Cisco 350-201 Practice Test 74
Question 730
For an original CBRCOR educational scenario, consider: A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Treat a model-generated attack narrative as an established timeline without checking underlying timestamps.
- Check: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Change: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Explanation
Correct Answer
C:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Required intervention: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
D:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Evidence: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
Incorrect Answers
A:Check: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
E:Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. A predictive engine labels a burst of outbound requests as exfiltration even though the source is an approved nightly telemetry collector.
Question 731
A SOC analyst is examining this cybersecurity operations situation: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment. A proposed shortcut is: Declare every repeated administrative connection malicious regardless of change tickets or authenticated actor evidence. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence.
- Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners.
- Declare every repeated administrative connection malicious regardless of change tickets or authenticated actor evidence.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment.
Incorrect Answers
B:Use multiple structural, behavior and intelligence features to compare samples while qualifying attribution confidence. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 732
A Cisco cybersecurity incident response review finds: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment. The team proposes: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
- Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Explanation
Correct Answer
D:Relevant validation before approval: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Applied case: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment.
Incorrect Answers
A:This option addresses a different security operations topic (AI-assisted traffic attack timeline reconstruction) rather than the documented AI-assisted lateral movement detection validation decision.
B:Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Threat severity is a function of access and consequence, not solely request frequency or component popularity. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 733
The SOC team has not yet approved changes. Current evidence indicates: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
- Review session origin, identity events, task creation, process trees and approved change records for the same time span.
- Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
Explanation
Correct Answer
C:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Applied case: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment.
Incorrect Answers
A:Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
B:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented AI-assisted lateral movement detection validation decision.
D:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 734
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
- The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
Explanation
Correct Answer
A:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 735
An implementation sign-off request identifies the following problem: A model detects internal remote-service bursts between servers, but those hosts also run an approved monthly configuration deployment. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Verify: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Verify: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Verify: Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Verify: Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment.
Explanation
Correct Answer
B:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. The change is successful only when: Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
Incorrect Answers
A:Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:Change: Challenge trust assumptions with realistic attacker access and validate claimed controls at actual enforcement points. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 736
A SOC analyst is examining this cybersecurity operations situation: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client. A proposed shortcut is: Declare every repeated administrative connection malicious regardless of change tickets or authenticated actor evidence. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
- Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
- Declare every repeated administrative connection malicious regardless of change tickets or authenticated actor evidence.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Incorrect Answers
A:Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Use this instead: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
Question 737
A Cisco cybersecurity incident response review finds: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client. The team proposes: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
- Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
- Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
- Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Explanation
Correct Answer
C:Relevant validation before approval: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Demonstrable success requires: Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
Incorrect Answers
A:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
B:Behavior-based detection can recognize attack progress even when exact files and addresses are unknown. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 738
The SOC team has not yet approved changes. Current evidence indicates: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
Explanation
Correct Answer
D:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Confirm afterward that: Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
Incorrect Answers
A:Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
B:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 739
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
- Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
Explanation
Correct Answer
C:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Applied case: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client.
Incorrect Answers
A:Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset. A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client.
B:The resulting report separates code-capability findings from verified executions and documents uncertainty. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 740
For an original CBRCOR educational scenario, consider: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls.
- Declare every repeated administrative connection malicious regardless of change tickets or authenticated actor evidence.
- Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
Explanation
Correct Answer
A:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Evidence: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
E:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Acceptance: Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
Incorrect Answers
B:Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
