Cisco 350-201 Practice Test 38
Question 370
For an original CBRCOR educational scenario, consider: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Turn every low-confidence historical indicator into a permanent production deny rule without validation.
- Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
- Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Check: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
Explanation
Correct Answer
D:Acceptance: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Applied case: Two intelligence providers submit contradictory indicator reputations and the SOC cannot explain the resulting firewall actions.
E:Acceptance: High-confidence current indicators receive proportionate treatment while stale or untrusted feed entries are reviewed. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
B:Change: Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
C:Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
Question 371
A SOC analyst is examining this cybersecurity operations situation: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator. A proposed shortcut is: Attribute an incident and block a customer domain based only on an unsourced AI summary. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Attribute an incident and block a customer domain based only on an unsourced AI summary.
- Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
- Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator.
Incorrect Answers
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented AI-supported threat intelligence correlation decision.
Question 372
A Cisco cybersecurity incident response review finds: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator. The team proposes: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Flow records summarize connections while full capture can preserve protocol packets only where visibility and collection policy permit.
- AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
- Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Explanation
Correct Answer
B:Demonstrable success requires: Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. This principle explains the proposed technical approach, which is: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
Incorrect Answers
A:Flow records summarize connections while full capture can preserve protocol packets only where visibility and collection policy permit. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Question 373
The SOC team has not yet approved changes. Current evidence indicates: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
Explanation
Correct Answer
B:If confirmed, the proportionate intervention is: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Applied case: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator.
Incorrect Answers
A:Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Question 374
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
- Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
- Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity.
Explanation
Correct Answer
C:The approved implementation step was: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Applied case: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator.
Incorrect Answers
A:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
B:Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Authorized applications communicate while untrusted devices cannot inherit unrestricted access merely from network proximity. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Question 375
An implementation sign-off request identifies the following problem: A model links an internal domain to a ransomware campaign solely because the strings share a similar name with a published indicator. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Verify: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Verify: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Verify: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Verify: Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
Explanation
Correct Answer
D:The change is successful only when: Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
Incorrect Answers
A:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
B:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
Question 376
A SOC analyst is examining this cybersecurity operations situation: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity. A proposed shortcut is: Attribute an incident and block a customer domain based only on an unsourced AI summary. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Attribute an incident and block a customer domain based only on an unsourced AI summary.
- Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
- Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity.
Incorrect Answers
A:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Use this instead: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
B:Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Question 377
A Cisco cybersecurity incident response review finds: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity. The team proposes: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Explanation
Correct Answer
A:Demonstrable success requires: Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. Applied case: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity.
Incorrect Answers
B:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity.
Question 378
The SOC team has not yet approved changes. Current evidence indicates: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
Explanation
Correct Answer
C:If confirmed, the proportionate intervention is: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Applied case: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity.
Incorrect Answers
A:Compare raw sample events with normalized user, source IP, action, timestamp and device fields. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
B:Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection. Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity.
Question 379
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
- Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion.
- False positives decline while validated attack detections and evidence quality remain acceptable.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
Explanation
Correct Answer
A:The approved implementation step was: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Applied case: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity.
Incorrect Answers
B:Analysts can justify each high-impact decision using independently observable events rather than an unsupported model assertion. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
C:False positives decline while validated attack detections and evidence quality remain acceptable. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Question 380
For an original CBRCOR educational scenario, consider: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Attribute an incident and block a customer domain based only on an unsourced AI summary.
- Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
- Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Explanation
Correct Answer
A:Required intervention: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
B:AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Incorrect Answers
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
E:Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
