Cisco 350-201 Practice Test 35
Question 340
For an original CBRCOR educational scenario, consider: A workload microsegmentation rule uses one broad subnet allowlist despite independent service identities and different application dependencies. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Approve all traffic from a VPN address pool regardless of the user, device health or requested service.
- Change: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Check: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
A:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Required intervention: Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
C:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Acceptance: Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
D:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
E:Check: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints. Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Question 341
A SOC analyst is examining this cybersecurity operations situation: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic. A proposed shortcut is: Expose network-device management ports to all client VLANs for troubleshooting convenience. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
- Expose network-device management ports to all client VLANs for troubleshooting convenience.
- Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
- Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic.
Incorrect Answers
A:Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
B:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 342
A Cisco cybersecurity incident response review finds: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic. The team proposes: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
- Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Explanation
Correct Answer
A:Demonstrable success requires: Only approved management origins reach administrative services and unexpected attempts are logged. Applied case: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic.
Incorrect Answers
B:Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
C:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
D:Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 343
The SOC team has not yet approved changes. Current evidence indicates: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
Explanation
Correct Answer
C:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Applied case: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic.
Incorrect Answers
A:Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
B:Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
D:Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 344
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
- Only approved management origins reach administrative services and unexpected attempts are logged.
- The diagnosis identifies actual transport failure or recovery without inventing completed application transactions.
Explanation
Correct Answer
C:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
B:The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
D:The diagnosis identifies actual transport failure or recovery without inventing completed application transactions. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 345
An implementation sign-off request identifies the following problem: Router management interfaces are accessible from a guest Wi-Fi network because their ACL is applied only to external WAN traffic. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls. Verify: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Change: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy. Verify: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Verify: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Verify: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
Explanation
Correct Answer
A:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. The change is successful only when: Only approved management origins reach administrative services and unexpected attempts are logged.
Incorrect Answers
B:This option addresses a different security operations topic (Endpoint DLP for removable media) rather than the documented Network control-plane and management protection decision.
C:Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
D:Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 346
A SOC analyst is examining this cybersecurity operations situation: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus. A proposed shortcut is: Expose network-device management ports to all client VLANs for troubleshooting convenience. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Build, scan and sign or approve hardened golden images before deployment, then replace noncompliant instances from the trusted baseline.
- Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
- Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
- Expose network-device management ports to all client VLANs for troubleshooting convenience.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Incorrect Answers
A:This option addresses a different security operations topic (Golden machine image hardening) rather than the documented Network control-plane and management protection decision.
C:Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
D:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Use this instead: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
Question 347
A Cisco cybersecurity incident response review finds: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus. The team proposes: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
- Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
- Cloud data loss can occur through application links and APIs even when network perimeter monitoring sees no email attachment.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
Explanation
Correct Answer
B:Demonstrable success requires: Only approved management origins reach administrative services and unexpected attempts are logged. This principle explains the proposed technical approach, which is: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
Incorrect Answers
A:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
C:This option addresses a different security operations topic (Cloud and application DLP policy) rather than the documented Network control-plane and management protection decision.
D:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 348
The SOC team has not yet approved changes. Current evidence indicates: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
Explanation
Correct Answer
A:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Confirm afterward that: Only approved management origins reach administrative services and unexpected attempts are logged.
Incorrect Answers
B:Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
C:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
D:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 349
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
- Only approved management origins reach administrative services and unexpected attempts are logged.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
- Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
Explanation
Correct Answer
B:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Applied case: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus.
Incorrect Answers
A:Key identity and network fields preserve meaning and collection failures produce explicit health alerts. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
C:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
D:Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 350
For an original CBRCOR educational scenario, consider: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
- Check: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
- Expose network-device management ports to all client VLANs for troubleshooting convenience.
Explanation
Correct Answer
C:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Acceptance: Only approved management origins reach administrative services and unexpected attempts are logged.
D:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Evidence: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
Incorrect Answers
A:Check: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
B:Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
