Cisco 350-201 Practice Test 67
Question 660
For an original CBRCOR educational scenario, consider: A packed file has almost no readable strings and investigators assume it must be benign because familiar keywords are absent. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Treat the absence of readable strings as a guarantee that the executable has no network or persistence behavior.
- Change: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
- Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
Explanation
Correct Answer
C:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Evidence: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
E:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Required intervention: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
Incorrect Answers
A:Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
D:Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window. Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Question 661
A SOC analyst is examining this cybersecurity operations situation: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet. A proposed shortcut is: Execute suspected malware directly on a domain-joined employee laptop because live execution yields realistic results. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Execute suspected malware directly on a domain-joined employee laptop because live execution yields realistic results.
- Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
- Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet.
Incorrect Answers
A:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 662
A Cisco cybersecurity incident response review finds: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet. The team proposes: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
- Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
Explanation
Correct Answer
B:Demonstrable success requires: Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. This principle explains the proposed technical approach, which is: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
Incorrect Answers
A:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 663
The SOC team has not yet approved changes. Current evidence indicates: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment.
- Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
Explanation
Correct Answer
B:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. Applied case: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet.
Incorrect Answers
A:Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 664
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
- Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match.
- Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
Explanation
Correct Answer
A:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. The approved implementation step was: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
Incorrect Answers
B:Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 665
An implementation sign-off request identifies the following problem: An unknown attachment is opened on an analyst's normal workstation to observe whether it creates files or contacts the internet. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Verify: Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Verify: Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment.
- Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Verify: Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Verify: Review token validation, authorization decisions and service account grants for negative identity and permission tests.
Explanation
Correct Answer
A:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. The change is successful only when: Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
Incorrect Answers
B:Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
D:Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 666
A SOC analyst is examining this cybersecurity operations situation: A virtual malware lab has unrestricted outbound connectivity to production identity systems and no snapshot restoration procedure. A proposed shortcut is: Execute suspected malware directly on a domain-joined employee laptop because live execution yields realistic results. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
- Execute suspected malware directly on a domain-joined employee laptop because live execution yields realistic results.
- Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Incorrect Answers
B:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. Use this instead: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
C:Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 667
A Cisco cybersecurity incident response review finds: A virtual malware lab has unrestricted outbound connectivity to production identity systems and no snapshot restoration procedure. The team proposes: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
- Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
- IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Explanation
Correct Answer
A:Demonstrable success requires: Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. Applied case: A virtual malware lab has unrestricted outbound connectivity to production identity systems and no snapshot restoration procedure.
Incorrect Answers
B:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 668
The SOC team has not yet approved changes. Current evidence indicates: A virtual malware lab has unrestricted outbound connectivity to production identity systems and no snapshot restoration procedure. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Examine object access logs, policy history, credential use, request source and affected file classifications.
Explanation
Correct Answer
B:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. If confirmed, the proportionate intervention is: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
Incorrect Answers
A:Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Examine object access logs, policy history, credential use, request source and affected file classifications. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 669
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A virtual malware lab has unrestricted outbound connectivity to production identity systems and no snapshot restoration procedure. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
- The case identifies whether protected data left the approved boundary and preserves evidence for affected records.
- Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity.
Explanation
Correct Answer
B:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
D:Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Question 670
For an original CBRCOR educational scenario, consider: A virtual malware lab has unrestricted outbound connectivity to production identity systems and no snapshot restoration procedure. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
- Check: Review session origin, identity events, task creation, process trees and approved change records for the same time span.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
- Execute suspected malware directly on a domain-joined employee laptop because live execution yields realistic results.
Explanation
Correct Answer
A:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. Required intervention: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
D:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. Acceptance: Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
Incorrect Answers
B:Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
C:Check: Review session origin, identity events, task creation, process trees and approved change records for the same time span. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
