Cisco 350-201 Practice Test 15
Question 140
For an original CBRCOR educational scenario, consider: A highly available application gets a temporary firewall restriction, but no owner measures residual exploitability or expiration of the exception. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Close the risk register entry permanently because a senior manager signed an undocumented exception.
- Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Check: Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
Explanation
Correct Answer
C:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Acceptance: The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
D:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Required intervention: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
B:Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
E:Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
Question 141
A SOC analyst is examining this cybersecurity operations situation: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation. A proposed shortcut is: Mark all incidents finished as soon as an EDR sensor reports successful network isolation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Mark all incidents finished as soon as an EDR sensor reports successful network isolation.
- Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
- Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation.
Incorrect Answers
A:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 142
A Cisco cybersecurity incident response review finds: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation. The team proposes: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility.
Explanation
Correct Answer
B:Demonstrable success requires: The case can be audited from initial alert through validated recovery and documented corrective action. Applied case: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation.
Incorrect Answers
A:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
C:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 143
The SOC team has not yet approved changes. Current evidence indicates: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
Explanation
Correct Answer
B:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Applied case: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation.
Incorrect Answers
A:Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
C:Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 144
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case can be audited from initial alert through validated recovery and documented corrective action.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
Explanation
Correct Answer
A:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:This option addresses a different security operations topic (Risk treatment and residual acceptance) rather than the documented Incident response lifecycle and documentation decision.
C:Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 145
An implementation sign-off request identifies the following problem: A security team jumps directly to recovery after a phishing report without triage, evidence preservation or root-cause investigation. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Verify: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Verify: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Verify: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Verify: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
Explanation
Correct Answer
C:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. The change is successful only when: The case can be audited from initial alert through validated recovery and documented corrective action.
Incorrect Answers
A:Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
B:Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 146
A SOC analyst is examining this cybersecurity operations situation: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service. A proposed shortcut is: Mark all incidents finished as soon as an EDR sensor reports successful network isolation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
- Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
- Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures.
- Mark all incidents finished as soon as an EDR sensor reports successful network isolation.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service.
Incorrect Answers
B:Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
C:Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Applied case: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service.
Question 147
A Cisco cybersecurity incident response review finds: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service. The team proposes: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
Explanation
Correct Answer
C:Demonstrable success requires: The case can be audited from initial alert through validated recovery and documented corrective action. Applied case: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service.
Incorrect Answers
A:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
B:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service.
D:This option addresses a different security operations topic (Network monitoring tool selection) rather than the documented Incident response lifecycle and documentation decision.
Question 148
The SOC team has not yet approved changes. Current evidence indicates: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
Explanation
Correct Answer
D:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Confirm afterward that: The case can be audited from initial alert through validated recovery and documented corrective action.
Incorrect Answers
A:Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
B:Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
C:This option addresses a different security operations topic (Website-defacement response workflow) rather than the documented Incident response lifecycle and documentation decision.
Question 149
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
- Each test incident enters the right workflow and has one accountable owner with a traceable escalation path.
- The case can be audited from initial alert through validated recovery and documented corrective action.
- Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report.
Explanation
Correct Answer
C:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. The approved implementation step was: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
Incorrect Answers
A:Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract. A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service.
B:This option addresses a different security operations topic (Playbook triggers and owners) rather than the documented Incident response lifecycle and documentation decision.
D:Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 150
For an original CBRCOR educational scenario, consider: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Mark all incidents finished as soon as an EDR sensor reports successful network isolation.
- Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
Explanation
Correct Answer
C:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Acceptance: The case can be audited from initial alert through validated recovery and documented corrective action.
E:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Evidence: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
Incorrect Answers
A:Check: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
B:Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
