Cisco 350-201 Practice Test 53
Question 520
For an original CBRCOR educational scenario, consider: A file download captures many TCP retransmissions on one WAN link and investigators misclassify all duplicate segments as repeated data exfiltration. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
- Interpret every retransmitted segment as a separate successful file upload regardless of transport acknowledgement.
- Check: Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
- Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
Explanation
Correct Answer
A:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Acceptance: The diagnosis identifies actual transport failure or recovery without inventing completed application transactions.
D:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Applied case: A file download captures many TCP retransmissions on one WAN link and investigators misclassify all duplicate segments as repeated data exfiltration.
Incorrect Answers
B:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Distinguish the two approaches by checking: Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
C:Check: Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths. TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
E:Change: Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
Question 521
A SOC analyst is examining this cybersecurity operations situation: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution. A proposed shortcut is: Treat all TLS packets as plaintext and attribute malicious actions from a single unfamiliar domain name. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context.
- Treat all TLS packets as plaintext and attribute malicious actions from a single unfamiliar domain name.
- Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows.
- Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution.
Incorrect Answers
A:Correlate identity, authorization and endpoint or network events by principal, timeline and relevant device context. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Enforce explicit network-zone boundaries with least-privilege intersegment policies and monitor permitted application flows. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 522
A Cisco cybersecurity incident response review finds: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution. The team proposes: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- Least-privilege segmentation limits trust to approved flows and can incorporate authenticated workload or user attributes.
- A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions.
- DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions.
Explanation
Correct Answer
A:Demonstrable success requires: Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps. This principle explains the proposed technical approach, which is: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
Incorrect Answers
B:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented DNS and TLS metadata in PCAP decision.
C:A SIEM can correlate only what its collectors and parsers accurately ingest; incorrect fields create false investigative conclusions. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
D:DevSecOps shifts security checks into repeatable delivery workflows while retaining access control and auditable exceptions. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 523
The SOC team has not yet approved changes. Current evidence indicates: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Correlate CISA KEV or vendor alerts, affected versions, external reachability, mitigation status and change constraints.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Applied case: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution.
Incorrect Answers
A:Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
C:This option addresses a different security operations topic (Risk-aware patch prioritization) rather than the documented DNS and TLS metadata in PCAP decision.
D:Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 524
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Key identity and network fields preserve meaning and collection failures produce explicit health alerts.
- Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact.
- Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps.
- Truly unauthorized service use is contained while documented legitimate workload changes remain allowed.
Explanation
Correct Answer
C:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. The approved implementation step was: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
Incorrect Answers
A:Key identity and network fields preserve meaning and collection failures produce explicit health alerts. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
B:Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
D:Truly unauthorized service use is contained while documented legitimate workload changes remain allowed. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 525
An implementation sign-off request identifies the following problem: A capture shows repeated DNS queries for algorithmically unusual domains but the team assumes every NXDOMAIN proves command execution. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. Verify: Correlate credential creation, API endpoints, data sensitivity, maintenance tickets and baseline volume for the service.
- Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Verify: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Change: Stage deployment on representative systems, define health checks and rollback methods and phase production rollout by risk. Verify: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Verify: Filter the five-tuple, follow the TCP stream and compare SYN, ACK, reset and retransmission patterns against timestamps.
Explanation
Correct Answer
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. The change is successful only when: Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps.
Incorrect Answers
A:Change: Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
C:This option addresses a different security operations topic (Patch testing and rollback planning) rather than the documented DNS and TLS metadata in PCAP decision.
D:Change: Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 526
A SOC analyst is examining this cybersecurity operations situation: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry. A proposed shortcut is: Treat all TLS packets as plaintext and attribute malicious actions from a single unfamiliar domain name. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment.
- Treat all TLS packets as plaintext and attribute malicious actions from a single unfamiliar domain name.
- Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
- Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry.
Incorrect Answers
A:Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Use this instead: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
D:This option addresses a different security operations topic (AI-assisted security triage with analyst validation) rather than the documented DNS and TLS metadata in PCAP decision.
Question 527
A Cisco cybersecurity incident response review finds: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry. The team proposes: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause.
- Endpoint DLP can observe local data movement that network and cloud gateways may never see.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Explanation
Correct Answer
C:Demonstrable success requires: Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps. Applied case: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry.
Incorrect Answers
A:Tuning should reduce unhelpful alerts without suppressing essential attack patterns or expanding policy exceptions beyond their cause. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
B:Endpoint DLP can observe local data movement that network and cloud gateways may never see. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
D:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 528
The SOC team has not yet approved changes. Current evidence indicates: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
- Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections.
- Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps.
Explanation
Correct Answer
B:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Applied case: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry.
Incorrect Answers
A:This option addresses a different security operations topic (Network analysis capture and visibility limits) rather than the documented DNS and TLS metadata in PCAP decision.
C:Test allowed admin hosts and denied guest sources for SSH, HTTPS, SNMP and relevant control-plane protections. A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry.
D:Cross-check discovery records, network reachability, patch inventory and security agent last-seen timestamps. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 529
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Findings distinguish suspicious communications from confirmed malicious content and document remaining visibility gaps.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
Explanation
Correct Answer
C:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
B:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
D:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 530
For an original CBRCOR educational scenario, consider: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Change: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
- Treat all TLS packets as plaintext and attribute malicious actions from a single unfamiliar domain name.
- Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
- Check: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
Explanation
Correct Answer
D:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Evidence: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
E:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Required intervention: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
Incorrect Answers
A:This option addresses a different security operations topic (Golden machine image hardening) rather than the documented DNS and TLS metadata in PCAP decision.
B:This option addresses a different security operations topic (MITRE ATT&CK tactics versus techniques) rather than the documented DNS and TLS metadata in PCAP decision.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
