Cisco 350-201 Practice Test 55
Question 540
For an original CBRCOR educational scenario, consider: An IDS signature triggers on legitimate signed updates because a byte-pattern match is applied without protocol or endpoint context. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Change: Validate field names, time windows, event source health and rule conditions, then refine content against representative samples.
- Change: Constrain exceptions by identity, source, time and monitoring, and schedule removal or replacement at an accountable review date.
- Suppress the entire security monitoring feed instead of repairing a parser reference or scoped rule condition.
- Check: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
Explanation
Correct Answer
B:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Evidence: Run known positive and negative test cases, inspect raw and parsed events and compare rule matches before publishing.
E:Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy. Acceptance: True attack test cases alert again while authorized activity no longer triggers the identified false-positive pattern.
Incorrect Answers
A:Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
C:This option addresses a different security operations topic (Control exception validation and compensating safeguards) rather than the documented Detection rule field and logic troubleshooting decision.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Detection logic depends on actual telemetry schemas and predicate semantics; parser changes or broad signatures can break accuracy.
Question 541
A SOC analyst is examining this cybersecurity operations situation: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics. A proposed shortcut is: Label every incident as exfiltration based only on the presence of a remote login or suspicious executable. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Recalibrate baseline windows, validate performance by asset group and monitor concept drift before expanding automated alert use.
- Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
- Label every incident as exfiltration based only on the presence of a remote login or suspicious executable.
- Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics.
Incorrect Answers
A:This option addresses a different security operations topic (Anomaly model drift and validation) rather than the documented MITRE ATT&CK tactics versus techniques decision.
B:Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
C:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 542
A Cisco cybersecurity incident response review finds: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics. The team proposes: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- DNS and TLS metadata support behavioral hypotheses but cannot by themselves reveal encrypted application contents or prove compromise.
- Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- Cloud data loss can occur through application links and APIs even when network perimeter monitoring sees no email attachment.
Explanation
Correct Answer
C:Demonstrable success requires: The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Applied case: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics.
Incorrect Answers
A:This option addresses a different security operations topic (DNS and TLS metadata in PCAP) rather than the documented MITRE ATT&CK tactics versus techniques decision.
B:Immutable image pipelines propagate security updates consistently; patching only live instances leaves future launches vulnerable. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
D:This option addresses a different security operations topic (Cloud and application DLP policy) rather than the documented MITRE ATT&CK tactics versus techniques decision.
Question 543
The SOC team has not yet approved changes. Current evidence indicates: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare timestamps with NTP sources, ingestion lag, parser fields and retention policies using a controlled multi-source event.
- Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
Explanation
Correct Answer
C:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Applied case: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics.
Incorrect Answers
A:This option addresses a different security operations topic (Security event retention and normalization) rather than the documented MITRE ATT&CK tactics versus techniques decision.
B:Review exception approval, constrained reachability, logs and expiry in a controlled negative and positive access test. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
D:Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Question 544
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- Every critical asset has a current owner and defensible posture measurement with known visibility gaps.
- The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
Explanation
Correct Answer
D:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
B:Every critical asset has a current owner and defensible posture measurement with known visibility gaps. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
C:The fleet reaches the intended secure version while key network and endpoint controls remain functional and rollback is tested. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Question 545
An implementation sign-off request identifies the following problem: Incident notes describe credential dumping followed by remote service creation, but the analyst classifies both as data exfiltration tactics. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution. Verify: Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. Verify: Inspect indicator provenance, first-seen and last-seen fields, confidence thresholds and policy expiry in a dry-run.
- Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. Verify: Review baseline access patterns, session source, VPN egress, new permissions and correlated endpoint telemetry.
- Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. Verify: Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
Explanation
Correct Answer
A:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. The change is successful only when: The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
Incorrect Answers
B:Change: Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
C:Change: Evaluate behavioral baselines with device, identity, network and business context before deciding whether anomalies indicate misuse. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
D:Change: Use AI-generated prioritization as a decision aid and require cited underlying events and human review before high-impact containment. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Question 546
A SOC analyst is examining this cybersecurity operations situation: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior. A proposed shortcut is: Label every incident as exfiltration based only on the presence of a remote login or suspicious executable. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement.
- Label every incident as exfiltration based only on the presence of a remote login or suspicious executable.
- Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
- Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior.
Incorrect Answers
A:Normalize incoming intelligence, preserve source and confidence metadata, enrich context and use bounded expiry before automated enforcement. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
B:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Applied case: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior.
D:Combine entity behavior score with change approvals, service ownership and privileged activity before setting incident severity. A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior.
Question 547
A Cisco cybersecurity incident response review finds: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior. The team proposes: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
- TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers.
- Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions.
- Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port.
Explanation
Correct Answer
A:Demonstrable success requires: The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses. Applied case: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior.
Incorrect Answers
B:TCP transport artifacts distinguish failed connectivity and loss from application-layer requests or multiple unique payload transfers. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
C:Management access is a separate high-value boundary and must be protected against unauthorized administrative sessions. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
D:Reducing attack surface means minimizing unneeded listeners while validating service dependencies rather than blindly closing every port. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Question 548
The SOC team has not yet approved changes. Current evidence indicates: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting.
- Compare model output with documented source links, DNS events, temporal context and known-benign collisions.
- Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events.
Explanation
Correct Answer
C:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare the model explanation, supporting log timestamps and labeled benign or malicious cases before acting. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
B:Compare model output with documented source links, DNS events, temporal context and known-benign collisions. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
D:Reproduce authorized and restricted USB and print operations with test documents and inspect enforcement events. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Question 549
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk.
- Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts.
- Unnecessary listeners disappear and critical application dependencies and security management continue functioning.
- The report supports its behavioral labels with telemetry and separates confirmed activity from hypotheses.
Explanation
Correct Answer
D:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. The approved implementation step was: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
Incorrect Answers
A:Leaders and responders can make appropriate decisions without misinterpreting raw alert volume as business risk. A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior.
B:Confirmed account misuse is restricted and benign events are documented without unnecessary enterprise-wide lockouts. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
C:Unnecessary listeners disappear and critical application dependencies and security management continue functioning. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
Question 550
For an original CBRCOR educational scenario, consider: A phishing login is followed by account discovery and lateral movement, yet the report records only a malware family name without actor behavior. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion.
- Check: Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
- Change: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
- Label every incident as exfiltration based only on the presence of a remote login or suspicious executable.
- Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations.
Explanation
Correct Answer
B:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Required intervention: Map observed adversary behaviors to relevant ATT&CK tactics and techniques with evidence and avoid asserting unsupported attribution.
C:ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases. Evidence: Associate each event with observed operation, target, timestamp and independently justified tactic and technique mapping.
Incorrect Answers
A:Check: Verify version and signature, simulate recovery, monitor service health and measure residual vulnerability before fleet-wide promotion. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
E:Change: Choose flow, logs or packet capture based on required fields, sensor placement, sampling and encryption limitations. ATT&CK tactics describe adversary objectives whereas techniques describe methods; an observed sequence can span multiple tactic phases.
