Cisco 350-201 Practice Test 75
Question 740
For an original CBRCOR educational scenario, consider: A SOC algorithm links many authentication events into one lateral movement chain despite each event belonging to a different shared NAT client. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Validate predicted lateral paths using identity, host, session and segmentation context before attributing them to a single incident.
- Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls.
- Declare every repeated administrative connection malicious regardless of change tickets or authenticated actor evidence.
- Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
Explanation
Correct Answer
A:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Evidence: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
E:Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation. Acceptance: Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
Incorrect Answers
B:Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
C:Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Similar network patterns can represent automated administration or compromise; session linkage and source identity determine interpretation.
Question 741
A SOC analyst is examining this cybersecurity operations situation: An EDR sensor reports PowerShell launching from an office document followed by browser credential store access on a laptop. A proposed shortcut is: Reimage the laptop immediately and discard all endpoint logs because the antivirus alert has already fired. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval.
- Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
- Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Reimage the laptop immediately and discard all endpoint logs because the antivirus alert has already fired.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Incorrect Answers
A:Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 742
A Cisco cybersecurity incident response review finds: An EDR sensor reports PowerShell launching from an office document followed by browser credential store access on a laptop. The team proposes: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
- Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
- Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
- Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Explanation
Correct Answer
A:Demonstrable success requires: The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained. This principle explains the proposed technical approach, which is: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Incorrect Answers
B:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 743
The SOC team has not yet approved changes. Current evidence indicates: An EDR sensor reports PowerShell launching from an office document followed by browser credential store access on a laptop. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
- Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
- Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
Explanation
Correct Answer
A:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. If confirmed, the proportionate intervention is: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Incorrect Answers
B:Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 744
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An EDR sensor reports PowerShell launching from an office document followed by browser credential store access on a laptop. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
- The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Explanation
Correct Answer
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. The approved implementation step was: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Incorrect Answers
A:Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:The case identifies material unauthorized behavior and preserves evidence for further containment. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 745
An implementation sign-off request identifies the following problem: An EDR sensor reports PowerShell launching from an office document followed by browser credential store access on a laptop. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. Verify: Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
- Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Verify: Examine object access logs, policy history, credential use, request source and affected file classifications.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Verify: Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Verify: Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
Explanation
Correct Answer
A:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. The change is successful only when: The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
Incorrect Answers
B:Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 746
A SOC analyst is examining this cybersecurity operations situation: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console. A proposed shortcut is: Reimage the laptop immediately and discard all endpoint logs because the antivirus alert has already fired. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
- Reimage the laptop immediately and discard all endpoint logs because the antivirus alert has already fired.
- Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console.
Incorrect Answers
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Use this instead: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
C:Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 747
A Cisco cybersecurity incident response review finds: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console. The team proposes: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
- Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
Explanation
Correct Answer
C:Demonstrable success requires: The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained. Applied case: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console.
Incorrect Answers
A:Threat severity is a function of access and consequence, not solely request frequency or component popularity. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
B:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console.
Question 748
The SOC team has not yet approved changes. Current evidence indicates: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
- Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
Explanation
Correct Answer
A:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Applied case: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console.
Incorrect Answers
B:Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Match call graphs and code references to observed sandbox traces without altering the original captured file. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 749
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
- Investigators can reproduce findings from an untampered original while analysis copies remain isolated.
- Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented.
- The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
Explanation
Correct Answer
D:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
B:Investigators can reproduce findings from an untampered original while analysis copies remain isolated. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 750
For an original CBRCOR educational scenario, consider: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Reimage the laptop immediately and discard all endpoint logs because the antivirus alert has already fired.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
- Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Check: Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
Explanation
Correct Answer
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Acceptance: The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
E:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Required intervention: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
