Cisco 350-201 Practice Test 30
Question 290
For an original CBRCOR educational scenario, consider: A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
- Check: Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Apply every control from an unrelated platform checklist directly to production without testing compatibility.
- Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Explanation
Correct Answer
A:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Acceptance: Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
B:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Required intervention: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
Incorrect Answers
C:Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. A network team applies workstation browser guidance to firewall operating systems without checking platform-specific baseline recommendations.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
E:Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
Question 291
A SOC analyst is examining this cybersecurity operations situation: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score. A proposed shortcut is: Use only alphabetical asset names to schedule remediation and ignore whether attackers are exploiting the vulnerability. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
- Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
- Use only alphabetical asset names to schedule remediation and ignore whether attackers are exploiting the vulnerability.
- Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score.
Incorrect Answers
A:Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 292
A Cisco cybersecurity incident response review finds: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score. The team proposes: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Explanation
Correct Answer
A:Demonstrable success requires: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk. Applied case: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score.
Incorrect Answers
B:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
D:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 293
The SOC team has not yet approved changes. Current evidence indicates: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
D:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Applied case: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score.
Incorrect Answers
A:Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
B:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented Risk-aware patch prioritization decision.
C:Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 294
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
- The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact.
- Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
Explanation
Correct Answer
B:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
D:Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 295
An implementation sign-off request identifies the following problem: A publicly reachable VPN gateway has an exploited vulnerability but is queued after a low-risk isolated test application with the same CVSS score. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Verify: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls. Verify: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Verify: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
Explanation
Correct Answer
C:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. The change is successful only when: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
Incorrect Answers
A:Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
B:Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
D:Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
Question 296
A SOC analyst is examining this cybersecurity operations situation: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic. A proposed shortcut is: Use only alphabetical asset names to schedule remediation and ignore whether attackers are exploiting the vulnerability. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
- Use only alphabetical asset names to schedule remediation and ignore whether attackers are exploiting the vulnerability.
- Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
- Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Incorrect Answers
A:Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
B:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Use this instead: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
C:Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 297
A Cisco cybersecurity incident response review finds: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic. The team proposes: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
- CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Explanation
Correct Answer
D:Demonstrable success requires: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk. This principle explains the proposed technical approach, which is: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
Incorrect Answers
A:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
B:This option addresses a different security operations topic (MITRE ATT&CK tactics versus techniques) rather than the documented Risk-aware patch prioritization decision.
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 298
The SOC team has not yet approved changes. Current evidence indicates: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Compare active sockets, installed packages, process owners, business requirements and access rules before and after change.
- Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
Explanation
Correct Answer
B:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Confirm afterward that: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
Incorrect Answers
A:Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:Compare active sockets, installed packages, process owners, business requirements and access rules before and after change. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
D:Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 299
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
- The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps.
Explanation
Correct Answer
B:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Applied case: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic.
Incorrect Answers
A:Detection quality remains measured across representative groups with investigated drift and bounded alert noise. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
D:Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 300
For an original CBRCOR educational scenario, consider: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Result: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- Result: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Check: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
- Check: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
B:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Required intervention: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
E:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Acceptance: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
F:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Incorrect Answers
A:Result: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
D:Check: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
