Cisco 350-201 Practice Test 36
Question 350
For an original CBRCOR educational scenario, consider: A branch switch accepts insecure remote management and unrestricted SNMP communities after a migration to a monitored campus. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
- Check: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Change: Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
- Expose network-device management ports to all client VLANs for troubleshooting convenience.
Explanation
Correct Answer
C:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Acceptance: Only approved management origins reach administrative services and unexpected attempts are logged.
D:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Evidence: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
Incorrect Answers
A:Check: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
B:Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Question 351
A SOC analyst is examining this cybersecurity operations situation: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured. A proposed shortcut is: Skip all security gates whenever the continuous integration build produces a syntactically valid artifact. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
- Skip all security gates whenever the continuous integration build produces a syntactically valid artifact.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured.
Incorrect Answers
A:Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
B:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 352
A Cisco cybersecurity incident response review finds: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured. The team proposes: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
- Cloud data loss can occur through application links and APIs even when network perimeter monitoring sees no email attachment.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
Explanation
Correct Answer
C:Demonstrable success requires: Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible. This principle explains the proposed technical approach, which is: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Incorrect Answers
A:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
B:This option addresses a different security operations topic (Cloud and application DLP policy) rather than the documented DevSecOps pipeline security gates decision.
D:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 353
The SOC team has not yet approved changes. Current evidence indicates: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Explanation
Correct Answer
A:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Applied case: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured.
Incorrect Answers
B:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
C:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented DevSecOps pipeline security gates decision.
D:Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 354
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
- The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown.
- Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
Explanation
Correct Answer
C:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. The approved implementation step was: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Incorrect Answers
A:Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
B:The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
D:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 355
An implementation sign-off request identifies the following problem: A build pipeline deploys a container with a known critical dependency vulnerability after all tests pass because no vulnerability scan is configured. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Verify: Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Verify: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Verify: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
Explanation
Correct Answer
D:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. The change is successful only when: Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible.
Incorrect Answers
A:Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
B:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented DevSecOps pipeline security gates decision.
C:Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 356
A SOC analyst is examining this cybersecurity operations situation: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch. A proposed shortcut is: Skip all security gates whenever the continuous integration build produces a syntactically valid artifact. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Skip all security gates whenever the continuous integration build produces a syntactically valid artifact.
- Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Incorrect Answers
A:Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch.
B:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Use this instead: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
C:Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 357
A Cisco cybersecurity incident response review finds: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch. The team proposes: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
- Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Explanation
Correct Answer
A:Demonstrable success requires: Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible. Applied case: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch.
Incorrect Answers
B:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
C:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
D:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 358
The SOC team has not yet approved changes. Current evidence indicates: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
Explanation
Correct Answer
A:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. If confirmed, the proportionate intervention is: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Incorrect Answers
B:Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
C:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
D:Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 359
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
- Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
Explanation
Correct Answer
A:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
C:Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch.
D:Restricted local transfers are blocked or appropriately audited while approved business use remains possible. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 360
For an original CBRCOR educational scenario, consider: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Check: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Skip all security gates whenever the continuous integration build produces a syntactically valid artifact.
Explanation
Correct Answer
C:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Applied case: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch.
D:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Required intervention: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Incorrect Answers
A:Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
B:Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
