Cisco 350-201 Practice Test 25
Question 240
For an original CBRCOR educational scenario, consider: A threat scoring model trained on office desktops is applied to constrained industrial sensors without testing changes in baseline behavior. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Disable all thresholds and assume any statistical outlier is definitive evidence of compromise.
- Check: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
Explanation
Correct Answer
C:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Required intervention: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
D:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Evidence: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
Incorrect Answers
A:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
E:Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone. Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
Question 241
A SOC analyst is examining this cybersecurity operations situation: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated. A proposed shortcut is: Rely on one manually fixed server while continuing to scale hundreds of systems from the compromised template. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rely on one manually fixed server while continuing to scale hundreds of systems from the compromised template.
- Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
- Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
- Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated.
Incorrect Answers
A:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Validate field names, time windows, event source health and rule conditions, then refine content against representative samples. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 242
A Cisco cybersecurity incident response review finds: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated. The team proposes: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Explanation
Correct Answer
D:Demonstrable success requires: Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision. Applied case: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated.
Incorrect Answers
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
B:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
C:UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 243
The SOC team has not yet approved changes. Current evidence indicates: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
Explanation
Correct Answer
C:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Applied case: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated.
Incorrect Answers
A:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
B:Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:Compare model output with documented source links, DNS events, temporal context and known-benign collisions. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 244
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
- Unnecessary listeners disappear and critical application dependencies and security management continue functioning.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown.
Explanation
Correct Answer
A:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Unnecessary listeners disappear and critical application dependencies and security management continue functioning. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
C:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 245
An implementation sign-off request identifies the following problem: An autoscaling group repeatedly launches VMs with an old web-server package because the base image pipeline was never updated. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. Verify: Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Change: Tailor dashboards to stakeholder decisions using incident severity, asset exposure, response outcomes and contextual trends. Verify: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Change: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline. Verify: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
Explanation
Correct Answer
D:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. The change is successful only when: Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
Incorrect Answers
A:Change: Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture.
B:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented Golden machine image hardening decision.
C:Change: Tailor dashboards to stakeholder decisions using incident severity, asset exposure, response outcomes and contextual trends. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 246
A SOC analyst is examining this cybersecurity operations situation: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service. A proposed shortcut is: Rely on one manually fixed server while continuing to scale hundreds of systems from the compromised template. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
- Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
- Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
- Rely on one manually fixed server while continuing to scale hundreds of systems from the compromised template.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service.
Incorrect Answers
A:Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
B:Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Applied case: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service.
Question 247
A Cisco cybersecurity incident response review finds: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service. The team proposes: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
- Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Explanation
Correct Answer
C:Demonstrable success requires: Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision. Applied case: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service.
Incorrect Answers
A:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
B:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 248
The SOC team has not yet approved changes. Current evidence indicates: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
- Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
Explanation
Correct Answer
D:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Confirm afterward that: Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
Incorrect Answers
A:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
B:Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
C:Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
Question 249
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed.
- Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
- Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
Explanation
Correct Answer
C:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. The approved implementation step was: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
Incorrect Answers
A:High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
B:Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service.
Question 250
For an original CBRCOR educational scenario, consider: A cloud team manually patches one running instance while its immutable image template still contains an exposed administrative service. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Change: Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Rely on one manually fixed server while continuing to scale hundreds of systems from the compromised template.
- Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
Explanation
Correct Answer
A:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Acceptance: Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
B:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Evidence: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
Incorrect Answers
C:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
E:Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
