Cisco 350-201 Practice Test 4
Question 30
For an original CBRCOR educational scenario, consider: A DDoS playbook cannot handle a provider scrubbing service outage and offers no alternate escalation route. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
- Check: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Execute the most disruptive containment step for every alert without evaluating its confidence or business impact.
- Check: Test normal, false-positive and third-party-failure paths against recorded decision criteria and communications.
Explanation
Correct Answer
A:Acceptance: Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails. Applied case: A DDoS playbook cannot handle a provider scrubbing service outage and offers no alternate escalation route.
E:Acceptance: Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails. Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage.
Incorrect Answers
B:Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage.
C:Check: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix. Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage.
D:Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage. Use this instead: Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
Question 31
A SOC analyst is examining this cybersecurity operations situation: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready. A proposed shortcut is: Reboot every suspected host first and use only a perimeter vulnerability scan to reconstruct running processes. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone.
- Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
- Reboot every suspected host first and use only a perimeter vulnerability scan to reconstruct running processes.
- Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready.
Incorrect Answers
A:Rank risks by connecting asset business value, vulnerability exploitability, threat activity and control exposure rather than severity alone. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Add evidence-based decision branches, severity thresholds and controlled fallback instructions to the relevant playbook. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 32
A Cisco cybersecurity incident response review finds: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready. The team proposes: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
- GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Explanation
Correct Answer
D:Demonstrable success requires: The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Applied case: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready.
Incorrect Answers
A:Branches distinguish confirmed compromise from suspicious observation and prevent a fixed response from causing avoidable business damage. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
B:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 33
The SOC team has not yet approved changes. Current evidence indicates: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
Explanation
Correct Answer
D:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Applied case: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready.
Incorrect Answers
A:Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
B:Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 34
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
- The rule reduces avoidable work without unacceptable loss of validated malicious cases.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report.
Explanation
Correct Answer
A:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The rule reduces avoidable work without unacceptable loss of validated malicious cases. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
D:Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 35
An implementation sign-off request identifies the following problem: A responder must preserve a volatile process list before a compromised workstation is restarted but has only a network scanner ready. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Verify: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Verify: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Verify: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
Explanation
Correct Answer
C:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. The change is successful only when: The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
Incorrect Answers
A:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
B:Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
D:Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
Question 36
A SOC analyst is examining this cybersecurity operations situation: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence. A proposed shortcut is: Reboot every suspected host first and use only a perimeter vulnerability scan to reconstruct running processes. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
- Reboot every suspected host first and use only a perimeter vulnerability scan to reconstruct running processes.
- Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
- Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Incorrect Answers
A:Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
B:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Use this instead: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
D:Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 37
A Cisco cybersecurity incident response review finds: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence. The team proposes: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
- Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Explanation
Correct Answer
B:Demonstrable success requires: The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. This principle explains the proposed technical approach, which is: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
Incorrect Answers
A:Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence.
D:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 38
The SOC team has not yet approved changes. Current evidence indicates: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
Explanation
Correct Answer
A:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Confirm afterward that: The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
Incorrect Answers
B:Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence.
D:Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 39
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Each test incident enters the right workflow and has one accountable owner with a traceable escalation path.
- The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
Explanation
Correct Answer
D:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Applied case: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence.
Incorrect Answers
A:Each test incident enters the right workflow and has one accountable owner with a traceable escalation path. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
B:The residual exposure and justification are visible and temporary compensating controls have named owners and expiry checks. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
C:Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 40
For an original CBRCOR educational scenario, consider: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
- Reboot every suspected host first and use only a perimeter vulnerability scan to reconstruct running processes.
- Check: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
Explanation
Correct Answer
D:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Acceptance: The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
E:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Evidence: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
Incorrect Answers
A:Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
B:This option addresses a different security operations topic (IaaS guest responsibility versus provider platform) rather than the documented Forensic tool selection for endpoint evidence decision.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
