Cisco 350-201 Practice Test 29
Question 280
For an original CBRCOR educational scenario, consider: A regulatory exception disables MFA for a service account yet no compensating credential vault or audit monitoring is applied. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Check: Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
- Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
- Make every temporary security bypass permanent and remove audit collection to avoid generating alerts.
Explanation
Correct Answer
B:Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency. Acceptance: Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required.
C:Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency. Required intervention: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
Incorrect Answers
A:Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency.
D:Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls. Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency.
Question 281
A SOC analyst is examining this cybersecurity operations situation: An analyst uses an arbitrary internet checklist to harden a Windows server and disables services required by the installed role. A proposed shortcut is: Apply every control from an unrelated platform checklist directly to production without testing compatibility. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Apply every control from an unrelated platform checklist directly to production without testing compatibility.
- Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Incorrect Answers
A:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:This option addresses a different security operations topic (Threat intelligence platform feed lifecycle) rather than the documented CIS benchmarks and vendor baselines decision.
D:This option addresses a different security operations topic (DevSecOps pipeline security gates) rather than the documented CIS benchmarks and vendor baselines decision.
Question 282
A Cisco cybersecurity incident response review finds: An analyst uses an arbitrary internet checklist to harden a Windows server and disables services required by the installed role. The team proposes: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
- Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Explanation
Correct Answer
C:Demonstrable success requires: Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. This principle explains the proposed technical approach, which is: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
Incorrect Answers
A:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
B:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Question 283
The SOC team has not yet approved changes. Current evidence indicates: An analyst uses an arbitrary internet checklist to harden a Windows server and disables services required by the installed role. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
- Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
Explanation
Correct Answer
C:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Confirm afterward that: Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
Incorrect Answers
A:Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
B:Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Question 284
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An analyst uses an arbitrary internet checklist to harden a Windows server and disables services required by the installed role. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact.
- Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
Explanation
Correct Answer
A:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
C:Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Question 285
An implementation sign-off request identifies the following problem: An analyst uses an arbitrary internet checklist to harden a Windows server and disables services required by the installed role. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Verify: Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
- Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Verify: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Change: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role. Verify: Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Verify: Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
Explanation
Correct Answer
C:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. The change is successful only when: Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
Incorrect Answers
A:Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
B:Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations.
Question 286
A SOC analyst is examining this cybersecurity operations situation: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations. A proposed shortcut is: Apply every control from an unrelated platform checklist directly to production without testing compatibility. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
- Apply every control from an unrelated platform checklist directly to production without testing compatibility.
- Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations.
- Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations.
Incorrect Answers
B:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Applied case: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations.
C:Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:This option addresses a different security operations topic (Endpoint DLP for removable media) rather than the documented CIS benchmarks and vendor baselines decision.
Question 287
A Cisco cybersecurity incident response review finds: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations. The team proposes: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Explanation
Correct Answer
D:Demonstrable success requires: Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. Applied case: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations.
Incorrect Answers
A:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
B:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
C:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Question 288
The SOC team has not yet approved changes. Current evidence indicates: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
C:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
B:Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations.
Question 289
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
- Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
Explanation
Correct Answer
A:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. The approved implementation step was: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
Incorrect Answers
B:Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
C:Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
D:Key identity and network fields preserve meaning and collection failures produce explicit health alerts. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Question 290
For an original CBRCOR educational scenario, consider: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
- Check: Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Apply every control from an unrelated platform checklist directly to production without testing compatibility.
- Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Explanation
Correct Answer
A:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Acceptance: Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
B:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Required intervention: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
Incorrect Answers
C:Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
E:Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
