Cisco 350-201 Practice Test 13
Question 120
For an original CBRCOR educational scenario, consider: A ransomware incident incurs downtime and investigation costs but the company assumes all expenses are automatically insured regardless of exclusions. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
- Check: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Check: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Disable monitoring and backups because having an insurance contract guarantees every incident cost will be paid.
Explanation
Correct Answer
B:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Evidence: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
C:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Required intervention: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
Incorrect Answers
A:Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
D:Check: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Question 121
A SOC analyst is examining this cybersecurity operations situation: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS. A proposed shortcut is: Assign identical operational risk to every host running the vulnerable library regardless of reachability or impact. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
- Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
- Assign identical operational risk to every host running the vulnerable library regardless of reachability or impact.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS.
Incorrect Answers
B:Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
D:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 122
A Cisco cybersecurity incident response review finds: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS. The team proposes: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Explanation
Correct Answer
B:Demonstrable success requires: The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. This principle explains the proposed technical approach, which is: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
Incorrect Answers
A:This option addresses a different security operations topic (Incident response lifecycle and documentation) rather than the documented Asset threat vulnerability risk analysis decision.
C:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
D:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Question 123
The SOC team has not yet approved changes. Current evidence indicates: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
- Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Re-run a labeled set of benign and malicious activity against the rule and review precision, recall and handling effort.
Explanation
Correct Answer
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Applied case: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS.
Incorrect Answers
B:Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
D:Re-run a labeled set of benign and malicious activity against the rule and review precision, recall and handling effort. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Question 124
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
- The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
Explanation
Correct Answer
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. The approved implementation step was: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
Incorrect Answers
B:The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:This option addresses a different security operations topic (Network monitoring tool selection) rather than the documented Asset threat vulnerability risk analysis decision.
D:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Question 125
An implementation sign-off request identifies the following problem: A public-facing payroll server has a critical reachable flaw and direct access to sensitive personal data, but a scoring sheet considers only CVSS. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Verify: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Change: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Verify: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Verify: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Verify: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
Explanation
Correct Answer
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. The change is successful only when: The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
Incorrect Answers
B:Change: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:This option addresses a different security operations topic (Forensic tool selection for endpoint evidence) rather than the documented Asset threat vulnerability risk analysis decision.
D:Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Question 126
A SOC analyst is examining this cybersecurity operations situation: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure. A proposed shortcut is: Assign identical operational risk to every host running the vulnerable library regardless of reachability or impact. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Assign identical operational risk to every host running the vulnerable library regardless of reachability or impact.
- Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
- Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
Incorrect Answers
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Use this instead: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
C:Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
D:Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
Question 127
A Cisco cybersecurity incident response review finds: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure. The team proposes: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
- Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Explanation
Correct Answer
D:Demonstrable success requires: The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. Applied case: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
Incorrect Answers
A:This option addresses a different security operations topic (PaaS runtime and data-governance responsibility) rather than the documented Asset threat vulnerability risk analysis decision.
B:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
Question 128
The SOC team has not yet approved changes. Current evidence indicates: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
Explanation
Correct Answer
C:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Applied case: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
Incorrect Answers
A:Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
B:Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
D:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Question 129
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
- Business functions recover and previously observed malicious access paths fail under documented checks.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
- The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments.
Explanation
Correct Answer
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Business functions recover and previously observed malicious access paths fail under documented checks. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
D:The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments. A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure.
Question 130
For an original CBRCOR educational scenario, consider: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Assign identical operational risk to every host running the vulnerable library regardless of reachability or impact.
- Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
- Check: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
Explanation
Correct Answer
B:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Acceptance: The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
D:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Required intervention: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
E:Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
