can coexist with hybrid.
Explanation
Correct Answer
B:Relevant validation before approval: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. This principle explains the proposed technical approach, which is: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Incorrect Answers
A:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
C:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Deployment model describes hosting and governance boundaries, while multicloud describes use of more than one provider and can coexist with hybrid. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 113
The SOC team has not yet approved changes. Current evidence indicates: Leadership proposes replacing endpoint detection and tested backups with a cyber insurance policy that might reimburse some losses. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
Explanation
Correct Answer
A:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. If confirmed, the proportionate intervention is: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Incorrect Answers
B:Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
C:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 114
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Leadership proposes replacing endpoint detection and tested backups with a cyber insurance policy that might reimburse some losses. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments.
- Business functions recover and previously observed malicious access paths fail under documented checks.
Explanation
Correct Answer
B:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. The approved implementation step was: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Incorrect Answers
A:Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
C:The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Business functions recover and previously observed malicious access paths fail under documented checks. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 115
An implementation sign-off request identifies the following problem: Leadership proposes replacing endpoint detection and tested backups with a cyber insurance policy that might reimburse some losses. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Verify: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Verify: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Verify: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
Explanation
Correct Answer
D:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. The change is successful only when: The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
Incorrect Answers
A:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
B:Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
C:Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 116
A SOC analyst is examining this cybersecurity operations situation: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions. A proposed shortcut is: Disable monitoring and backups because having an insurance contract guarantees every incident cost will be paid. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Disable monitoring and backups because having an insurance contract guarantees every incident cost will be paid.
- Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions.
Incorrect Answers
A:Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
B:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Use this instead: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
C:Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 117
A Cisco cybersecurity incident response review finds: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions. The team proposes: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
- Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Explanation
Correct Answer
D:Relevant validation before approval: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. Applied case: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions.
Incorrect Answers
A:In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
B:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
C:Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 118
The SOC team has not yet approved changes. Current evidence indicates: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
Explanation
Correct Answer
A:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Applied case: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions.
Incorrect Answers
B:Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
C:Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 119
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- Trend metrics identify the specific stage that slows response and are reproducible from incident evidence.
Explanation
Correct Answer
A:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use. A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions.
C:Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Trend metrics identify the specific stage that slows response and are reproducible from incident evidence. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 120
For an original CBRCOR educational scenario, consider: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
- Check: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Check: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Disable monitoring and backups because having an insurance contract guarantees every incident cost will be paid.
Explanation
Correct Answer
B:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Evidence: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
C:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Required intervention: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Incorrect Answers
A:Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Check: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
