Cisco 350-201 Practice Test 43
Question 420
For an original CBRCOR educational scenario, consider: A newly created SIEM correlation rule suppresses repeated high-risk credential failures for a full day, hiding active attacks. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Replay representative authorized scans and malicious indicators across old and proposed rule versions.
- Change: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
- Check: Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage.
- Replace targeted threshold tuning with a blanket disablement of all high-severity network detections.
Explanation
Correct Answer
A:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. Acceptance: False positives decline while validated attack detections and evidence quality remain acceptable.
D:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. Evidence: Replay representative authorized scans and malicious indicators across old and proposed rule versions.
Incorrect Answers
B:Change: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples. Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
C:Check: Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
Question 421
A SOC analyst is examining this cybersecurity operations situation: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC. A proposed shortcut is: Discard raw evidence immediately after deriving one dashboard chart and assume no future investigation needs it. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
- Discard raw evidence immediately after deriving one dashboard chart and assume no future investigation needs it.
- Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC.
Incorrect Answers
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 422
A Cisco cybersecurity incident response review finds: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC. The team proposes: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
- Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency.
- Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Explanation
Correct Answer
D:Demonstrable success requires: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Applied case: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC.
Incorrect Answers
A:Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
B:This option addresses a different security operations topic (Control exception validation and compensating safeguards) rather than the documented Security event retention and normalization decision.
C:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 423
The SOC team has not yet approved changes. Current evidence indicates: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
Explanation
Correct Answer
D:Confirm afterward that: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Applied case: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC.
Incorrect Answers
A:Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
B:Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 424
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval.
- Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
Explanation
Correct Answer
A:The approved implementation step was: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Applied case: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC.
Incorrect Answers
B:Restricted local transfers are blocked or appropriately audited while approved business use remains possible. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:Detection quality remains measured across representative groups with investigated drift and bounded alert noise. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 425
An implementation sign-off request identifies the following problem: An incident investigation cannot correlate identity and proxy events because one source uses local time without timezone and another uses UTC. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Verify: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Verify: Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Verify: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Verify: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
Explanation
Correct Answer
A:The change is successful only when: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval.
Incorrect Answers
B:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 426
A SOC analyst is examining this cybersecurity operations situation: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks. A proposed shortcut is: Discard raw evidence immediately after deriving one dashboard chart and assume no future investigation needs it. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
- Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Discard raw evidence immediately after deriving one dashboard chart and assume no future investigation needs it.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Incorrect Answers
B:Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks.
D:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Use this instead: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
Question 427
A Cisco cybersecurity incident response review finds: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks. The team proposes: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking.
- Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Explanation
Correct Answer
B:Demonstrable success requires: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. This principle explains the proposed technical approach, which is: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
Incorrect Answers
A:Threat intelligence is time- and context-dependent; ingestion is not equivalent to validated actionable blocking. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 428
The SOC team has not yet approved changes. Current evidence indicates: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment.
Explanation
Correct Answer
A:Confirm afterward that: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Incorrect Answers
B:Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Compare raw sample events with normalized user, source IP, action, timestamp and device fields. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:Record OS version, device role, benchmark revision and configuration assessment output in a pilot environment. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 429
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Only approved management origins reach administrative services and unexpected attempts are logged.
- Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- The diagnosis identifies actual transport failure or recovery without inventing completed application transactions.
Explanation
Correct Answer
B:The approved implementation step was: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Incorrect Answers
A:Only approved management origins reach administrative services and unexpected attempts are logged. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:The diagnosis identifies actual transport failure or recovery without inventing completed application transactions. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 430
For an original CBRCOR educational scenario, consider: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Discard raw evidence immediately after deriving one dashboard chart and assume no future investigation needs it.
- Change: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
- Check: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
Explanation
Correct Answer
B:Acceptance: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Acceptance: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Applied case: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
E:Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
