Cisco 350-201 Practice Test 44
Question 430
For an original CBRCOR educational scenario, consider: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Discard raw evidence immediately after deriving one dashboard chart and assume no future investigation needs it.
- Change: Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
- Check: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
Explanation
Correct Answer
B:Acceptance: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
C:Acceptance: Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. Applied case: Logs from a critical authentication service are deleted after one day although investigations routinely span several weeks.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
D:Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
E:Change: Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. Accurate analytics depend on consistent event semantics, reliable ingestion and sufficient lawful evidence retention.
Question 431
A SOC analyst is examining this cybersecurity operations situation: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution. A proposed shortcut is: Treat any event that appears in a dashboard as correctly normalized regardless of parser mappings. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat any event that appears in a dashboard as correctly normalized regardless of parser mappings.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution.
Incorrect Answers
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Normalize time and source fields, maintain collection health and enforce documented retention and access controls by data class. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 432
A Cisco cybersecurity incident response review finds: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution. The team proposes: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Explanation
Correct Answer
A:Demonstrable success requires: Key identity and network fields preserve meaning and collection failures produce explicit health alerts. Applied case: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution.
Incorrect Answers
B:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
C:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented SIEM source onboarding and parser quality decision.
D:This option addresses a different security operations topic (Detection rule field and logic troubleshooting) rather than the documented SIEM source onboarding and parser quality decision.
Question 433
The SOC team has not yet approved changes. Current evidence indicates: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
Explanation
Correct Answer
D:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Applied case: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution.
Incorrect Answers
A:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
B:This option addresses a different security operations topic (TCP stream and retransmission interpretation) rather than the documented SIEM source onboarding and parser quality decision.
C:Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 434
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required.
Explanation
Correct Answer
B:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
C:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 435
An implementation sign-off request identifies the following problem: An identity provider sends events to the SIEM but its parser maps the source user as the destination account and reverses attribution. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Verify: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Verify: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Change: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted. Verify: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Verify: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
Explanation
Correct Answer
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. The change is successful only when: Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
Incorrect Answers
B:This option addresses a different security operations topic (Control efficacy against an attack path) rather than the documented SIEM source onboarding and parser quality decision.
C:This option addresses a different security operations topic (User alert investigation next action) rather than the documented SIEM source onboarding and parser quality decision.
D:Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 436
A SOC analyst is examining this cybersecurity operations situation: A firewall reports connection action values in a custom field ignored by every existing correlation query. A proposed shortcut is: Treat any event that appears in a dashboard as correctly normalized regardless of parser mappings. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat any event that appears in a dashboard as correctly normalized regardless of parser mappings.
- Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture.
- Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Incorrect Answers
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Use this instead: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
C:Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 437
A Cisco cybersecurity incident response review finds: A firewall reports connection action values in a custom field ignored by every existing correlation query. The team proposes: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
- Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Explanation
Correct Answer
A:Demonstrable success requires: Key identity and network fields preserve meaning and collection failures produce explicit health alerts. This principle explains the proposed technical approach, which is: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
Incorrect Answers
B:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
C:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 438
The SOC team has not yet approved changes. Current evidence indicates: A firewall reports connection action values in a custom field ignored by every existing correlation query. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Replay representative authorized scans and malicious indicators across old and proposed rule versions.
Explanation
Correct Answer
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Applied case: A firewall reports connection action values in a custom field ignored by every existing correlation query.
Incorrect Answers
B:Compare model output with documented source links, DNS events, temporal context and known-benign collisions. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
C:Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Replay representative authorized scans and malicious indicators across old and proposed rule versions. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 439
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A firewall reports connection action values in a custom field ignored by every existing correlation query. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
Explanation
Correct Answer
B:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. The approved implementation step was: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
Incorrect Answers
A:Only approved clients use the exception and the team can detect abuse and remove the bypass when no longer required. A firewall reports connection action values in a custom field ignored by every existing correlation query.
C:This option addresses a different security operations topic (Patch testing and rollback planning) rather than the documented SIEM source onboarding and parser quality decision.
D:The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 440
For an original CBRCOR educational scenario, consider: A firewall reports connection action values in a custom field ignored by every existing correlation query. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Check: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Treat any event that appears in a dashboard as correctly normalized regardless of parser mappings.
Explanation
Correct Answer
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Required intervention: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
C:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Evidence: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
Incorrect Answers
B:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Check: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
