Cisco 350-201 Practice Test 16
Question 150
For an original CBRCOR educational scenario, consider: A compromised endpoint is isolated, but responders omit communication and lessons learned after restoring the user to service. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Mark all incidents finished as soon as an EDR sensor reports successful network isolation.
- Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
Explanation
Correct Answer
C:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Acceptance: The case can be audited from initial alert through validated recovery and documented corrective action.
E:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Evidence: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
Incorrect Answers
A:Check: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
B:Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
Question 151
A SOC analyst is examining this cybersecurity operations situation: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account. A proposed shortcut is: Either shut down every connected service or refuse all containment until a quarterly governance meeting occurs. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Either shut down every connected service or refuse all containment until a quarterly governance meeting occurs.
- Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
- Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
- Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account.
Incorrect Answers
A:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
D:Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 152
A Cisco cybersecurity incident response review finds: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account. The team proposes: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
- Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
- Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review.
Explanation
Correct Answer
B:Demonstrable success requires: Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. Applied case: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account.
Incorrect Answers
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
D:Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 153
The SOC team has not yet approved changes. Current evidence indicates: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
Explanation
Correct Answer
D:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Applied case: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account.
Incorrect Answers
A:This option addresses a different security operations topic (Playbook triggers and owners) rather than the documented Proportionate containment authorization decision.
B:Review control test evidence, exception scope, business-owner authorization and review date against the documented threat. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 154
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
- Business functions recover and previously observed malicious access paths fail under documented checks.
Explanation
Correct Answer
C:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
B:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
D:Business functions recover and previously observed malicious access paths fail under documented checks. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 155
An implementation sign-off request identifies the following problem: A false-positive data-transfer alert triggers a proposed shutdown of a busy production billing database without confirming the affected account. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Verify: Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Verify: Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Verify: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
Explanation
Correct Answer
A:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. The change is successful only when: Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
Incorrect Answers
B:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
D:This option addresses a different security operations topic (Cyber insurance risk transfer) rather than the documented Proportionate containment authorization decision.
Question 156
A SOC analyst is examining this cybersecurity operations situation: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible. A proposed shortcut is: Either shut down every connected service or refuse all containment until a quarterly governance meeting occurs. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
- Either shut down every connected service or refuse all containment until a quarterly governance meeting occurs.
- Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
- Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible.
Incorrect Answers
A:Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible.
B:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Applied case: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible.
C:Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 157
A Cisco cybersecurity incident response review finds: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible. The team proposes: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
- In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review.
Explanation
Correct Answer
A:Demonstrable success requires: Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. Applied case: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible.
Incorrect Answers
B:In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:This option addresses a different security operations topic (Incident response lifecycle and documentation) rather than the documented Proportionate containment authorization decision.
D:Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review. A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible.
Question 158
The SOC team has not yet approved changes. Current evidence indicates: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
Explanation
Correct Answer
A:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Confirm afterward that: Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
Incorrect Answers
B:Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
D:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 159
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
Explanation
Correct Answer
C:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. The approved implementation step was: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
Incorrect Answers
A:Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
B:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
D:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible.
Question 160
For an original CBRCOR educational scenario, consider: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Either shut down every connected service or refuse all containment until a quarterly governance meeting occurs.
- Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Check: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Check: Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
Explanation
Correct Answer
B:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Acceptance: Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
E:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Required intervention: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:This option addresses a different security operations topic (PaaS runtime and data-governance responsibility) rather than the documented Proportionate containment authorization decision.
D:Check: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
