Cisco 350-201 Practice Test 17
Question 160
For an original CBRCOR educational scenario, consider: A confirmed malicious process continues outbound communication while responders debate whether any network isolation is permissible. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Either shut down every connected service or refuse all containment until a quarterly governance meeting occurs.
- Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Check: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Check: Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
Explanation
Correct Answer
B:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Acceptance: Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
E:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Required intervention: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
C:This option addresses a different security operations topic (PaaS runtime and data-governance responsibility) rather than the documented Proportionate containment authorization decision.
D:Check: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls. Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Question 161
A SOC analyst is examining this cybersecurity operations situation: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment. A proposed shortcut is: Declare recovery complete solely because the application homepage loads successfully after redeployment. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Declare recovery complete solely because the application homepage loads successfully after redeployment.
- Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment.
Incorrect Answers
A:Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment.
C:Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 162
A Cisco cybersecurity incident response review finds: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment. The team proposes: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Explanation
Correct Answer
B:Demonstrable success requires: Business functions recover and previously observed malicious access paths fail under documented checks. Applied case: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment.
Incorrect Answers
A:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
C:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
D:Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 163
The SOC team has not yet approved changes. Current evidence indicates: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
Explanation
Correct Answer
D:Confirm afterward that: Business functions recover and previously observed malicious access paths fail under documented checks. Applied case: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment.
Incorrect Answers
A:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
C:Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 164
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
- Business functions recover and previously observed malicious access paths fail under documented checks.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
Explanation
Correct Answer
C:The approved implementation step was: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Applied case: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment.
Incorrect Answers
A:Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
D:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 165
An implementation sign-off request identifies the following problem: A server is restored from backup but a stolen administrator token remains active and immediately reopens access to the environment. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Verify: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Verify: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Verify: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. Verify: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
Explanation
Correct Answer
A:The change is successful only when: Business functions recover and previously observed malicious access paths fail under documented checks.
Incorrect Answers
B:Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
C:Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
D:Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 166
A SOC analyst is examining this cybersecurity operations situation: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline. A proposed shortcut is: Declare recovery complete solely because the application homepage loads successfully after redeployment. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Declare recovery complete solely because the application homepage loads successfully after redeployment.
- Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
- Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
- Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. The required acceptance condition is: Business functions recover and previously observed malicious access paths fail under documented checks.
Incorrect Answers
A:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
D:Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 167
A Cisco cybersecurity incident response review finds: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline. The team proposes: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- Deployment model describes hosting and governance boundaries, while multicloud describes use of more than one provider and can coexist with hybrid.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Explanation
Correct Answer
D:Demonstrable success requires: Business functions recover and previously observed malicious access paths fail under documented checks. This principle explains the proposed technical approach, which is: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
Incorrect Answers
A:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:This option addresses a different security operations topic (Private public hybrid and multicloud boundaries) rather than the documented Recovery validation and recurrence prevention decision.
C:This option addresses a different security operations topic (Network monitoring tool selection) rather than the documented Recovery validation and recurrence prevention decision.
Question 168
The SOC team has not yet approved changes. Current evidence indicates: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
- Review control test evidence, exception scope, business-owner authorization and review date against the documented threat.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
Explanation
Correct Answer
C:Confirm afterward that: Business functions recover and previously observed malicious access paths fail under documented checks. Applied case: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline.
Incorrect Answers
A:Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:Review control test evidence, exception scope, business-owner authorization and review date against the documented threat. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
D:Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 169
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Business functions recover and previously observed malicious access paths fail under documented checks.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
- Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report.
Explanation
Correct Answer
A:The approved implementation step was: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
C:The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
D:Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 170
For an original CBRCOR educational scenario, consider: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Declare recovery complete solely because the application homepage loads successfully after redeployment.
- Check: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Change: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
Explanation
Correct Answer
D:Required intervention: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
E:Evidence: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
Incorrect Answers
A:Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
