Cisco 350-201 Practice Test 34
Question 330
For an original CBRCOR educational scenario, consider: A business unit places employee workstations and payment processing systems on a shared VLAN with unrestricted internal paths. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Keep all east-west traffic open because only internet-origin attacks are considered relevant to segmentation.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
Explanation
Correct Answer
A:Required intervention: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
D:Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
C:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
E:Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Question 331
A SOC analyst is examining this cybersecurity operations situation: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks. A proposed shortcut is: Approve all traffic from a VPN address pool regardless of the user, device health or requested service. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Approve all traffic from a VPN address pool regardless of the user, device health or requested service.
- Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations.
- Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks.
Incorrect Answers
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
C:Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 332
A Cisco cybersecurity incident response review finds: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks. The team proposes: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
- Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
Explanation
Correct Answer
C:Demonstrable success requires: Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity. This principle explains the proposed technical approach, which is: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
Incorrect Answers
A:This option addresses a different security operations topic (CIS benchmarks and vendor baselines) rather than the documented Identity-aware microsegmentation decision.
B:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 333
The SOC team has not yet approved changes. Current evidence indicates: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
Explanation
Correct Answer
D:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Applied case: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks.
Incorrect Answers
A:Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
B:Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
C:Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 334
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required.
- The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown.
Explanation
Correct Answer
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. The approved implementation step was: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
Incorrect Answers
B:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
C:Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 335
An implementation sign-off request identifies the following problem: Remote contractor devices share the same VPN pool as employees and can reach sensitive administrative ports without device posture checks. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Verify: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. Verify: Review baseline access patterns, session source, VPN egress, new permissions and correlated endpoint telemetry.
- Change: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone. Verify: Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Change: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted. Verify: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
Explanation
Correct Answer
C:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. The change is successful only when: Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
Incorrect Answers
A:This option addresses a different security operations topic (Threat intelligence platform feed lifecycle) rather than the documented Identity-aware microsegmentation decision.
B:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:Change: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted.
Question 336
A SOC analyst is examining this cybersecurity operations situation: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies. A proposed shortcut is: Approve all traffic from a VPN address pool regardless of the user, device health or requested service. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Approve all traffic from a VPN address pool regardless of the user, device health or requested service.
- Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
- Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
- Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Incorrect Answers
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Use this instead: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
C:Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 337
A Cisco cybersecurity incident response review finds: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies. The team proposes: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
- AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Explanation
Correct Answer
D:Demonstrable success requires: Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity. Applied case: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies.
Incorrect Answers
A:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
B:Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
C:AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 338
The SOC team has not yet approved changes. Current evidence indicates: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
Explanation
Correct Answer
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. If confirmed, the proportionate intervention is: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
Incorrect Answers
B:This option addresses a different security operations topic (DNS and TLS metadata in PCAP) rather than the documented Identity-aware microsegmentation decision.
C:This option addresses a different security operations topic (Network control-plane and management protection) rather than the documented Identity-aware microsegmentation decision.
D:Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 339
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
- Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
Explanation
Correct Answer
C:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies.
B:Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 340
For an original CBRCOR educational scenario, consider: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Approve all traffic from a VPN address pool regardless of the user, device health or requested service.
- Change: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Check: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Required intervention: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
C:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Acceptance: Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
E:Check: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
