Cisco 350-201 Practice Test 61
Question 600
For an original CBRCOR educational scenario, consider: A phishing message appears to come from HR while mail headers and identity logs show impossible travel and new mailbox forwarding rules. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Result: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty.
- Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
- Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points.
- Result: Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Explanation
Correct Answer
A:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Acceptance: Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
C:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Evidence: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
F:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Required intervention: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
Incorrect Answers
B:Result: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
D:Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
E:Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Question 601
A SOC analyst is examining this cybersecurity operations situation: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow. A proposed shortcut is: Classify every large data transfer as malicious and shut down all approved backup or analytics services. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
- Classify every large data transfer as malicious and shut down all approved backup or analytics services.
- Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact.
- Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow.
Incorrect Answers
A:Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 602
A Cisco cybersecurity incident response review finds: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow. The team proposes: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
- Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
- Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Explanation
Correct Answer
D:Demonstrable success requires: The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Applied case: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow.
Incorrect Answers
A:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
C:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 603
The SOC team has not yet approved changes. Current evidence indicates: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
Explanation
Correct Answer
B:Confirm afterward that: The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Applied case: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow.
Incorrect Answers
A:Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
C:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 604
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
- The case identifies whether protected data left the approved boundary and preserves evidence for affected records.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
Explanation
Correct Answer
B:The approved implementation step was: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Applied case: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow.
Incorrect Answers
A:Investigators present a defensible sequence with confidence and clearly separated benign explanations. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
C:The case identifies material unauthorized behavior and preserves evidence for further containment. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 605
An implementation sign-off request identifies the following problem: A workstation uploads a large encrypted archive to a newly seen storage provider after working hours and the owner cannot identify a business workflow. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Verify: Examine object access logs, policy history, credential use, request source and affected file classifications.
- Change: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Verify: Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Change: Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Verify: Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
- Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Verify: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
Explanation
Correct Answer
B:The change is successful only when: The case identifies whether protected data left the approved boundary and preserves evidence for affected records.
Incorrect Answers
A:Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
C:Change: Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry.
Question 606
A SOC analyst is examining this cybersecurity operations situation: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident. A proposed shortcut is: Classify every large data transfer as malicious and shut down all approved backup or analytics services. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners.
- Classify every large data transfer as malicious and shut down all approved backup or analytics services.
- Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination.
- Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
Incorrect Answers
A:Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
C:Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 607
A Cisco cybersecurity incident response review finds: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident. The team proposes: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
- Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
- Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Explanation
Correct Answer
B:Demonstrable success requires: The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Applied case: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
Incorrect Answers
A:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
C:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 608
The SOC team has not yet approved changes. Current evidence indicates: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
Explanation
Correct Answer
B:Confirm afterward that: The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Applied case: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
Incorrect Answers
A:Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
C:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
D:Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Question 609
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
- The case identifies whether protected data left the approved boundary and preserves evidence for affected records.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
Explanation
Correct Answer
C:The approved implementation step was: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Applied case: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
Incorrect Answers
A:Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
B:The resulting report separates code-capability findings from verified executions and documents uncertainty. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Investigators present a defensible sequence with confidence and clearly separated benign explanations. A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
Question 610
For an original CBRCOR educational scenario, consider: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
- Change: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact.
- Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Classify every large data transfer as malicious and shut down all approved backup or analytics services.
Explanation
Correct Answer
A:Acceptance: The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Applied case: A legitimate data-science batch exports terabytes to a sanctioned bucket but triggers the same data-volume threshold as a prior exfiltration incident.
C:Acceptance: The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Incorrect Answers
B:Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
D:Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
