Cisco 350-201 Practice Test 2
Question 10
For an original CBRCOR educational scenario, consider: An overnight alert escalates to two teams because the playbook does not say which responder can authorize containment. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook.
- Let every analyst independently choose severity and shut down production without recording an approval.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Check: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Check: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
Explanation
Correct Answer
A:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Evidence: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
D:A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision. Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
C:Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
E:Check: Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. A playbook is actionable when its triggers, permissions and handoffs tell responders who makes each decision.
Question 11
A SOC analyst is examining this cybersecurity operations situation: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host. A proposed shortcut is: Delete host artifacts and clear all alerts immediately after the first blocking rule is applied. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
- Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
- Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Delete host artifacts and clear all alerts immediately after the first blocking rule is applied.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host.
Incorrect Answers
B:Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
C:Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
D:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 12
A Cisco cybersecurity incident response review finds: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host. The team proposes: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Explanation
Correct Answer
C:Demonstrable success requires: Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed. Applied case: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host.
Incorrect Answers
A:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
B:Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
D:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 13
The SOC team has not yet approved changes. Current evidence indicates: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
Explanation
Correct Answer
A:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Applied case: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host.
Incorrect Answers
B:Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
C:Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
D:Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 14
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Trend metrics identify the specific stage that slows response and are reproducible from incident evidence.
- Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
- Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
Explanation
Correct Answer
D:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Trend metrics identify the specific stage that slows response and are reproducible from incident evidence. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
B:Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
C:The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 15
An implementation sign-off request identifies the following problem: A ransomware runbook lists isolation steps but does not identify which evidence to preserve before reimaging a host. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Verify: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Verify: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Verify: Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Verify: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
Explanation
Correct Answer
B:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. The change is successful only when: Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
Incorrect Answers
A:Change: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
C:Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
D:Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 16
A SOC analyst is examining this cybersecurity operations situation: An incident is declared closed as soon as an IP is blocked even though validation and recovery criteria are absent. A proposed shortcut is: Delete host artifacts and clear all alerts immediately after the first blocking rule is applied. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Delete host artifacts and clear all alerts immediately after the first blocking rule is applied.
- Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
- Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Incorrect Answers
A:Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
B:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Use this instead: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
C:Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 17
A Cisco cybersecurity incident response review finds: An incident is declared closed as soon as an IP is blocked even though validation and recovery criteria are absent. The team proposes: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Explanation
Correct Answer
C:Demonstrable success requires: Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed. This principle explains the proposed technical approach, which is: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
Incorrect Answers
A:Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
B:This option addresses a different security operations topic (Government compliance mapping) rather than the documented Playbook evidence and recovery gates decision.
D:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 18
The SOC team has not yet approved changes. Current evidence indicates: An incident is declared closed as soon as an IP is blocked even though validation and recovery criteria are absent. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
Explanation
Correct Answer
C:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Confirm afterward that: Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
Incorrect Answers
A:Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
B:Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
D:Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 19
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An incident is declared closed as soon as an IP is blocked even though validation and recovery criteria are absent. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case can be audited from initial alert through validated recovery and documented corrective action.
- Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
- Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
Explanation
Correct Answer
B:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Applied case: An incident is declared closed as soon as an IP is blocked even though validation and recovery criteria are absent.
Incorrect Answers
A:The case can be audited from initial alert through validated recovery and documented corrective action. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
C:Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
D:Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Question 20
For an original CBRCOR educational scenario, consider: An incident is declared closed as soon as an IP is blocked even though validation and recovery criteria are absent. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
- Check: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Delete host artifacts and clear all alerts immediately after the first blocking rule is applied.
Explanation
Correct Answer
C:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Acceptance: Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
D:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Required intervention: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
Incorrect Answers
A:Check: Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
B:Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
