Cisco 350-201 Practice Test 27
Question 260
For an original CBRCOR educational scenario, consider: A business-critical IoT gateway is omitted from scanning because it rarely appears in user login records. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
- Check: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Change: Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture.
- Check: Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Declare unobserved assets secure solely because the SIEM has never received an event from them.
Explanation
Correct Answer
C:Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance. Evidence: Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
D:Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance. Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
Incorrect Answers
A:Change: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone. Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance.
B:Check: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval. Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance.
Question 261
A SOC analyst is examining this cybersecurity operations situation: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally. A proposed shortcut is: Treat one successful perimeter penetration test as proof that internal identity and east-west controls are complete. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat one successful perimeter penetration test as proof that internal identity and east-west controls are complete.
- Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally.
Incorrect Answers
A:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
C:Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 262
A Cisco cybersecurity incident response review finds: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally. The team proposes: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
- A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
- Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Explanation
Correct Answer
D:Relevant validation before approval: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results. Applied case: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally.
Incorrect Answers
A:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
B:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
C:A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency. A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally.
Question 263
The SOC team has not yet approved changes. Current evidence indicates: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Compare active sockets, installed packages, process owners, business requirements and access rules before and after change.
Explanation
Correct Answer
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. Applied case: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally.
Incorrect Answers
A:Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
B:This option addresses a different security operations topic (DNS and TLS metadata in PCAP) rather than the documented Control efficacy against an attack path decision.
D:This option addresses a different security operations topic (Unnecessary services and listening ports) rather than the documented Control efficacy against an attack path decision.
Question 264
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
- Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- False positives decline while validated attack detections and evidence quality remain acceptable.
- True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
Explanation
Correct Answer
B:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Key identity and network fields preserve meaning and collection failures produce explicit health alerts. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
C:False positives decline while validated attack detections and evidence quality remain acceptable. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
D:True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 265
An implementation sign-off request identifies the following problem: A company claims lateral movement is blocked by a perimeter firewall while workstations freely reach database administrative ports internally. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Verify: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Verify: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Verify: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Verify: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
Explanation
Correct Answer
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. The change is successful only when: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
Incorrect Answers
A:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
B:Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
D:Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 266
A SOC analyst is examining this cybersecurity operations situation: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment. A proposed shortcut is: Treat one successful perimeter penetration test as proof that internal identity and east-west controls are complete. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat one successful perimeter penetration test as proof that internal identity and east-west controls are complete.
- Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
- Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment.
Incorrect Answers
A:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. Applied case: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment.
B:Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
D:Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 267
A Cisco cybersecurity incident response review finds: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment. The team proposes: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Explanation
Correct Answer
A:Relevant validation before approval: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results. Applied case: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment.
Incorrect Answers
B:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
C:Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
D:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 268
The SOC team has not yet approved changes. Current evidence indicates: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace.
Explanation
Correct Answer
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
B:Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
D:Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 269
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
- Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
Explanation
Correct Answer
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. The approved implementation step was: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap.
Incorrect Answers
A:Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
B:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
D:The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
Question 270
For an original CBRCOR educational scenario, consider: An identity alert covers successful privileged logins but the SOC has no audit of new service principal grants to the same environment. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Check: Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
- Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap.
- Check: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Treat one successful perimeter penetration test as proof that internal identity and east-west controls are complete.
Explanation
Correct Answer
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. Evidence: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
D:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
Incorrect Answers
A:Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
B:Check: Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
