Cisco 350-201 Practice Test 46
Question 450
For an original CBRCOR educational scenario, consider: An account receives many MFA-denied prompts and later succeeds from another device, yet the SOC threshold looks only at successful logins. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage.
- Check: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Close any account alert as benign if the final authentication succeeded without reviewing preceding denied attempts.
Explanation
Correct Answer
C:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Required intervention: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
D:Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity. Evidence: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
Incorrect Answers
A:Check: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
B:Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Cross-source correlation strengthens hypotheses by connecting related actions while still requiring verification against legitimate activity.
Question 451
A SOC analyst is examining this cybersecurity operations situation: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility. A proposed shortcut is: Convert every external indicator into unconditional automatic user disablement with no review. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
- Convert every external indicator into unconditional automatic user disablement with no review.
- Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
- Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility.
Incorrect Answers
A:Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
B:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 452
A Cisco cybersecurity incident response review finds: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility. The team proposes: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
- Cloud data loss can occur through application links and APIs even when network perimeter monitoring sees no email attachment.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Explanation
Correct Answer
C:Demonstrable success requires: Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization. Applied case: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility.
Incorrect Answers
A:A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
B:This option addresses a different security operations topic (Cloud and application DLP policy) rather than the documented SOAR enrichment before containment decision.
D:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 453
The SOC team has not yet approved changes. Current evidence indicates: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
Explanation
Correct Answer
B:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Applied case: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility.
Incorrect Answers
A:Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
C:Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 454
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
- The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
- Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads.
Explanation
Correct Answer
C:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
B:The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:Escalated matches have a reproducible evidence trail and unconfirmed associations remain investigatory leads. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 455
An implementation sign-off request identifies the following problem: An orchestration workflow receives an untrusted URL indicator and immediately disables every associated user account without checking source credibility. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Verify: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Verify: Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Verify: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Verify: Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
Explanation
Correct Answer
A:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. The change is successful only when: Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
Incorrect Answers
B:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
C:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 456
A SOC analyst is examining this cybersecurity operations situation: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval. A proposed shortcut is: Convert every external indicator into unconditional automatic user disablement with no review. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Convert every external indicator into unconditional automatic user disablement with no review.
- Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
- Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval.
Incorrect Answers
A:Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
B:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Applied case: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval.
D:Apply appropriate transport encryption, at-rest protection and runtime access restrictions to each data state and trust boundary. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 457
A Cisco cybersecurity incident response review finds: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval. The team proposes: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
- Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions.
Explanation
Correct Answer
B:Demonstrable success requires: Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization. Applied case: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval.
Incorrect Answers
A:Patching reduces vulnerability exposure but unvalidated mass change can disrupt availability or disable protective agents. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
C:AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:Predictive and generative models can accelerate triage but can produce false positives, missing context and unverifiable conclusions. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 458
The SOC team has not yet approved changes. Current evidence indicates: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Replay representative authorized scans and malicious indicators across old and proposed rule versions.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
Explanation
Correct Answer
B:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Confirm afterward that: Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
Incorrect Answers
A:Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
C:Replay representative authorized scans and malicious indicators across old and proposed rule versions. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 459
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
- Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
Explanation
Correct Answer
A:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. The approved implementation step was: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
Incorrect Answers
B:Detection quality remains measured across representative groups with investigated drift and bounded alert noise. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
C:Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
Question 460
For an original CBRCOR educational scenario, consider: A SOC uses automated ticket creation but cannot pause a high-impact endpoint-isolation step for incident commander approval. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
- Convert every external indicator into unconditional automatic user disablement with no review.
- Check: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
Explanation
Correct Answer
B:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Acceptance: Supported cases proceed efficiently while uncertain or disruptive actions await appropriate authorization.
E:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Required intervention: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
Incorrect Answers
A:This option addresses a different security operations topic (Control efficacy against an attack path) rather than the documented SOAR enrichment before containment decision.
C:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
