Cisco 350-201 Practice Test 70
Question 690
For an original CBRCOR educational scenario, consider: A suspected credential stealer contains multiple branches but analysts assume all imported functions are always executed on every system. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Publish claims that every referenced API was executed solely because its symbol appears in an import table.
- Change: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
- Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
Explanation
Correct Answer
A:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Match call graphs and code references to observed sandbox traces without altering the original captured file.
D:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Evidence: Match call graphs and code references to observed sandbox traces without altering the original captured file.
Incorrect Answers
B:Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
E:Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
Question 691
A SOC analyst is examining this cybersecurity operations situation: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure. A proposed shortcut is: Attribute every packed executable to one threat group because the compiler or packer signature matches. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Attribute every packed executable to one threat group because the compiler or packer signature matches.
- Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access.
- Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval.
- Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure.
Incorrect Answers
A:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
C:Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 692
A Cisco cybersecurity incident response review finds: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure. The team proposes: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
- Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
- Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
- IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Explanation
Correct Answer
B:Demonstrable success requires: The case states supported similarity with confidence levels and avoids unsupported named-actor attribution. This principle explains the proposed technical approach, which is: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
Incorrect Answers
A:Behavior-based detection can recognize attack progress even when exact files and addresses are unknown. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
C:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 693
The SOC team has not yet approved changes. Current evidence indicates: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Review token validation, authorization decisions and service account grants for negative identity and permission tests.
- Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
Explanation
Correct Answer
B:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Applied case: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure.
Incorrect Answers
A:Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
C:Review token validation, authorization decisions and service account grants for negative identity and permission tests. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:Replay representative benign installer traces and malicious test artifacts and compare true and false matches. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 694
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The published indicator preserves measured coverage without overwhelming legitimate workstation activity.
- The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
- Investigators can reproduce findings from an untampered original while analysis copies remain isolated.
Explanation
Correct Answer
B:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. The approved implementation step was: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
Incorrect Answers
A:The published indicator preserves measured coverage without overwhelming legitimate workstation activity. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
C:Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:Investigators can reproduce findings from an untampered original while analysis copies remain isolated. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 695
An implementation sign-off request identifies the following problem: Two binaries share a packer signature, and an analyst declares they are the same attacker campaign without comparing code or infrastructure. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Verify: Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Change: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence. Verify: Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Verify: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. Verify: Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
Explanation
Correct Answer
B:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. The change is successful only when: The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
Incorrect Answers
A:Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
C:Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 696
A SOC analyst is examining this cybersecurity operations situation: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns. A proposed shortcut is: Attribute every packed executable to one threat group because the compiler or packer signature matches. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
- Attribute every packed executable to one threat group because the compiler or packer signature matches.
- Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
- Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns.
Incorrect Answers
B:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Use this instead: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
C:Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 697
A Cisco cybersecurity incident response review finds: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns. The team proposes: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
- Forensic reproducibility depends on preserving the original artifact and recording who accessed derived samples.
- Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
- Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Explanation
Correct Answer
C:Demonstrable success requires: The case states supported similarity with confidence levels and avoids unsupported named-actor attribution. Applied case: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns.
Incorrect Answers
A:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
B:Forensic reproducibility depends on preserving the original artifact and recording who accessed derived samples. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 698
The SOC team has not yet approved changes. Current evidence indicates: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
Explanation
Correct Answer
C:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Applied case: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns.
Incorrect Answers
A:Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
B:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 699
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
- Extracted objects have documented provenance and uncertainty about incomplete or encrypted payloads is explicit.
- The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation.
- The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering.
Explanation
Correct Answer
A:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Extracted objects have documented provenance and uncertainty about incomplete or encrypted payloads is explicit. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
C:The report distinguishes observed static facts from hypotheses requiring controlled dynamic confirmation. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
D:The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Question 700
For an original CBRCOR educational scenario, consider: A sample changes its hash after repacking, causing analysts to discard all prior behavioral similarities despite similar network and persistence patterns. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Result: The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
- Change: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
- Check: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Check: Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Result: Extracted objects have documented provenance and uncertainty about incomplete or encrypted payloads is explicit.
- Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions.
Explanation
Correct Answer
A:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Required intervention: Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
B:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Evidence: Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
D:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Acceptance: The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
Incorrect Answers
C:Check: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
E:Result: Extracted objects have documented provenance and uncertainty about incomplete or encrypted payloads is explicit. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
F:Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
