Cisco 350-201 Practice Test 63
Question 620
For an original CBRCOR educational scenario, consider: A server maintenance window includes legitimate service restarts but also an unapproved addition to a security administrator group. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Review session origin, identity events, task creation, process trees and approved change records for the same time span.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
- Accept every change performed during a maintenance window as legitimate without verifying the individual actor or scope.
- Check: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
- Change: Establish the authenticated actor and change provenance, then examine persistence, privileges and lateral activity using approved logs.
Explanation
Correct Answer
A:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. Acceptance: Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable.
E:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. Evidence: Review session origin, identity events, task creation, process trees and approved change records for the same time span.
Incorrect Answers
B:This option addresses a different security operations topic (Sandbox containment and safe dynamic execution) rather than the documented Suspicious administrator activity investigation decision.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
D:Check: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate. Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
Question 621
A SOC analyst is examining this cybersecurity operations situation: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity. A proposed shortcut is: Block all customers whenever legitimate usage exceeds a historical traffic threshold. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
- Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
- Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Block all customers whenever legitimate usage exceeds a historical traffic threshold.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity.
Incorrect Answers
B:Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 622
A Cisco cybersecurity incident response review finds: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity. The team proposes: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
- Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
- Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
Explanation
Correct Answer
B:Demonstrable success requires: The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation. Applied case: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity.
Incorrect Answers
A:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented Denial-of-service incident investigation decision.
Question 623
The SOC team has not yet approved changes. Current evidence indicates: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
Explanation
Correct Answer
A:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. Applied case: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity.
Incorrect Answers
B:Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
Question 624
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The published indicator preserves measured coverage without overwhelming legitimate workstation activity.
- Extracted objects have documented provenance and uncertainty about incomplete or encrypted payloads is explicit.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
- The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation.
Explanation
Correct Answer
D:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The published indicator preserves measured coverage without overwhelming legitimate workstation activity. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
B:Extracted objects have documented provenance and uncertainty about incomplete or encrypted payloads is explicit. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:This option addresses a different security operations topic (Threat modeling spoofing and elevation risks) rather than the documented Denial-of-service incident investigation decision.
Question 625
An implementation sign-off request identifies the following problem: A web application slows during a flash sale and the team declares DDoS without reviewing successful customer traffic or edge capacity. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Verify: Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Verify: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Verify: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Change: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion. Verify: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
Explanation
Correct Answer
C:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. The change is successful only when: The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation.
Incorrect Answers
A:Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
B:This option addresses a different security operations topic (Sandbox-derived multi-artifact IOC production) rather than the documented Denial-of-service incident investigation decision.
D:Change: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion.
Question 626
A SOC analyst is examining this cybersecurity operations situation: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking. A proposed shortcut is: Block all customers whenever legitimate usage exceeds a historical traffic threshold. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
- Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
- Block all customers whenever legitimate usage exceeds a historical traffic threshold.
- Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking.
Incorrect Answers
B:Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. Applied case: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking.
D:Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
Question 627
A Cisco cybersecurity incident response review finds: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking. The team proposes: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
- File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Explanation
Correct Answer
A:Demonstrable success requires: The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation. Applied case: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking.
Incorrect Answers
B:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:Threat severity is a function of access and consequence, not solely request frequency or component popularity. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
Question 628
The SOC team has not yet approved changes. Current evidence indicates: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
Explanation
Correct Answer
B:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins. A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking.
C:Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking.
Question 629
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
- Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
- The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation.
- Risky connections are restricted safely while essential device functionality and forensic observations remain preserved.
Explanation
Correct Answer
C:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. The approved implementation step was: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
Incorrect Answers
A:The case states supported similarity with confidence levels and avoids unsupported named-actor attribution. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
B:Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:This option addresses a different security operations topic (IoT and industrial endpoint investigation) rather than the documented Denial-of-service incident investigation decision.
Question 630
For an original CBRCOR educational scenario, consider: A public DNS service shows sudden resolver queries from varied sources while application health remains normal and operations wants blanket blocking. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
- Block all customers whenever legitimate usage exceeds a historical traffic threshold.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Check: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
Explanation
Correct Answer
A:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. Evidence: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
E:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. Required intervention: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
Incorrect Answers
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
C:Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
D:Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window. Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
