Cisco 350-201 Practice Test 69
Question 680
For an original CBRCOR educational scenario, consider: A suspicious program creates a scheduled task during a test, yet the report lists only outbound TCP connections and ignores persistence. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Ignore host-side modifications because a single network callback is enough to characterize the entire sample.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Check: Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Check: Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
Explanation
Correct Answer
B:Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution. Evidence: Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
E:Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution. Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution.
C:Check: Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines. Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution.
D:Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution.
Question 681
A SOC analyst is examining this cybersecurity operations situation: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered. A proposed shortcut is: Publish claims that every referenced API was executed solely because its symbol appears in an import table. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
- Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Publish claims that every referenced API was executed solely because its symbol appears in an import table.
- Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered.
Incorrect Answers
B:This option addresses a different security operations topic (AI-assisted lateral movement detection validation) rather than the documented Reverse-engineering triage without unsafe execution decision.
C:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Question 682
A Cisco cybersecurity incident response review finds: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered. The team proposes: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
- Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
- Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
- Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Explanation
Correct Answer
D:Relevant validation before approval: Match call graphs and code references to observed sandbox traces without altering the original captured file. Applied case: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered.
Incorrect Answers
A:This option addresses a different security operations topic (Threat modeling spoofing and elevation risks) rather than the documented Reverse-engineering triage without unsafe execution decision.
B:Behavior-based detection can recognize attack progress even when exact files and addresses are unknown. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:This option addresses a different security operations topic (Mobile device compromise indicators) rather than the documented Reverse-engineering triage without unsafe execution decision.
Question 683
The SOC team has not yet approved changes. Current evidence indicates: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file.
- Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
Explanation
Correct Answer
C:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Applied case: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered.
Incorrect Answers
A:Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
B:Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
D:Replay representative benign installer traces and malicious test artifacts and compare true and false matches. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Question 684
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff.
- Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
Explanation
Correct Answer
D:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The case identifies material unauthorized behavior and preserves evidence for further containment. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
B:Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Question 685
An implementation sign-off request identifies the following problem: An obfuscated executable exposes an unexplained persistence routine and a reverse engineer must determine whether its conditions can be triggered. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Verify: Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Verify: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Verify: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Change: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. Verify: Match call graphs and code references to observed sandbox traces without altering the original captured file.
Explanation
Correct Answer
D:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. The change is successful only when: The resulting report separates code-capability findings from verified executions and documents uncertainty.
Incorrect Answers
A:This option addresses a different security operations topic (Sandbox containment and safe dynamic execution) rather than the documented Reverse-engineering triage without unsafe execution decision.
B:Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
C:This option addresses a different security operations topic (IOC confidence, expiration and false associations) rather than the documented Reverse-engineering triage without unsafe execution decision.
Question 686
A SOC analyst is examining this cybersecurity operations situation: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system. A proposed shortcut is: Publish claims that every referenced API was executed solely because its symbol appears in an import table. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
- Publish claims that every referenced API was executed solely because its symbol appears in an import table.
- Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system.
Incorrect Answers
A:Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
B:Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Applied case: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system.
Question 687
A Cisco cybersecurity incident response review finds: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system. The team proposes: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
- Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
- Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Explanation
Correct Answer
D:Relevant validation before approval: Match call graphs and code references to observed sandbox traces without altering the original captured file. Applied case: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system.
Incorrect Answers
A:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented Reverse-engineering triage without unsafe execution decision.
Question 688
The SOC team has not yet approved changes. Current evidence indicates: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Match call graphs and code references to observed sandbox traces without altering the original captured file.
Explanation
Correct Answer
D:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
B:This option addresses a different security operations topic (Suspicious data-transfer investigation) rather than the documented Reverse-engineering triage without unsafe execution decision.
C:Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Question 689
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
- The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
- Investigators can reproduce findings from an untampered original while analysis copies remain isolated.
- The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering.
Explanation
Correct Answer
A:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. The approved implementation step was: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
Incorrect Answers
B:The case states supported similarity with confidence levels and avoids unsupported named-actor attribution. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:Investigators can reproduce findings from an untampered original while analysis copies remain isolated. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
D:The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Question 690
For an original CBRCOR educational scenario, consider: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Publish claims that every referenced API was executed solely because its symbol appears in an import table.
- Change: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
- Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
Explanation
Correct Answer
A:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Match call graphs and code references to observed sandbox traces without altering the original captured file.
D:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Evidence: Match call graphs and code references to observed sandbox traces without altering the original captured file.
Incorrect Answers
B:Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
E:Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
