Cisco 350-201 Practice Test 22
Question 210
For an original CBRCOR educational scenario, consider: A public virtual machine is exposed on administrative ports, but its owner believes the provider's data-center locks replace guest network controls. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
- Check: Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service.
- Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Leave guest operating systems unpatched because IaaS providers always perform customer application administration.
Explanation
Correct Answer
A:In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility. Acceptance: The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
C:In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility. Required intervention: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
Incorrect Answers
B:Check: Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service. In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility.
D:Change: Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. In IaaS the provider protects underlying cloud infrastructure, but the customer manages guest configuration and workloads under shared responsibility.
Question 211
A SOC analyst is examining this cybersecurity operations situation: Developers deploy secrets into a managed application environment and assume the PaaS provider automatically rotates the customer API keys. A proposed shortcut is: Give all application users full data administration because a managed platform guarantees secure authorization by default. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
- Give all application users full data administration because a managed platform guarantees secure authorization by default.
- Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Incorrect Answers
A:Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
B:Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
C:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 212
A Cisco cybersecurity incident response review finds: Developers deploy secrets into a managed application environment and assume the PaaS provider automatically rotates the customer API keys. The team proposes: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
Explanation
Correct Answer
A:Relevant validation before approval: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix. Demonstrable success requires: Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
Incorrect Answers
B:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
C:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
D:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 213
The SOC team has not yet approved changes. Current evidence indicates: Developers deploy secrets into a managed application environment and assume the PaaS provider automatically rotates the customer API keys. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
- Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
Explanation
Correct Answer
B:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Confirm afterward that: Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
Incorrect Answers
A:Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
C:Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
D:Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 214
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Developers deploy secrets into a managed application environment and assume the PaaS provider automatically rotates the customer API keys. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Each test incident enters the right workflow and has one accountable owner with a traceable escalation path.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
Explanation
Correct Answer
D:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Each test incident enters the right workflow and has one accountable owner with a traceable escalation path. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
B:The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
C:The site serves validated trusted content and the unauthorized change path is closed without losing investigative records. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 215
An implementation sign-off request identifies the following problem: Developers deploy secrets into a managed application environment and assume the PaaS provider automatically rotates the customer API keys. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Verify: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Verify: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Verify: Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Verify: Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
Explanation
Correct Answer
B:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. The change is successful only when: Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
Incorrect Answers
A:Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
C:Change: Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
D:Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 216
A SOC analyst is examining this cybersecurity operations situation: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine. A proposed shortcut is: Give all application users full data administration because a managed platform guarantees secure authorization by default. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Give all application users full data administration because a managed platform guarantees secure authorization by default.
- Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures.
- Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine.
Incorrect Answers
A:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Applied case: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine.
B:Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
D:Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 217
A Cisco cybersecurity incident response review finds: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine. The team proposes: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
- Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
- PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Explanation
Correct Answer
D:Relevant validation before approval: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix. Applied case: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine.
Incorrect Answers
A:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine.
B:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
C:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 218
The SOC team has not yet approved changes. Current evidence indicates: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
Explanation
Correct Answer
B:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:This option addresses a different security operations topic (Privilege-escalation incident playbook) rather than the documented PaaS runtime and data-governance responsibility decision.
C:Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
D:Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine.
Question 219
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
Explanation
Correct Answer
C:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. The approved implementation step was: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
Incorrect Answers
A:This option addresses a different security operations topic (Network monitoring tool selection) rather than the documented PaaS runtime and data-governance responsibility decision.
B:Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
D:The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 220
For an original CBRCOR educational scenario, consider: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Give all application users full data administration because a managed platform guarantees secure authorization by default.
- Check: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
Explanation
Correct Answer
C:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Acceptance: Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
D:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Evidence: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
Incorrect Answers
A:Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
E:Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
