Cisco 350-201 Practice Test 5
Question 40
For an original CBRCOR educational scenario, consider: A remote laptop is suspected of credential theft and the team attempts disk imaging before collecting rapidly disappearing memory evidence. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
- Reboot every suspected host first and use only a perimeter vulnerability scan to reconstruct running processes.
- Check: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
- Change: Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
Explanation
Correct Answer
D:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Acceptance: The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
E:Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state. Evidence: Compare required artifacts against EDR collection capabilities, endpoint access and evidence hash or timestamp requirements.
Incorrect Answers
A:Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
B:This option addresses a different security operations topic (IaaS guest responsibility versus provider platform) rather than the documented Forensic tool selection for endpoint evidence decision.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Question 41
A SOC analyst is examining this cybersecurity operations situation: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations. A proposed shortcut is: Assume any one security dashboard screenshot proves full packet contents and precise data exfiltration volume. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity.
- Assume any one security dashboard screenshot proves full packet contents and precise data exfiltration volume.
- Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
- Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations.
Incorrect Answers
A:Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
B:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:This option addresses a different security operations topic (Cyber insurance risk transfer) rather than the documented Network monitoring tool selection decision.
Question 42
A Cisco cybersecurity incident response review finds: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations. The team proposes: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Accepting residual risk is an informed governance decision after threats, remaining exposure and mitigation feasibility are described.
- Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
- PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
Explanation
Correct Answer
C:Demonstrable success requires: Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations. This principle explains the proposed technical approach, which is: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
Incorrect Answers
A:This option addresses a different security operations topic (Risk treatment and residual acceptance) rather than the documented Network monitoring tool selection decision.
B:Incident response is a controlled lifecycle with feedback; technical containment is only one stage of operational resolution. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
D:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
Question 43
The SOC team has not yet approved changes. Current evidence indicates: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
Explanation
Correct Answer
D:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Applied case: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations.
Incorrect Answers
A:Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
B:Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
C:Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
Question 44
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
- Responders select proportionate actions and still have an approved route when the primary mitigation dependency fails.
Explanation
Correct Answer
A:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. The approved implementation step was: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
Incorrect Answers
B:Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
C:Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
D:This option addresses a different security operations topic (Playbook branching and exception handling) rather than the documented Network monitoring tool selection decision.
Question 45
An implementation sign-off request identifies the following problem: Analysts investigate possible DNS tunneling but select a host patch scanner that cannot display query volumes or resolver destinations. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. Verify: Verify affected host and identity scope, ongoing traffic, critical workflows and allowed emergency actions.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. Verify: Inspect personal-data flows, financial reporting systems, report criteria and contractual assurance scope separately.
- Change: Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy. Verify: Re-run a labeled set of benign and malicious activity against the rule and review precision, recall and handling effort.
Explanation
Correct Answer
B:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. The change is successful only when: Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
Incorrect Answers
A:Change: Match containment urgency to evidence, blast radius and predefined approval authority, documenting alternative isolation options. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
C:Change: Distinguish privacy, financial-reporting and service-assurance requirements and map each to the actual business activity. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
D:Change: Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy.
Question 46
A SOC analyst is examining this cybersecurity operations situation: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard. A proposed shortcut is: Assume any one security dashboard screenshot proves full packet contents and precise data exfiltration volume. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Assume any one security dashboard screenshot proves full packet contents and precise data exfiltration volume.
- Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
- Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard.
Incorrect Answers
A:Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
B:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Use this instead: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
D:Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
Question 47
A Cisco cybersecurity incident response review finds: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard. The team proposes: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- Endpoint process and memory evidence can disappear on reboot, whereas a port scanner cannot capture host-local volatile state.
Explanation
Correct Answer
A:Demonstrable success requires: Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations. Applied case: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard.
Incorrect Answers
B:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
C:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
D:This option addresses a different security operations topic (Forensic tool selection for endpoint evidence) rather than the documented Network monitoring tool selection decision.
Question 48
The SOC team has not yet approved changes. Current evidence indicates: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
Explanation
Correct Answer
D:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Applied case: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard.
Incorrect Answers
A:Recalculate detection and containment durations from source alert, first malicious activity, intervention and restoration timestamps. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
B:This option addresses a different security operations topic (Website-defacement response workflow) rather than the documented Network monitoring tool selection decision.
C:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
Question 49
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider.
- The diagram correctly labels each hosting boundary and avoids assuming shared security responsibilities across unlike environments.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible.
Explanation
Correct Answer
C:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The cloud VM follows customer-owned guest and access controls without falsely attributing them to the provider. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
B:This option addresses a different security operations topic (Private public hybrid and multicloud boundaries) rather than the documented Network monitoring tool selection decision.
D:Confirmed harmful activity is restricted promptly while unrelated production services stay available where feasible. A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard.
Question 50
For an original CBRCOR educational scenario, consider: A data-exfiltration case needs a traffic timeline and flow direction but the team relies only on a single screenshot of a firewall dashboard. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Assume any one security dashboard screenshot proves full packet contents and precise data exfiltration volume.
- Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties.
- Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
Explanation
Correct Answer
A:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Required intervention: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
E:DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption. Acceptance: Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
C:Change: Assign guest operating-system hardening, identity policy and network exposure controls to the IaaS customer while recording provider infrastructure duties. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
D:Check: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage. DNS logs identify queried names while flow records show connection summaries and packet capture can expose protocol detail subject to encryption.
