Cisco 350-201 Practice Test 7
Question 60
For an original CBRCOR educational scenario, consider: A contractor token unexpectedly acquires cloud administrator permissions while a CI workload continues issuing sensitive API operations. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
- Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Delete all audit history after removing the admin role because revoking one grant proves no prior misuse occurred.
- Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
Explanation
Correct Answer
B:Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review. Evidence: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
E:Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review. Acceptance: Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use.
Incorrect Answers
A:Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review.
C:Change: Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Unexpected privilege changes can expand the attacker's control, so authentication, authorization changes and subsequent actions require correlated review.
Question 61
A SOC analyst is examining this cybersecurity operations situation: A public customer portal is overwhelmed by thousands of requests from distributed addresses and legitimate sessions time out. A proposed shortcut is: Permanently deny all external traffic as the default reaction to any sudden increase in request volume. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system.
- Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
- Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
- Permanently deny all external traffic as the default reaction to any sudden increase in request volume.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. The required acceptance condition is: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage.
Incorrect Answers
A:Record risk treatment choices, compensating controls, accountable acceptance and scheduled re-evaluation for the affected system. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 62
A Cisco cybersecurity incident response review finds: A public customer portal is overwhelmed by thousands of requests from distributed addresses and legitimate sessions time out. The team proposes: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Deployment model describes hosting and governance boundaries, while multicloud describes use of more than one provider and can coexist with hybrid.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls.
Explanation
Correct Answer
B:Demonstrable success requires: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. This principle explains the proposed technical approach, which is: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
Incorrect Answers
A:This option addresses a different security operations topic (Private public hybrid and multicloud boundaries) rather than the documented DoS and DDoS response playbook decision.
C:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:Vulnerability severity informs risk, but impact and likelihood depend on asset criticality, attacker opportunity and compensating controls. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Question 63
The SOC team has not yet approved changes. Current evidence indicates: A public customer portal is overwhelmed by thousands of requests from distributed addresses and legitimate sessions time out. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
Explanation
Correct Answer
A:Confirm afterward that: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Applied case: A public customer portal is overwhelmed by thousands of requests from distributed addresses and legitimate sessions time out.
Incorrect Answers
B:Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
C:Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Question 64
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A public customer portal is overwhelmed by thousands of requests from distributed addresses and legitimate sessions time out. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report.
- The selected evidence actually covers the system and government cloud service before acceptance.
- Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage.
- Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract.
Explanation
Correct Answer
C:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:The selected evidence actually covers the system and government cloud service before acceptance. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:Applications use restricted credentials and approved data permissions while platform maintenance follows the correct provider contract. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Question 65
An implementation sign-off request identifies the following problem: A public customer portal is overwhelmed by thousands of requests from distributed addresses and legitimate sessions time out. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Verify: Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Verify: Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Verify: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Verify: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
Explanation
Correct Answer
D:The change is successful only when: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage.
Incorrect Answers
A:Change: Define observable entry conditions, responsible roles, decision points and escalation targets in the incident playbook. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:Change: Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
C:Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
Question 66
A SOC analyst is examining this cybersecurity operations situation: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely. A proposed shortcut is: Permanently deny all external traffic as the default reaction to any sudden increase in request volume. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
- Permanently deny all external traffic as the default reaction to any sudden increase in request volume.
- Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
Incorrect Answers
A:Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
C:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Applied case: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
Question 67
A Cisco cybersecurity incident response review finds: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely. The team proposes: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider.
- Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place.
- GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
Explanation
Correct Answer
A:Demonstrable success requires: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Applied case: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
Incorrect Answers
B:PaaS reduces customer infrastructure-management burden but does not transfer application security and data authorization to the provider. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
C:Recovering service availability is insufficient if compromise mechanisms or stolen credentials remain in place. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Question 68
The SOC team has not yet approved changes. Current evidence indicates: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
- Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
Explanation
Correct Answer
A:Confirm afterward that: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Applied case: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
Incorrect Answers
B:Record asset inventory, exposure path, known exploitation, control effectiveness and plausible business impact for both systems. A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
C:Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Question 69
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage.
- The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking.
Explanation
Correct Answer
C:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. The approved implementation step was: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
Incorrect Answers
A:Required evidence is retained and an incident cannot close until authorized recovery and monitoring checks succeed. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
D:The production remediation order reflects real-world exposure and documented residual risks rather than a raw score ranking. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Question 70
For an original CBRCOR educational scenario, consider: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Check: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Permanently deny all external traffic as the default reaction to any sudden increase in request volume.
- Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
- Check: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
Explanation
Correct Answer
D:Acceptance: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Applied case: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
E:Acceptance: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Incorrect Answers
A:Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:Check: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
C:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Use this instead: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
