Cisco 350-201 Practice Test 24
Question 230
For an original CBRCOR educational scenario, consider: A security copilot classifies every new command-line alert as malicious because the training set excludes common maintenance jobs. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Let a natural-language model's confidence sentence automatically authorize isolation of every device.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
Explanation
Correct Answer
A:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Required intervention: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Acceptance: Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
C:Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
E:Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Question 231
A SOC analyst is examining this cybersecurity operations situation: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms. A proposed shortcut is: Disable all thresholds and assume any statistical outlier is definitive evidence of compromise. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Disable all thresholds and assume any statistical outlier is definitive evidence of compromise.
- Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms.
Incorrect Answers
A:Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 232
A Cisco cybersecurity incident response review finds: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms. The team proposes: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance.
- TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
- Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Explanation
Correct Answer
D:Demonstrable success requires: Detection quality remains measured across representative groups with investigated drift and bounded alert noise. Applied case: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms.
Incorrect Answers
A:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
C:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 233
The SOC team has not yet approved changes. Current evidence indicates: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
Explanation
Correct Answer
C:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Applied case: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms.
Incorrect Answers
A:Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
D:Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 234
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
- Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality.
Explanation
Correct Answer
C:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
D:Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 235
An implementation sign-off request identifies the following problem: An unsupervised model learns normal overnight administration but a new batch schedule changes login patterns and triggers thousands of false alarms. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline. Verify: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Verify: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Verify: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
Explanation
Correct Answer
D:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. The change is successful only when: Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
Incorrect Answers
A:Change: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
B:Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
C:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented Anomaly model drift and validation decision.
Question 236
A SOC analyst is examining this cybersecurity operations situation: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior. A proposed shortcut is: Disable all thresholds and assume any statistical outlier is definitive evidence of compromise. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
- Disable all thresholds and assume any statistical outlier is definitive evidence of compromise.
- Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior.
Incorrect Answers
B:Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
C:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Applied case: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior.
D:Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 237
A Cisco cybersecurity incident response review finds: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior. The team proposes: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Explanation
Correct Answer
A:Demonstrable success requires: Detection quality remains measured across representative groups with investigated drift and bounded alert noise. Applied case: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior.
Incorrect Answers
B:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
C:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
D:This option addresses a different security operations topic (MITRE ATT&CK tactics versus techniques) rather than the documented Anomaly model drift and validation decision.
Question 238
The SOC team has not yet approved changes. Current evidence indicates: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
Explanation
Correct Answer
D:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare raw sample events with normalized user, source IP, action, timestamp and device fields. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
C:Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 239
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
- Only approved management origins reach administrative services and unexpected attempts are logged.
- Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
Explanation
Correct Answer
A:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. The approved implementation step was: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
Incorrect Answers
B:Only approved management origins reach administrative services and unexpected attempts are logged. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
C:Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
D:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 240
For an original CBRCOR educational scenario, consider: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Disable all thresholds and assume any statistical outlier is definitive evidence of compromise.
- Check: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
Explanation
Correct Answer
C:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Required intervention: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
D:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Evidence: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
Incorrect Answers
A:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
E:Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
