Cisco 350-201 Practice Test 49
Question 480
For an original CBRCOR educational scenario, consider: An employee travels internationally and generates impossible-travel alerts even though the sign-in location is a corporate VPN exit. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Check: Review baseline access patterns, session source, VPN egress, new permissions and correlated endpoint telemetry.
- Disable every account whose login location changes without validating proxy, travel or device context.
- Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse.
Explanation
Correct Answer
B:UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes. Acceptance: Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality.
E:UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes. Evidence: Review baseline access patterns, session source, VPN egress, new permissions and correlated endpoint telemetry.
Incorrect Answers
A:Check: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths. UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
D:Change: Tune specific signatures, thresholds and scoped allowlists using known benign workloads and preserved malicious test coverage. UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
Question 481
A SOC analyst is examining this cybersecurity operations situation: A build service principal suddenly reads thousands of employee profiles after a new credential was created by an unknown actor. A proposed shortcut is: Whitelist every service account permanently because automated identities cannot be compromised. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Whitelist every service account permanently because automated identities cannot be compromised.
- Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Incorrect Answers
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:This option addresses a different security operations topic (Patch testing and rollback planning) rather than the documented UEBA service account burst anomalies decision.
C:Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 482
A Cisco cybersecurity incident response review finds: A build service principal suddenly reads thousands of employee profiles after a new credential was created by an unknown actor. The team proposes: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
- Hardening guidance is platform and workload specific; a relevant benchmark needs a tested applicability and exception review.
- Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
- Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals.
Explanation
Correct Answer
C:Demonstrable success requires: Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. This principle explains the proposed technical approach, which is: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
Incorrect Answers
A:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
B:This option addresses a different security operations topic (CIS benchmarks and vendor baselines) rather than the documented UEBA service account burst anomalies decision.
D:Technical analysts need actionable evidence while executives need accurate risk and service impact rather than uncontextualized event totals. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 483
The SOC team has not yet approved changes. Current evidence indicates: A build service principal suddenly reads thousands of employee profiles after a new credential was created by an unknown actor. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience.
- Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
Explanation
Correct Answer
B:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Confirm afterward that: Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
Incorrect Answers
A:Compare dashboard labels, metric definitions, incidents in progress and evidence drilldowns for each audience. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented UEBA service account burst anomalies decision.
D:This option addresses a different security operations topic (Security event retention and normalization) rather than the documented UEBA service account burst anomalies decision.
Question 484
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A build service principal suddenly reads thousands of employee profiles after a new credential was created by an unknown actor. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence.
- Restricted local transfers are blocked or appropriately audited while approved business use remains possible.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
Explanation
Correct Answer
D:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
B:Unauthorized paths are denied and each crucial control action leaves sufficient forensic evidence. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:Restricted local transfers are blocked or appropriately audited while approved business use remains possible. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 485
An implementation sign-off request identifies the following problem: A build service principal suddenly reads thousands of employee profiles after a new credential was created by an unknown actor. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Verify: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Verify: Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Verify: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Verify: Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
Explanation
Correct Answer
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. The change is successful only when: Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
Incorrect Answers
B:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
D:Change: Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 486
A SOC analyst is examining this cybersecurity operations situation: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst. A proposed shortcut is: Whitelist every service account permanently because automated identities cannot be compromised. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
- Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
- Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
- Whitelist every service account permanently because automated identities cannot be compromised.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst.
Incorrect Answers
A:Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
B:This option addresses a different security operations topic (MITRE ATT&CK tactics versus techniques) rather than the documented UEBA service account burst anomalies decision.
D:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Applied case: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst.
Question 487
A Cisco cybersecurity incident response review finds: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst. The team proposes: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
- Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources.
- Flow records summarize connections while full capture can preserve protocol packets only where visibility and collection policy permit.
- Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Explanation
Correct Answer
D:Demonstrable success requires: Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. Applied case: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst.
Incorrect Answers
A:This option addresses a different security operations topic (TCP stream and retransmission interpretation) rather than the documented UEBA service account burst anomalies decision.
B:Internal segmentation limits lateral movement and constrains which source segments can reach sensitive resources. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:Flow records summarize connections while full capture can preserve protocol packets only where visibility and collection policy permit. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 488
The SOC team has not yet approved changes. Current evidence indicates: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
Explanation
Correct Answer
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
B:This option addresses a different security operations topic (Detection rule field and logic troubleshooting) rather than the documented UEBA service account burst anomalies decision.
C:This option addresses a different security operations topic (DNS and TLS metadata in PCAP) rather than the documented UEBA service account burst anomalies decision.
D:Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 489
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
- Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible.
- Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access.
Explanation
Correct Answer
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. The approved implementation step was: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
Incorrect Answers
B:The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:Unapproved vulnerabilities or credential exposure stop deployment and authorized releases remain reproducible. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
D:Sensitive data receives controls suited to its lifecycle with approved users and applications retaining needed access. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 490
For an original CBRCOR educational scenario, consider: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
- Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Check: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Check: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Whitelist every service account permanently because automated identities cannot be compromised.
Explanation
Correct Answer
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Acceptance: Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
D:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Required intervention: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
Incorrect Answers
B:Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:Check: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
