Cisco 350-201 Practice Test 65
Question 640
For an original CBRCOR educational scenario, consider: A packet capture contains a downloaded binary yet investigators overwrite the only source file while renaming it for analysis. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination.
- Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance.
- Check: Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file.
- Edit the original suspected payload directly and share it through unmanaged personal accounts to simplify analysis.
Explanation
Correct Answer
A:Forensic reproducibility depends on preserving the original artifact and recording who accessed derived samples.
D:Required intervention: Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination.
Incorrect Answers
B:Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. Forensic reproducibility depends on preserving the original artifact and recording who accessed derived samples.
C:Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Forensic reproducibility depends on preserving the original artifact and recording who accessed derived samples.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Forensic reproducibility depends on preserving the original artifact and recording who accessed derived samples.
Question 641
A SOC analyst is examining this cybersecurity operations situation: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel. A proposed shortcut is: Execute every unfamiliar executable on a corporate workstation to identify its publisher before calculating its hash. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
- Execute every unfamiliar executable on a corporate workstation to identify its publisher before calculating its hash.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel.
Incorrect Answers
A:Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
D:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 642
A Cisco cybersecurity incident response review finds: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel. The team proposes: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
- File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
- Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
- Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
Explanation
Correct Answer
B:Demonstrable success requires: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty. This principle explains the proposed technical approach, which is: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
Incorrect Answers
A:Threat severity is a function of access and consequence, not solely request frequency or component popularity. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:This option addresses a different security operations topic (Mobile device compromise indicators) rather than the documented Malware static triage metadata and hashes decision.
D:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 643
The SOC team has not yet approved changes. Current evidence indicates: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
Explanation
Correct Answer
A:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Applied case: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel.
Incorrect Answers
B:Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
D:Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 644
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
- The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty.
- Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable.
- The exposure report identifies confirmed unauthorized access, bounded data scope and validated control fixes.
Explanation
Correct Answer
B:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. The approved implementation step was: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
Incorrect Answers
A:Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
D:The exposure report identifies confirmed unauthorized access, bounded data scope and validated control fixes. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 645
An implementation sign-off request identifies the following problem: A suspicious executable claims to be an enterprise updater but its signer is untrusted and its embedded metadata disagrees with the distribution channel. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Verify: Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Verify: Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. Verify: Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Verify: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
Explanation
Correct Answer
B:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. The change is successful only when: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty.
Incorrect Answers
A:This option addresses a different security operations topic (Vulnerability mitigation and defense layers) rather than the documented Malware static triage metadata and hashes decision.
C:Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
D:Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 646
A SOC analyst is examining this cybersecurity operations situation: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash. A proposed shortcut is: Execute every unfamiliar executable on a corporate workstation to identify its publisher before calculating its hash. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Execute every unfamiliar executable on a corporate workstation to identify its publisher before calculating its hash.
- Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context.
- Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
- Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash.
Incorrect Answers
A:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Use this instead: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
B:Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 647
A Cisco cybersecurity incident response review finds: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash. The team proposes: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
- File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
- Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
- Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Explanation
Correct Answer
B:Demonstrable success requires: The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty. Applied case: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash.
Incorrect Answers
A:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
D:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 648
The SOC team has not yet approved changes. Current evidence indicates: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file.
- Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
Explanation
Correct Answer
A:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Applied case: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash.
Incorrect Answers
B:Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
D:Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 649
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- The exposure report identifies confirmed unauthorized access, bounded data scope and validated control fixes.
- The sample is classified for further analysis using reproducible static evidence and explicit remaining uncertainty.
Explanation
Correct Answer
D:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
B:The case identifies material unauthorized behavior and preserves evidence for further containment. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:The exposure report identifies confirmed unauthorized access, bounded data scope and validated control fixes. Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash.
Question 650
For an original CBRCOR educational scenario, consider: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
- Check: Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Execute every unfamiliar executable on a corporate workstation to identify its publisher before calculating its hash.
Explanation
Correct Answer
A:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Evidence: Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
D:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Required intervention: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
Incorrect Answers
B:Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
