Cisco 350-201 Practice Test 31
Question 300
For an original CBRCOR educational scenario, consider: A server team treats all security advisories as equal even when one affects an internet-facing identity provider with active attack traffic. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Result: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- Result: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Check: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
- Check: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
B:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Required intervention: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
E:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Acceptance: The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
F:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Incorrect Answers
A:Result: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
C:Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
D:Check: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
Question 301
A SOC analyst is examining this cybersecurity operations situation: A network security patch is pushed to every branch firewall simultaneously with no HA failover test or backout image. A proposed shortcut is: Schedule all production devices to reboot at once without monitoring or any approved rollback mechanism. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
- Schedule all production devices to reboot at once without monitoring or any approved rollback mechanism.
- Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Incorrect Answers
B:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 302
A Cisco cybersecurity incident response review finds: A network security patch is pushed to every branch firewall simultaneously with no HA failover test or backout image. The team proposes: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Explanation
Correct Answer
D:Demonstrable success requires: The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested. This principle explains the proposed technical approach, which is: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
Incorrect Answers
A:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
B:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
C:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 303
The SOC team has not yet approved changes. Current evidence indicates: A network security patch is pushed to every branch firewall simultaneously with no HA failover test or backout image. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
Explanation
Correct Answer
D:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. If confirmed, the proportionate intervention is: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
Incorrect Answers
A:Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
B:Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
C:Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 304
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A network security patch is pushed to every branch firewall simultaneously with no HA failover test or backout image. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unnecessary listeners disappear and critical application dependencies and security management continue functioning.
- Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
- High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed.
Explanation
Correct Answer
C:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. The approved implementation step was: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
Incorrect Answers
A:Unnecessary listeners disappear and critical application dependencies and security management continue functioning. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
B:Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 305
An implementation sign-off request identifies the following problem: A network security patch is pushed to every branch firewall simultaneously with no HA failover test or backout image. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy. Verify: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Verify: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Verify: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Verify: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
Explanation
Correct Answer
B:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. The change is successful only when: The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
Incorrect Answers
A:Change: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
C:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 306
A SOC analyst is examining this cybersecurity operations situation: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot. A proposed shortcut is: Schedule all production devices to reboot at once without monitoring or any approved rollback mechanism. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
- Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
- Schedule all production devices to reboot at once without monitoring or any approved rollback mechanism.
- Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot.
Incorrect Answers
A:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented Patch testing and rollback planning decision.
C:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. Use this instead: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
D:Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 307
A Cisco cybersecurity incident response review finds: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot. The team proposes: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
- Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Explanation
Correct Answer
B:Demonstrable success requires: The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested. Applied case: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot.
Incorrect Answers
A:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
C:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 308
The SOC team has not yet approved changes. Current evidence indicates: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
Explanation
Correct Answer
A:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. Applied case: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot.
Incorrect Answers
B:Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
C:Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 309
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
- Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
Explanation
Correct Answer
A:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
C:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Question 310
For an original CBRCOR educational scenario, consider: An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Check: Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
- Schedule all production devices to reboot at once without monitoring or any approved rollback mechanism.
- Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
Explanation
Correct Answer
B:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. Required intervention: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
E:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. Acceptance: The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
Incorrect Answers
A:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. An operating-system hotfix reduces attack exposure but breaks the EDR driver on a subset of laptops during the pilot.
C:Check: Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
