Cisco 350-201 Practice Test 45
Question 440
For an original CBRCOR educational scenario, consider: A firewall reports connection action values in a custom field ignored by every existing correlation query. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
- Check: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Treat any event that appears in a dashboard as correctly normalized regardless of parser mappings.
Explanation
Correct Answer
A:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Required intervention: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content.
C:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. Evidence: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
Incorrect Answers
B:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
D:Check: Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
Question 441
A SOC analyst is examining this cybersecurity operations situation: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage. A proposed shortcut is: Close any account alert as benign if the final authentication succeeded without reviewing preceding denied attempts. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Close any account alert as benign if the final authentication succeeded without reviewing preceding denied attempts.
- Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture.
- Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage.
Incorrect Answers
A:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
D:Add endpoint DLP or device-control monitoring at the actual local copy and print pathways, consistent with classification policy. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 442
A Cisco cybersecurity incident response review finds: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage. The team proposes: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
- TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Explanation
Correct Answer
A:Demonstrable success requires: The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Applied case: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage.
Incorrect Answers
B:Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
C:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 443
The SOC team has not yet approved changes. Current evidence indicates: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
A:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Applied case: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage.
Incorrect Answers
B:Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
C:Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
D:Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 444
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Only approved management origins reach administrative services and unexpected attempts are logged.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
- Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
Explanation
Correct Answer
B:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Only approved management origins reach administrative services and unexpected attempts are logged. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
C:Restricted local transfers are blocked or appropriately audited while approved business use remains possible. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
D:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 445
An implementation sign-off request identifies the following problem: A suspicious login originates from a new geography and is followed by privileged changes, but each event is reviewed separately without linkage. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Verify: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Verify: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Change: Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. Verify: Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Verify: Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
Explanation
Correct Answer
B:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. The change is successful only when: The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
Incorrect Answers
A:Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
C:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented SIEM multi-source correlation for account misuse decision.
D:Change: Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 446
A SOC analyst is examining this cybersecurity operations situation: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins. A proposed shortcut is: Close any account alert as benign if the final authentication succeeded without reviewing preceding denied attempts. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Close any account alert as benign if the final authentication succeeded without reviewing preceding denied attempts.
- Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture.
- Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins.
Incorrect Answers
B:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Applied case: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins.
C:Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins.
D:Select current CIS Benchmarks, vendor guides and organization policy appropriate to the asset version and business role. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 447
A Cisco cybersecurity incident response review finds: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins. The team proposes: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
- Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
- Cloud data loss can occur through application links and APIs even when network perimeter monitoring sees no email attachment.
- Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency.
Explanation
Correct Answer
B:Demonstrable success requires: The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Applied case: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins.
Incorrect Answers
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
C:Cloud data loss can occur through application links and APIs even when network perimeter monitoring sees no email attachment. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
D:This option addresses a different security operations topic (Control exception validation and compensating safeguards) rather than the documented SIEM multi-source correlation for account misuse decision.
Question 448
The SOC team has not yet approved changes. Current evidence indicates: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare labeled test windows, feature distributions, precision and recall before and after the operational change.
- Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
- Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
Explanation
Correct Answer
D:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare labeled test windows, feature distributions, precision and recall before and after the operational change. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
B:Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
C:Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 449
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
Explanation
Correct Answer
A:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. The approved implementation step was: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
Incorrect Answers
B:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins.
C:Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
D:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 450
For an original CBRCOR educational scenario, consider: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage.
- Check: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Close any account alert as benign if the final authentication succeeded without reviewing preceding denied attempts.
Explanation
Correct Answer
C:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Required intervention: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
D:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Evidence: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
Incorrect Answers
A:Check: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
B:Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
