Cisco 350-201 Practice Test 57
Question 560
For an original CBRCOR educational scenario, consider: An internal file exchange crosses from a partner network to a regulated system without a documented trust boundary or control owner. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Assume the absence of a public-facing login page means all APIs have no external attack surface.
- Check: Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls.
Explanation
Correct Answer
C:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. Acceptance: Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
E:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. Evidence: Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
Incorrect Answers
A:Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
D:Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
Question 561
A SOC analyst is examining this cybersecurity operations situation: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal. A proposed shortcut is: Accept every submitted username as an authenticated administrator and grant file converters full database ownership. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Establish the authenticated actor and change provenance, then examine persistence, privileges and lateral activity using approved logs.
- Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Accept every submitted username as an authenticated administrator and grant file converters full database ownership.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal.
Incorrect Answers
A:Establish the authenticated actor and change provenance, then examine persistence, privileges and lateral activity using approved logs. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
C:Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 562
A Cisco cybersecurity incident response review finds: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal. The team proposes: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries.
- A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
- IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
- Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Explanation
Correct Answer
B:Relevant validation before approval: Review token validation, authorization decisions and service account grants for negative identity and permission tests. Applied case: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal.
Incorrect Answers
A:File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
C:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 563
The SOC team has not yet approved changes. Current evidence indicates: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Review token validation, authorization decisions and service account grants for negative identity and permission tests.
- Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
Explanation
Correct Answer
B:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Applied case: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal.
Incorrect Answers
A:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
C:Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 564
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
- Risky connections are restricted safely while essential device functionality and forensic observations remain preserved.
Explanation
Correct Answer
C:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Investigators present a defensible sequence with confidence and clearly separated benign explanations. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
B:Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:Risky connections are restricted safely while essential device functionality and forensic observations remain preserved. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 565
An implementation sign-off request identifies the following problem: A service accepts a user ID supplied in a request body as proof of identity and performs administrative actions without checking the authenticated principal. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. Verify: Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Verify: Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Verify: Review token validation, authorization decisions and service account grants for negative identity and permission tests.
- Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Verify: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
Explanation
Correct Answer
C:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. The change is successful only when: Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
Incorrect Answers
A:Change: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
B:Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
D:Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
Question 566
A SOC analyst is examining this cybersecurity operations situation: A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration. A proposed shortcut is: Accept every submitted username as an authenticated administrator and grant file converters full database ownership. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Accept every submitted username as an authenticated administrator and grant file converters full database ownership.
- Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Reconstruct authorized files or streams from packet evidence, verify completeness and hash recovered objects before isolated analysis.
- Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Incorrect Answers
A:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Use this instead: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
C:Reconstruct authorized files or streams from packet evidence, verify completeness and hash recovered objects before isolated analysis. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 567
A Cisco cybersecurity incident response review finds: A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration. The team proposes: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
- A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Explanation
Correct Answer
D:Relevant validation before approval: Review token validation, authorization decisions and service account grants for negative identity and permission tests. Demonstrable success requires: Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
Incorrect Answers
A:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
B:Threat severity is a function of access and consequence, not solely request frequency or component popularity. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
C:Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 568
The SOC team has not yet approved changes. Current evidence indicates: A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Review token validation, authorization decisions and service account grants for negative identity and permission tests.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Examine object access logs, policy history, credential use, request source and affected file classifications.
Explanation
Correct Answer
B:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Confirm afterward that: Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
Incorrect Answers
A:Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
C:Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:Examine object access logs, policy history, credential use, request source and affected file classifications. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 569
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
- Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
- The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
Explanation
Correct Answer
C:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Applied case: A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration.
Incorrect Answers
A:Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration.
B:Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
Question 570
For an original CBRCOR educational scenario, consider: A file-processing queue uses one highly privileged service account for both untrusted uploads and database administration. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Accept every submitted username as an authenticated administrator and grant file converters full database ownership.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls.
- Check: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Check: Review token validation, authorization decisions and service account grants for negative identity and permission tests.
Explanation
Correct Answer
A:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Evidence: Review token validation, authorization decisions and service account grants for negative identity and permission tests.
E:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Acceptance: Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
C:Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
D:Check: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event. A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
