Cisco 350-201 Practice Test 18
Question 170
For an original CBRCOR educational scenario, consider: A compromised web workload is rebuilt from a golden image yet the same insecure deployment secret is left in its CI pipeline. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Declare recovery complete solely because the application homepage loads successfully after redeployment.
- Check: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Change: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
Explanation
Correct Answer
D:Required intervention: Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
E:Evidence: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
Incorrect Answers
A:Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
B:Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
Question 171
A SOC analyst is examining this cybersecurity operations situation: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise. A proposed shortcut is: Report only the fastest incidents and label acknowledgment latency as time from initial compromise to full recovery. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
- Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
- Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Report only the fastest incidents and label acknowledgment latency as time from initial compromise to full recovery.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise.
Incorrect Answers
A:Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
D:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 172
A Cisco cybersecurity incident response review finds: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise. The team proposes: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
- GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
- Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Explanation
Correct Answer
A:Demonstrable success requires: Trend metrics identify the specific stage that slows response and are reproducible from incident evidence. Applied case: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise.
Incorrect Answers
B:GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
C:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
D:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 173
The SOC team has not yet approved changes. Current evidence indicates: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
Explanation
Correct Answer
C:This check tests the actual security, identity or operational boundary before an operationally risky response. Applied case: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise.
Incorrect Answers
A:Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
D:Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 174
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Trend metrics identify the specific stage that slows response and are reproducible from incident evidence.
- The rule reduces avoidable work without unacceptable loss of validated malicious cases.
Explanation
Correct Answer
C:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. Applied case: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise.
Incorrect Answers
A:The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
D:The rule reduces avoidable work without unacceptable loss of validated malicious cases. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 175
An implementation sign-off request identifies the following problem: SOC dashboards show a low alert acknowledgment time but ransomware is often detected many hours after initial compromise. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Verify: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Verify: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Verify: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
Explanation
Correct Answer
D:The change is successful only when: Trend metrics identify the specific stage that slows response and are reproducible from incident evidence.
Incorrect Answers
A:Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
C:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 176
A SOC analyst is examining this cybersecurity operations situation: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark. A proposed shortcut is: Report only the fastest incidents and label acknowledgment latency as time from initial compromise to full recovery. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
- Report only the fastest incidents and label acknowledgment latency as time from initial compromise to full recovery.
- Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
Incorrect Answers
A:Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. Applied case: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
D:Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 177
A Cisco cybersecurity incident response review finds: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark. The team proposes: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
- GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
Explanation
Correct Answer
C:Demonstrable success requires: Trend metrics identify the specific stage that slows response and are reproducible from incident evidence. Applied case: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
Incorrect Answers
A:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
B:GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls. A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
D:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 178
The SOC team has not yet approved changes. Current evidence indicates: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
Explanation
Correct Answer
C:This check tests the actual security, identity or operational boundary before an operationally risky response. Applied case: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
Incorrect Answers
A:Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
D:Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 179
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Trend metrics identify the specific stage that slows response and are reproducible from incident evidence.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
Explanation
Correct Answer
A:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
C:The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards. A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
D:The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
Question 180
For an original CBRCOR educational scenario, consider: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures.
- Report only the fastest incidents and label acknowledgment latency as time from initial compromise to full recovery.
- Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Check: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
Explanation
Correct Answer
D:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. Evidence: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
E:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. Required intervention: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
Incorrect Answers
A:Change: Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A manager reports mean time to contain but excludes incidents that exceed service-level targets, distorting the response benchmark.
C:Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
