Cisco 350-201 Practice Test 73
Question 720
For an original CBRCOR educational scenario, consider: A detection engineer receives an IOC report with no hash, time window or source citation and cannot build a reliable test. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Check: Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
- Publish unverified malware-family accusations with no sample provenance or reproducible evidence.
- Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance.
Explanation
Correct Answer
C:Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output. Acceptance: Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
E:Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output. Evidence: Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
Incorrect Answers
A:Check: Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline. Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output.
B:Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. A detection engineer receives an IOC report with no hash, time window or source citation and cannot build a reliable test.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output.
Question 721
A SOC analyst is examining this cybersecurity operations situation: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login. A proposed shortcut is: Treat a model-generated attack narrative as an established timeline without checking underlying timestamps. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access.
- Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance.
- Treat a model-generated attack narrative as an established timeline without checking underlying timestamps.
- Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login.
Incorrect Answers
A:Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
B:Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
C:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 722
A Cisco cybersecurity incident response review finds: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login. The team proposes: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Explanation
Correct Answer
A:Demonstrable success requires: Investigators present a defensible sequence with confidence and clearly separated benign explanations. Applied case: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login.
Incorrect Answers
B:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
C:Threat severity is a function of access and consequence, not solely request frequency or component popularity. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
D:Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Question 723
The SOC team has not yet approved changes. Current evidence indicates: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Review session origin, identity events, task creation, process trees and approved change records for the same time span.
- Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
Explanation
Correct Answer
B:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Applied case: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login.
Incorrect Answers
A:Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
C:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented AI-assisted traffic attack timeline reconstruction decision.
D:Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Question 724
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
- Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
- The case states supported similarity with confidence levels and avoids unsupported named-actor attribution.
Explanation
Correct Answer
C:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
B:Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
D:The case states supported similarity with confidence levels and avoids unsupported named-actor attribution. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Question 725
An implementation sign-off request identifies the following problem: A traffic model flags potential beaconing at regular intervals, but the SOC cannot establish whether the connections preceded or followed a suspicious login. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. Verify: Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Verify: Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Verify: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Change: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence. Verify: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
Explanation
Correct Answer
D:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. The change is successful only when: Investigators present a defensible sequence with confidence and clearly separated benign explanations.
Incorrect Answers
A:Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
B:This option addresses a different security operations topic (Vulnerability mitigation and defense layers) rather than the documented AI-assisted traffic attack timeline reconstruction decision.
C:Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Question 726
A SOC analyst is examining this cybersecurity operations situation: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector. A proposed shortcut is: Treat a model-generated attack narrative as an established timeline without checking underlying timestamps. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context.
- Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
- Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
- Treat a model-generated attack narrative as an established timeline without checking underlying timestamps.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Incorrect Answers
A:Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
B:Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
D:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Use this instead: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
Question 727
A Cisco cybersecurity incident response review finds: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector. The team proposes: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
- Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Explanation
Correct Answer
C:Demonstrable success requires: Investigators present a defensible sequence with confidence and clearly separated benign explanations. This principle explains the proposed technical approach, which is: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
Incorrect Answers
A:This option addresses a different security operations topic (Container and ephemeral workload intrusion triage) rather than the documented AI-assisted traffic attack timeline reconstruction decision.
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
D:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Question 728
The SOC team has not yet approved changes. Current evidence indicates: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Review token validation, authorization decisions and service account grants for negative identity and permission tests.
Explanation
Correct Answer
B:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Applied case: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector.
Incorrect Answers
A:This option addresses a different security operations topic (Denial-of-service incident investigation) rather than the documented AI-assisted traffic attack timeline reconstruction decision.
C:Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
D:Review token validation, authorization decisions and service account grants for negative identity and permission tests. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
Question 729
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented.
- Investigators present a defensible sequence with confidence and clearly separated benign explanations.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
Explanation
Correct Answer
B:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. The approved implementation step was: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
Incorrect Answers
A:Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
C:The case identifies material unauthorized behavior and preserves evidence for further containment. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
D:Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive. A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector.
Question 730
For an original CBRCOR educational scenario, consider: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Treat a model-generated attack narrative as an established timeline without checking underlying timestamps.
- Check: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Change: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Explanation
Correct Answer
C:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Required intervention: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
D:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Evidence: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
Incorrect Answers
A:Check: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
E:Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector.
