Cisco 350-201 Practice Test 50
Question 490
For an original CBRCOR educational scenario, consider: A backup service increases its API request rate during an approved migration and the UEBA model flags the expected burst. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
- Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Check: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Check: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Whitelist every service account permanently because automated identities cannot be compromised.
Explanation
Correct Answer
A:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Acceptance: Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
D:Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume. Required intervention: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
Incorrect Answers
B:Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
C:Check: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Machine identity baselines require knowledge of scheduled jobs and intended privilege scope, not only deviations in event volume.
Question 491
A SOC analyst is examining this cybersecurity operations situation: A cloud identity alert reports repeated denied MFA prompts followed by a suspicious grant of administrative permissions. A proposed shortcut is: Rotate all organization secrets immediately for any new-browser notification without performing even basic evidence checks. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rotate all organization secrets immediately for any new-browser notification without performing even basic evidence checks.
- Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted.
- Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity.
- Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Validate the premise using: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
Incorrect Answers
A:A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Apply cloud and application DLP policies to sharing permissions, sensitive-content detection and sanctioned app activity. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
D:Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 492
A Cisco cybersecurity incident response review finds: A cloud identity alert reports repeated denied MFA prompts followed by a suspicious grant of administrative permissions. The team proposes: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Defense in depth requires each relevant trust boundary to be enforced and monitored rather than relying on one edge device.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
- AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence.
Explanation
Correct Answer
C:Relevant validation before approval: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Demonstrable success requires: Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
Incorrect Answers
A:This option addresses a different security operations topic (Control efficacy against an attack path) rather than the documented User alert investigation next action decision.
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
D:AI can prioritize likely relationships but indicator matching and attribution require independently corroborated evidence. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 493
The SOC team has not yet approved changes. Current evidence indicates: A cloud identity alert reports repeated denied MFA prompts followed by a suspicious grant of administrative permissions. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths.
- Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Replay representative authorized scans and malicious indicators across old and proposed rule versions.
- Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
Explanation
Correct Answer
B:Confirm afterward that: Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts. Applied case: A cloud identity alert reports repeated denied MFA prompts followed by a suspicious grant of administrative permissions.
Incorrect Answers
A:Inspect TLS enforcement, storage encryption, key access, runtime permissions and actual data sharing paths. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
C:Replay representative authorized scans and malicious indicators across old and proposed rule versions. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
D:Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 494
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A cloud identity alert reports repeated denied MFA prompts followed by a suspicious grant of administrative permissions. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
- Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality.
- Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval.
- Detection quality remains measured across representative groups with investigated drift and bounded alert noise.
Explanation
Correct Answer
A:A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
C:Analysts can reconstruct an ordered incident trail and verify records remain available for the required interval. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
D:Detection quality remains measured across representative groups with investigated drift and bounded alert noise. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 495
An implementation sign-off request identifies the following problem: A cloud identity alert reports repeated denied MFA prompts followed by a suspicious grant of administrative permissions. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. Verify: Replay false-positive and true-positive events through enrichment outputs, human approval gates and cancellation paths.
- Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. Verify: Compare raw sample events with normalized user, source IP, action, timestamp and device fields.
- Change: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted. Verify: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Verify: Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
Explanation
Correct Answer
C:The change is successful only when: Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
Incorrect Answers
A:Change: Build a SOAR sequence with source validation, enrichment, branching, approvals and documented rollback for consequential actions. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
B:Change: Validate source onboarding, field mapping, time parsing and health before using normalized events in production detection content. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
D:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 496
A SOC analyst is examining this cybersecurity operations situation: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals. A proposed shortcut is: Rotate all organization secrets immediately for any new-browser notification without performing even basic evidence checks. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted.
- Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation.
- Rotate all organization secrets immediately for any new-browser notification without performing even basic evidence checks.
- Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals.
Incorrect Answers
B:Prioritize remediation by exploit activity, exposure, asset criticality and compensating controls, with accelerated action for active exploitation. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
C:A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency. Applied case: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals.
D:Add automated dependency and image scanning, protected credentials, artifact provenance and approval checks before production promotion. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 497
A Cisco cybersecurity incident response review finds: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals. The team proposes: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Compensating controls can reduce a specific residual risk but do not eliminate the need to understand and govern the original deficiency.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Explanation
Correct Answer
D:Relevant validation before approval: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Applied case: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals.
Incorrect Answers
A:This option addresses a different security operations topic (Control exception validation and compensating safeguards) rather than the documented User alert investigation next action decision.
B:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
C:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 498
The SOC team has not yet approved changes. Current evidence indicates: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios.
- Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
Explanation
Correct Answer
D:Confirm afterward that: Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts. Applied case: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals.
Incorrect Answers
A:Trace one release through tested dependencies, secret access, artifact digest, scan findings and blocked promotion scenarios. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
B:Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
C:Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 499
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality.
- The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk.
- Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
Explanation
Correct Answer
C:A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency. The approved implementation step was: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted.
Incorrect Answers
A:Elevated alerts receive proportionate investigation and documented benign causes are used to improve detection quality. A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals.
B:The most exposed exploited assets are addressed first with explicit deadlines and documented residual risk. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
D:Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Question 500
For an original CBRCOR educational scenario, consider: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Tailor dashboards to stakeholder decisions using incident severity, asset exposure, response outcomes and contextual trends.
- Change: Verify alert evidence and identity ownership, prioritize based on harmful follow-on actions and invoke approved credential containment when warranted.
- Result: The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
- Check: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity.
- Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone.
- Result: Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
Explanation
Correct Answer
B:Evidence: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. Applied case: A SIEM notes a privileged user signing in from a new browser but no associated abnormal activity or corroborating signals.
D:Acceptance: Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
F:Evidence: Inspect MFA challenge history, session tokens, new grants, device state and the user's confirmed activity. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
Incorrect Answers
A:Change: Tailor dashboards to stakeholder decisions using incident severity, asset exposure, response outcomes and contextual trends. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
C:Result: The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
E:Check: Test legitimate transaction flows and disallowed administrative connections from each relevant source VLAN or zone. A user anomaly is a hypothesis; subsequent privileged actions and authentication evidence change response urgency.
