Cisco 350-201 Practice Test 33
Question 320
For an original CBRCOR educational scenario, consider: A server baseline disables DNS entirely on a domain controller because the scanner lists DNS as a network service. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Check: Compare active sockets, installed packages, process owners, business requirements and access rules before and after change.
- Turn off every listening daemon including required identity or resolution services solely to produce a zero-port scan.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
Explanation
Correct Answer
B:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. Required intervention: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
E:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. Evidence: Compare active sockets, installed packages, process owners, business requirements and access rules before and after change.
Incorrect Answers
A:Check: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths. Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
D:Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
Question 321
A SOC analyst is examining this cybersecurity operations situation: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway. A proposed shortcut is: Keep all east-west traffic open because only internet-origin attacks are considered relevant to segmentation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Keep all east-west traffic open because only internet-origin attacks are considered relevant to segmentation.
- Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
- Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway.
Incorrect Answers
A:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
B:Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 322
A Cisco cybersecurity incident response review finds: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway. The team proposes: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
- Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Explanation
Correct Answer
D:Demonstrable success requires: Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Applied case: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway.
Incorrect Answers
A:UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 323
The SOC team has not yet approved changes. Current evidence indicates: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
Explanation
Correct Answer
D:Confirm afterward that: Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Applied case: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway.
Incorrect Answers
A:Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
B:Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 324
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed.
- Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access.
Explanation
Correct Answer
B:The approved implementation step was: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Applied case: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway.
Incorrect Answers
A:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
D:Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 325
An implementation sign-off request identifies the following problem: A compromised reception laptop can connect directly to a production database management port despite a strong perimeter gateway. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Verify: Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions. Verify: Compare active sockets, installed packages, process owners, business requirements and access rules before and after change.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Verify: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Change: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role. Verify: Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
Explanation
Correct Answer
C:The change is successful only when: Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
Incorrect Answers
A:Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
B:Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
D:Change: Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
Question 326
A SOC analyst is examining this cybersecurity operations situation: A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths. A proposed shortcut is: Keep all east-west traffic open because only internet-origin attacks are considered relevant to segmentation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Keep all east-west traffic open because only internet-origin attacks are considered relevant to segmentation.
- Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Incorrect Answers
A:Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Use this instead: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
D:Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths.
Question 327
A Cisco cybersecurity incident response review finds: A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths. The team proposes: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
- Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Explanation
Correct Answer
C:Demonstrable success requires: Needed application traffic remains available while unauthorized cross-zone access is denied and logged. This principle explains the proposed technical approach, which is: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
Incorrect Answers
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
B:Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
D:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths.
Question 328
The SOC team has not yet approved changes. Current evidence indicates: A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace.
- Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
Explanation
Correct Answer
A:Confirm afterward that: Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Incorrect Answers
B:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
D:Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 329
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
Explanation
Correct Answer
C:The approved implementation step was: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Incorrect Answers
A:Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
B:Detection quality remains measured across representative groups with investigated drift and bounded alert noise. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
D:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 330
For an original CBRCOR educational scenario, consider: A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Keep all east-west traffic open because only internet-origin attacks are considered relevant to segmentation.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
Explanation
Correct Answer
A:Required intervention: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
D:Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
E:Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
