Cisco 350-201 Practice Test 60
Question 590
For an original CBRCOR educational scenario, consider: A small internal management interface is ignored because it has little user traffic, even though compromise would provide domain-wide administration. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
- Check: Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Prioritize security work solely by page views and dismiss seldom-used privileged administration paths.
- Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners.
Explanation
Correct Answer
B:Threat severity is a function of access and consequence, not solely request frequency or component popularity. Acceptance: The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes.
E:Threat severity is a function of access and consequence, not solely request frequency or component popularity. Evidence: Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
Incorrect Answers
A:Check: Replay representative benign installer traces and malicious test artifacts and compare true and false matches. Threat severity is a function of access and consequence, not solely request frequency or component popularity.
C:Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Threat severity is a function of access and consequence, not solely request frequency or component popularity.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Threat severity is a function of access and consequence, not solely request frequency or component popularity.
Question 591
A SOC analyst is examining this cybersecurity operations situation: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email. A proposed shortcut is: Delete the email only and assume no account investigation is needed once the user's inbox is clear. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
- Delete the email only and assume no account investigation is needed once the user's inbox is clear.
- Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
- Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email.
Incorrect Answers
A:This option addresses a different security operations topic (Malware strings and import-table analysis) rather than the documented Phishing-led credential compromise investigation decision.
B:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 592
A Cisco cybersecurity incident response review finds: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email. The team proposes: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
- A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
- Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
- Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
Explanation
Correct Answer
C:Relevant validation before approval: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Applied case: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email.
Incorrect Answers
A:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
B:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 593
The SOC team has not yet approved changes. Current evidence indicates: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
Explanation
Correct Answer
C:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Applied case: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email.
Incorrect Answers
A:Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
B:Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 594
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case identifies whether protected data left the approved boundary and preserves evidence for affected records.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Explanation
Correct Answer
D:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:This option addresses a different security operations topic (Suspicious data-transfer investigation) rather than the documented Phishing-led credential compromise investigation decision.
B:Investigators present a defensible sequence with confidence and clearly separated benign explanations. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
C:Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 595
An implementation sign-off request identifies the following problem: An employee reports a suspicious OAuth consent page and later signs in from an unknown device, but help desk closes the case after deleting the email. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Verify: Examine object access logs, policy history, credential use, request source and affected file classifications.
- Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners. Verify: Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Verify: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Change: Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Verify: Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
Explanation
Correct Answer
C:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. The change is successful only when: Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Incorrect Answers
A:Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access.
B:This option addresses a different security operations topic (Threat model prioritization against business impact) rather than the documented Phishing-led credential compromise investigation decision.
D:This option addresses a different security operations topic (Complex IOC quality and safety in sandbox) rather than the documented Phishing-led credential compromise investigation decision.
Question 596
A SOC analyst is examining this cybersecurity operations situation: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules. A proposed shortcut is: Delete the email only and assume no account investigation is needed once the user's inbox is clear. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
- Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
- Delete the email only and assume no account investigation is needed once the user's inbox is clear.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules.
Incorrect Answers
A:Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
B:Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Applied case: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules.
Question 597
A Cisco cybersecurity incident response review finds: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules. The team proposes: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
- Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
- Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Explanation
Correct Answer
D:Relevant validation before approval: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Applied case: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules.
Incorrect Answers
A:This option addresses a different security operations topic (IoT and industrial endpoint investigation) rather than the documented Phishing-led credential compromise investigation decision.
B:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
C:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 598
The SOC team has not yet approved changes. Current evidence indicates: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment.
Explanation
Correct Answer
B:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Confirm afterward that: Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Incorrect Answers
A:This option addresses a different security operations topic (Malware safe evidence extraction from PCAP) rather than the documented Phishing-led credential compromise investigation decision.
C:Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 599
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
- The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
Explanation
Correct Answer
C:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. The approved implementation step was: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
Incorrect Answers
A:Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
B:The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Investigators present a defensible sequence with confidence and clearly separated benign explanations. A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules.
Question 600
For an original CBRCOR educational scenario, consider: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Result: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty.
- Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
- Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points.
- Result: Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Explanation
Correct Answer
A:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Acceptance: Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
C:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Evidence: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
F:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Required intervention: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
Incorrect Answers
B:Result: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
E:Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
