Cisco 350-201 Practice Test 66
Question 650
For an original CBRCOR educational scenario, consider: Analysts decide a binary is safe because its file name matches a known system service despite a changed cryptographic hash. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
- Check: Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Execute every unfamiliar executable on a corporate workstation to identify its publisher before calculating its hash.
Explanation
Correct Answer
A:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Evidence: Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
D:File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence. Required intervention: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
Incorrect Answers
B:Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
C:Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. File names and descriptions are mutable; signatures, hashes and structural indicators provide stronger but not conclusive evidence.
Question 651
A SOC analyst is examining this cybersecurity operations situation: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use. A proposed shortcut is: Treat the absence of readable strings as a guarantee that the executable has no network or persistence behavior. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat the absence of readable strings as a guarantee that the executable has no network or persistence behavior.
- Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance.
- Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use.
Incorrect Answers
A:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
C:Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 652
A Cisco cybersecurity incident response review finds: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use. The team proposes: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
- Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
- Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Explanation
Correct Answer
C:Demonstrable success requires: The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation. This principle explains the proposed technical approach, which is: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
Incorrect Answers
A:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
B:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 653
The SOC team has not yet approved changes. Current evidence indicates: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Review session origin, identity events, task creation, process trees and approved change records for the same time span.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
Explanation
Correct Answer
C:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Applied case: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use.
Incorrect Answers
A:Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
B:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented Malware strings and import-table analysis decision.
D:Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 654
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
- The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
- Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff.
Explanation
Correct Answer
B:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. The approved implementation step was: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
Incorrect Answers
A:Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
C:The resulting report separates code-capability findings from verified executions and documents uncertainty. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 655
An implementation sign-off request identifies the following problem: An unknown Windows binary contains hard-coded network destinations and suspicious process APIs, but the team has not established their actual use. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Verify: Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment.
- Change: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims. Verify: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Verify: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Verify: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
Explanation
Correct Answer
B:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. The change is successful only when: The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation.
Incorrect Answers
A:Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
C:Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 656
A SOC analyst is examining this cybersecurity operations situation: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent. A proposed shortcut is: Treat the absence of readable strings as a guarantee that the executable has no network or persistence behavior. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Treat the absence of readable strings as a guarantee that the executable has no network or persistence behavior.
- Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
- Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
- Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent.
Incorrect Answers
A:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Use this instead: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
B:Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 657
A Cisco cybersecurity incident response review finds: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent. The team proposes: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
- Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
- Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
- Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Explanation
Correct Answer
A:Demonstrable success requires: The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation. Applied case: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent.
Incorrect Answers
B:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
C:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Behavior-based detection can recognize attack progress even when exact files and addresses are unknown. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 658
The SOC team has not yet approved changes. Current evidence indicates: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
Explanation
Correct Answer
B:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Applied case: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent.
Incorrect Answers
A:Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
C:Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 659
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
- The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
- Responders retain defensible evidence and remove the compromised workload through a trusted deployment path.
Explanation
Correct Answer
B:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
C:Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Responders retain defensible evidence and remove the compromised workload through a trusted deployment path. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 660
For an original CBRCOR educational scenario, consider: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Treat the absence of readable strings as a guarantee that the executable has no network or persistence behavior.
- Change: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
- Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
Explanation
Correct Answer
C:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Evidence: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
E:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Required intervention: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
Incorrect Answers
A:Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
