Cisco 350-201 Practice Test 40
Question 390
For an original CBRCOR educational scenario, consider: An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Declare all sensitive information protected because the website has an HTTPS certificate.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Change: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
Explanation
Correct Answer
A:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. Required intervention: Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
D:Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others. Evidence: Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
C:Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. An administrator encrypts database disks but allows unrestricted privileged processes to read decrypted confidential values during execution.
E:Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy. Data in transit, at rest and in use face different exposures; encrypting one state does not automatically protect the others.
Question 391
A SOC analyst is examining this cybersecurity operations situation: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy. A proposed shortcut is: Claim email gateway attachment scanning controls every removable-drive and local print operation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Claim email gateway attachment scanning controls every removable-drive and local print operation.
- Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
- Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy.
Incorrect Answers
A:Endpoint DLP can observe local data movement that network and cloud gateways may never see. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
D:Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 392
A Cisco cybersecurity incident response review finds: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy. The team proposes: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
- Endpoint DLP can observe local data movement that network and cloud gateways may never see.
- Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
Explanation
Correct Answer
B:Demonstrable success requires: Restricted local transfers are blocked or appropriately audited while approved business use remains possible. Applied case: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy.
Incorrect Answers
A:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
C:Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
D:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 393
The SOC team has not yet approved changes. Current evidence indicates: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Replay representative authorized scans and malicious indicators across old and proposed rule versions.
- Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
Explanation
Correct Answer
D:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Applied case: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy.
Incorrect Answers
A:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
B:Replay representative authorized scans and malicious indicators across old and proposed rule versions. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
C:Compare raw sample events with normalized user, source IP, action, timestamp and device fields. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 394
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
- The diagnosis identifies actual transport failure or recovery without inventing completed application transactions.
Explanation
Correct Answer
C:Endpoint DLP can observe local data movement that network and cloud gateways may never see. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
B:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
D:The diagnosis identifies actual transport failure or recovery without inventing completed application transactions. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 395
An implementation sign-off request identifies the following problem: An employee copies unencrypted client records to a USB drive but cloud DLP reports no event because the transfer never crossed its monitored proxy. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy. Verify: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Verify: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. Verify: Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace.
- Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Verify: Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
Explanation
Correct Answer
A:Endpoint DLP can observe local data movement that network and cloud gateways may never see. The change is successful only when: Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
Incorrect Answers
B:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
C:Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
D:Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 396
A SOC analyst is examining this cybersecurity operations situation: A laptop user prints confidential design documents and the organization relies solely on blocking outbound SMTP attachments. A proposed shortcut is: Claim email gateway attachment scanning controls every removable-drive and local print operation. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
- Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
- Claim email gateway attachment scanning controls every removable-drive and local print operation.
- Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Incorrect Answers
A:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented Endpoint DLP for removable media decision.
C:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Use this instead: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
D:Restrict management plane sources, require encrypted authenticated access and enforce documented ACL and logging controls. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 397
A Cisco cybersecurity incident response review finds: A laptop user prints confidential design documents and the organization relies solely on blocking outbound SMTP attachments. The team proposes: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Endpoint DLP can observe local data movement that network and cloud gateways may never see.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- Asset posture depends on exposure, controls and observed state; the absence of an alert is not evidence of compliance.
- Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
Explanation
Correct Answer
A:Demonstrable success requires: Restricted local transfers are blocked or appropriately audited while approved business use remains possible. This principle explains the proposed technical approach, which is: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
Incorrect Answers
B:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
C:This option addresses a different security operations topic (Asset posture inventory and exposure) rather than the documented Endpoint DLP for removable media decision.
D:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 398
The SOC team has not yet approved changes. Current evidence indicates: A laptop user prints confidential design documents and the organization relies solely on blocking outbound SMTP attachments. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
Explanation
Correct Answer
B:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Confirm afterward that: Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
Incorrect Answers
A:Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
C:Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
D:Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 399
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A laptop user prints confidential design documents and the organization relies solely on blocking outbound SMTP attachments. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Only approved management origins reach administrative services and unexpected attempts are logged.
- Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps.
- Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval.
- Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
Explanation
Correct Answer
D:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Applied case: A laptop user prints confidential design documents and the organization relies solely on blocking outbound SMTP attachments.
Incorrect Answers
A:Only approved management origins reach administrative services and unexpected attempts are logged. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
B:Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
C:Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
Question 400
For an original CBRCOR educational scenario, consider: A laptop user prints confidential design documents and the organization relies solely on blocking outbound SMTP attachments. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
- Result: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- Result: Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
- Check: Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
- Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Check: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
Explanation
Correct Answer
A:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Acceptance: Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
C:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Required intervention: Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
D:Endpoint DLP can observe local data movement that network and cloud gateways may never see. Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
Incorrect Answers
B:Result: Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
E:Change: Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
F:Check: Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections. Endpoint DLP can observe local data movement that network and cloud gateways may never see.
