Cisco 350-201 Practice Test 54
Question 530
For an original CBRCOR educational scenario, consider: A TLS session to a rare destination is captured but analysts claim to know the encrypted HTTP body without keys or endpoint telemetry. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
- Change: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
- Treat all TLS packets as plaintext and attribute malicious actions from a single unfamiliar domain name.
- Change: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
- Check: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
Explanation
Correct Answer
D:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Evidence: Review resolver responses, name patterns, certificate or SNI visibility and corresponding host activity within a bounded interval.
E:DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise. Required intervention: Correlate DNS answers, timing, TLS handshake metadata and endpoint logs while explicitly respecting encrypted-content limits.
Incorrect Answers
A:This option addresses a different security operations topic (Golden machine image hardening) rather than the documented DNS and TLS metadata in PCAP decision.
B:This option addresses a different security operations topic (MITRE ATT&CK tactics versus techniques) rather than the documented DNS and TLS metadata in PCAP decision.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
Question 531
A SOC analyst is examining this cybersecurity operations situation: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised. A proposed shortcut is: Suppress the entire security monitoring feed instead of repairing a parser reference or scoped rule condition. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
- Suppress the entire security monitoring feed instead of repairing a parser reference or scoped rule condition.
- Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions.
- Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised.
Incorrect Answers
A:Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
B:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Identify unnecessary exposed services by workload dependency and disable or restrict them without removing required business functions. A SIEM correlation rule stops firing after a parser update renamed src_ip to source.
Question 532
A Cisco cybersecurity incident response review finds: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised. The team proposes: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
- Flow records summarize connections while full capture can preserve protocol packets only where visibility and collection policy permit.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
- UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
Explanation
Correct Answer
C:Relevant validation before approval: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. Applied case: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised.
Incorrect Answers
A:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
B:Flow records summarize connections while full capture can preserve protocol packets only where visibility and collection policy permit. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
D:UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Question 533
The SOC team has not yet approved changes. Current evidence indicates: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy.
Explanation
Correct Answer
B:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Applied case: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised.
Incorrect Answers
A:Test public versus restricted sharing, sensitivity labels, audit events and approved exceptions in a representative SaaS workspace. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
C:Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
D:Compare source image digest, package scan, approved baseline and a fresh deployment against the operational policy. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Question 534
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact.
- The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names.
- True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
- Approved baseline settings reduce unnecessary exposure while documented required functions continue operating.
Explanation
Correct Answer
C:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Sensitive documents cannot be anonymously distributed while authorized collaboration remains intact. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
B:The case captures a coherent sequence with discriminating evidence and avoids merging unrelated users with similar names. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
D:Approved baseline settings reduce unnecessary exposure while documented required functions continue operating. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Question 535
An implementation sign-off request identifies the following problem: A SIEM correlation rule stops firing after a parser update renamed src_ip to source.ip and its query was not revised. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. Verify: Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Verify: Compare capture location, SPAN or TAP paths, time sync, packet drops and available metadata for a test connection.
- Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. Verify: Simulate permitted and denied flows plus authorized privilege grants in a lab and compare expected logs and enforcement results.
- Change: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples. Verify: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
D:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. The change is successful only when: True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
Incorrect Answers
A:Change: Correlate AI-suggested threats with sourced intelligence, local telemetry and confidence or false-match checks before containment. A SIEM correlation rule stops firing after a parser update renamed src_ip to source.
B:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
C:Change: Test controls against the complete attacker path and add missing segmentation or identity telemetry at the observed gap. A SIEM correlation rule stops firing after a parser update renamed src_ip to source.
Question 536
A SOC analyst is examining this cybersecurity operations situation: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context. A proposed shortcut is: Suppress the entire security monitoring feed instead of repairing a parser reference or scoped rule condition. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Suppress the entire security monitoring feed instead of repairing a parser reference or scoped rule condition.
- Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
- Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture.
- Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context.
Incorrect Answers
A:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Applied case: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context.
C:Reconcile authoritative asset inventory, ownership, supported vulnerability scanning, configuration and sensor coverage before assigning posture. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
D:Follow TCP handshake, sequence acknowledgments, stream reassembly and retransmission context before inferring application behavior. An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context.
Question 537
A Cisco cybersecurity incident response review finds: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context. The team proposes: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
- TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
- SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes.
- UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes.
Explanation
Correct Answer
A:Relevant validation before approval: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing. Applied case: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context.
Incorrect Answers
B:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
C:SOAR coordinates repeatable tasks but requires guardrails when uncertain inputs might trigger disruptive production changes. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
D:UEBA scores deviations from learned behavior; contextual evidence distinguishes genuine account compromise from legitimate operational changes. An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context.
Question 538
The SOC team has not yet approved changes. Current evidence indicates: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Map service dependencies, evaluate permitted identity posture and test denied lateral flows and legitimate service paths.
- Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window.
- Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
D:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Confirm afterward that: True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
Incorrect Answers
A:This option addresses a different security operations topic (Security event retention and normalization) rather than the documented Detection rule field and logic troubleshooting decision.
B:This option addresses a different security operations topic (Identity-aware microsegmentation) rather than the documented Detection rule field and logic troubleshooting decision.
C:Query synchronized sign-in, MFA, directory-change and EDR events for the same identity in a defined time window. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Question 539
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
- True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
- Needed application traffic remains available while unauthorized cross-zone access is denied and logged.
- Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision.
Explanation
Correct Answer
B:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. The approved implementation step was: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
Incorrect Answers
A:The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
C:Needed application traffic remains available while unauthorized cross-zone access is denied and logged. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
D:Newly launched instances consistently meet the reviewed security baseline and can be traced to an approved image revision. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Question 540
For an original CBRCOR educational scenario, consider: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Change: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
- Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Suppress the entire security monitoring feed instead of repairing a parser reference or scoped rule condition.
- Check: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
B:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Evidence: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
E:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Acceptance: True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
Incorrect Answers
A:Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
C:This option addresses a different security operations topic (Control exception validation and compensating safeguards) rather than the documented Detection rule field and logic troubleshooting decision.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
