Cisco 350-201 Practice Test 39
Question 380
For an original CBRCOR educational scenario, consider: Threat analysts receive thousands of candidate domains from AI enrichment but cannot trace any result back to observable DNS or endpoint activity. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Attribute an incident and block a customer domain based only on an unsourced AI summary.
- Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
- Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Explanation
Correct Answer
A:Required intervention: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
B:AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Incorrect Answers
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
D:Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
E:Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Question 381
A SOC analyst is examining this cybersecurity operations situation: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store. A proposed shortcut is: Declare all sensitive information protected because the website has an HTTPS certificate. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
- Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Declare all sensitive information protected because the website has an HTTPS certificate.
- Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store.
Incorrect Answers
A:Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 382
A Cisco cybersecurity incident response review finds: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store. The team proposes: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity.
- Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Explanation
Correct Answer
B:Demonstrable success requires: Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access. Applied case: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store.
Incorrect Answers
A:Anomaly models learn distributions and can shift when workloads, users or device populations change without new attacker activity. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
D:Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 383
The SOC team has not yet approved changes. Current evidence indicates: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
Explanation
Correct Answer
A:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. Applied case: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store.
Incorrect Answers
B:This option addresses a different security operations topic (Control efficacy against an attack path) rather than the documented Data in motion versus at rest versus in use decision.
C:Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
D:Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 384
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access.
Explanation
Correct Answer
D:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The investigation states which observed fields are reliable and where encrypted or unsampled traffic remains unknown. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
B:Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 385
An implementation sign-off request identifies the following problem: A project claims a TLS connection is sufficient to protect exported employee records that are stored unencrypted in a public object store. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Verify: Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. Verify: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Verify: Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
B:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. The change is successful only when: Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access.
Incorrect Answers
A:Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
D:Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 386
A SOC analyst is examining this cybersecurity operations situation: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution. A proposed shortcut is: Declare all sensitive information protected because the website has an HTTPS certificate. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations.
- Declare all sensitive information protected because the website has an HTTPS certificate.
- Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
- Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution.
Incorrect Answers
A:Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
B:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. Applied case: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution.
C:Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 387
A Cisco cybersecurity incident response review finds: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution. The team proposes: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
- Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Explanation
Correct Answer
D:Demonstrable success requires: Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access. Applied case: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution.
Incorrect Answers
A:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
B:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 388
The SOC team has not yet approved changes. Current evidence indicates: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace.
- Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
Explanation
Correct Answer
A:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
B:Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
D:Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 389
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
- Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
Explanation
Correct Answer
C:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. The approved implementation step was: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
Incorrect Answers
A:The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
B:Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
D:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 390
For an original CBRCOR educational scenario, consider: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Declare all sensitive information protected because the website has an HTTPS certificate.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
Explanation
Correct Answer
A:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. Required intervention: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
D:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. Evidence: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution.
E:Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
