Cisco 350-201 Practice Test 37
Question 360
For an original CBRCOR educational scenario, consider: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Check: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Skip all security gates whenever the continuous integration build produces a syntactically valid artifact.
Explanation
Correct Answer
C:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Applied case: A platform team stores long-lived production signing keys as plaintext CI variables accessible to every developer branch.
D:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Required intervention: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Incorrect Answers
A:Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
B:Check: Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Question 361
A SOC analyst is examining this cybersecurity operations situation: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags. A proposed shortcut is: Turn every low-confidence historical indicator into a permanent production deny rule without validation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Turn every low-confidence historical indicator into a permanent production deny rule without validation.
- Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
- Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags.
Incorrect Answers
A:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
B:Segment access by workload and identity context, device posture and required ports rather than broad source-network membership alone. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
D:Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 362
A Cisco cybersecurity incident response review finds: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags. The team proposes: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Endpoint DLP can observe local data movement that network and cloud gateways may never see.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
- Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Explanation
Correct Answer
D:Demonstrable success requires: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Applied case: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags.
Incorrect Answers
A:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
B:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 363
The SOC team has not yet approved changes. Current evidence indicates: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Replay representative authorized scans and malicious indicators across old and proposed rule versions.
- Compare active sockets, installed packages, process owners, business requirements and access rules before and after change.
- Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
Explanation
Correct Answer
D:Confirm afterward that: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Applied case: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags.
Incorrect Answers
A:Replay representative authorized scans and malicious indicators across old and proposed rule versions. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
B:Compare active sockets, installed packages, process owners, business requirements and access rules before and after change. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 364
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
- Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact.
Explanation
Correct Answer
B:The approved implementation step was: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Applied case: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags.
Incorrect Answers
A:The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
D:Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 365
An implementation sign-off request identifies the following problem: A TIP automatically blocks every imported IPv4 address even when the feed is six years old and has no confidence tags. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Verify: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Change: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Verify: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Change: Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. Verify: Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Verify: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
Explanation
Correct Answer
A:The change is successful only when: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed.
Incorrect Answers
B:Change: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
C:Change: Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
D:Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 366
A SOC analyst is examining this cybersecurity operations situation: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions. A proposed shortcut is: Turn every low-confidence historical indicator into a permanent production deny rule without validation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
- Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted.
- Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Turn every low-confidence historical indicator into a permanent production deny rule without validation.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
Incorrect Answers
B:Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
D:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
Question 367
A Cisco cybersecurity incident response review finds: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions. The team proposes: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact.
- Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Explanation
Correct Answer
A:Demonstrable success requires: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
Incorrect Answers
B:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:CVSS severity alone does not express business risk or active exploitation; operational priority combines threat evidence and reachable impact. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
D:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 368
The SOC team has not yet approved changes. Current evidence indicates: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
Explanation
Correct Answer
B:Confirm afterward that: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
Incorrect Answers
A:Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
D:Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 369
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The diagnosis identifies actual transport failure or recovery without inventing completed application transactions.
- Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact.
- High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
Explanation
Correct Answer
C:The approved implementation step was: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
Incorrect Answers
A:The diagnosis identifies actual transport failure or recovery without inventing completed application transactions. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
B:Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact. Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
D:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 370
For an original CBRCOR educational scenario, consider: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Turn every low-confidence historical indicator into a permanent production deny rule without validation.
- Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
- Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Check: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
Explanation
Correct Answer
D:Acceptance: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
E:Acceptance: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
B:Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
