Cisco 350-201 Practice Test 23
Question 220
For an original CBRCOR educational scenario, consider: A managed database receives overly broad customer role grants even though the provider is responsible for operating its database engine. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Give all application users full data administration because a managed platform guarantees secure authorization by default.
- Check: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
Explanation
Correct Answer
C:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Acceptance: Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
D:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Evidence: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
Incorrect Answers
A:Check: Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
E:Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Question 221
A SOC analyst is examining this cybersecurity operations situation: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events. A proposed shortcut is: Let a natural-language model's confidence sentence automatically authorize isolation of every device. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
- Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Let a natural-language model's confidence sentence automatically authorize isolation of every device.
- Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events.
Incorrect Answers
A:Validate field names, time windows, event source health and rule conditions, then refine content against representative samples. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 222
A Cisco cybersecurity incident response review finds: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events. The team proposes: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Explanation
Correct Answer
D:Demonstrable success requires: Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion. This principle explains the proposed technical approach, which is: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
Incorrect Answers
A:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
B:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 223
The SOC team has not yet approved changes. Current evidence indicates: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
Explanation
Correct Answer
C:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Applied case: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events.
Incorrect Answers
A:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
B:Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
D:Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 224
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
- Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
Explanation
Correct Answer
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. The approved implementation step was: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
Incorrect Answers
A:Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
B:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 225
An implementation sign-off request identifies the following problem: A SOC team uses a model-generated incident summary to quarantine an executive laptop without reviewing supporting sensor events. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Verify: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Verify: Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Verify: Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
Explanation
Correct Answer
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. The change is successful only when: Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
Incorrect Answers
A:Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
B:Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
C:Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
Question 226
A SOC analyst is examining this cybersecurity operations situation: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs. A proposed shortcut is: Let a natural-language model's confidence sentence automatically authorize isolation of every device. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Let a natural-language model's confidence sentence automatically authorize isolation of every device.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs.
Incorrect Answers
A:Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Use this instead: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
Question 227
A Cisco cybersecurity incident response review finds: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs. The team proposes: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance.
- Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Explanation
Correct Answer
C:Demonstrable success requires: Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion. Applied case: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs.
Incorrect Answers
A:Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
B:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
D:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 228
The SOC team has not yet approved changes. Current evidence indicates: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
Explanation
Correct Answer
C:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Applied case: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs.
Incorrect Answers
A:Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
B:Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
D:Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 229
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
- Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
Explanation
Correct Answer
A:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Key identity and network fields preserve meaning and collection failures produce explicit health alerts. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
D:The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 230
For an original CBRCOR educational scenario, consider: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Let a natural-language model's confidence sentence automatically authorize isolation of every device.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
Explanation
Correct Answer
A:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Required intervention: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Acceptance: Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
E:Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
