Cisco 350-201 Practice Test 14
Question 130
For an original CBRCOR educational scenario, consider: A test VM has the same published software vulnerability as a production identity server but no external reachability or material data exposure. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Assign identical operational risk to every host running the vulnerable library regardless of reachability or impact.
- Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
- Check: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
Explanation
Correct Answer
B:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Acceptance: The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
D:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Required intervention: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
C:Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
E:Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Question 131
A SOC analyst is examining this cybersecurity operations situation: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure. A proposed shortcut is: Close the risk register entry permanently because a senior manager signed an undocumented exception. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy.
- Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
- Close the risk register entry permanently because a senior manager signed an undocumented exception.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure.
Incorrect Answers
B:Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
C:Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 132
A Cisco cybersecurity incident response review finds: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure. The team proposes: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Deployment model describes hosting and governance boundaries, while multicloud describes use of more than one provider and can coexist with hybrid.
- Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Explanation
Correct Answer
B:Demonstrable success requires: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. This principle explains the proposed technical approach, which is: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
Incorrect Answers
A:This option addresses a different security operations topic (Private public hybrid and multicloud boundaries) rather than the documented Risk treatment and residual acceptance decision.
C:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
Question 133
The SOC team has not yet approved changes. Current evidence indicates: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
Explanation
Correct Answer
A:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Applied case: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure.
Incorrect Answers
B:Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
C:Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
Question 134
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
- The rule reduces avoidable work without unacceptable loss of validated malicious cases.
Explanation
Correct Answer
A:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. The approved implementation step was: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
Incorrect Answers
B:Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
C:Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:The rule reduces avoidable work without unacceptable loss of validated malicious cases. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
Question 135
An implementation sign-off request identifies the following problem: A legacy clinical device cannot accept a patch, yet the owner signs an acceptance form without documenting its network exposure. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Verify: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Verify: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Verify: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Verify: Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
Explanation
Correct Answer
D:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. The change is successful only when: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
Incorrect Answers
A:Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
B:Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
C:Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
Question 136
A SOC analyst is examining this cybersecurity operations situation: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception. A proposed shortcut is: Close the risk register entry permanently because a senior manager signed an undocumented exception. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
- Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook.
- Close the risk register entry permanently because a senior manager signed an undocumented exception.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception.
Incorrect Answers
B:Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
C:Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Use this instead: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
Question 137
A Cisco cybersecurity incident response review finds: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception. The team proposes: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
- A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Explanation
Correct Answer
A:Demonstrable success requires: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Applied case: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception.
Incorrect Answers
B:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception.
C:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
Question 138
The SOC team has not yet approved changes. Current evidence indicates: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
Explanation
Correct Answer
B:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Applied case: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception.
Incorrect Answers
A:This option addresses a different security operations topic (DoS and DDoS response playbook) rather than the documented Risk treatment and residual acceptance decision.
C:Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception.
D:This option addresses a different security operations topic (Website-defacement response workflow) rather than the documented Risk treatment and residual acceptance decision.
Question 139
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
- The rule reduces avoidable work without unacceptable loss of validated malicious cases.
Explanation
Correct Answer
B:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
C:The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
D:The rule reduces avoidable work without unacceptable loss of validated malicious cases. A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception.
Question 140
For an original CBRCOR educational scenario, consider: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Close the risk register entry permanently because a senior manager signed an undocumented exception.
- Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Check: Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
Explanation
Correct Answer
C:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Acceptance: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
D:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Required intervention: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
B:Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
E:Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
