Cisco 350-201 Practice Test 76
Question 750
For an original CBRCOR educational scenario, consider: A laptop returns from an untrusted network with disabled endpoint protection but has no record of recent process activity in the central console. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Reimage the laptop immediately and discard all endpoint logs because the antivirus alert has already fired.
- Change: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
- Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
- Check: Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
Explanation
Correct Answer
B:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Acceptance: The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
E:Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration. Required intervention: Isolate as warranted and collect process lineage, persistence, file artifacts, endpoint health and identity events under approved procedures.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
C:Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
D:Check: Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. Endpoint investigation must distinguish malicious execution from platform administration and preserve volatile evidence before restoration.
Question 751
A SOC analyst is examining this cybersecurity operations situation: A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app. A proposed shortcut is: Assume a mobile phone is unhackable and close every case because it lacks a traditional Windows process tree. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
- Assume a mobile phone is unhackable and close every case because it lacks a traditional Windows process tree.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Incorrect Answers
A:This option addresses a different security operations topic (CVSS vector and exploit context prioritization) rather than the documented Mobile device compromise indicators decision.
C:Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
D:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 752
A Cisco cybersecurity incident response review finds: A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app. The team proposes: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output.
- Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution.
- Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
- Threat severity is a function of access and consequence, not solely request frequency or component popularity.
Explanation
Correct Answer
C:Demonstrable success requires: Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. This principle explains the proposed technical approach, which is: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
Incorrect Answers
A:Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
B:Malware effects span processes, persistence and network changes; any one indicator may describe only part of execution. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
D:Threat severity is a function of access and consequence, not solely request frequency or component popularity. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 753
The SOC team has not yet approved changes. Current evidence indicates: A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine object access logs, policy history, credential use, request source and affected file classifications.
- Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
Explanation
Correct Answer
D:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. Confirm afterward that: Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
Incorrect Answers
A:Examine object access logs, policy history, credential use, request source and affected file classifications. A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app.
B:Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking. A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app.
C:Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 754
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
- Closed issues show tested remediation and overdue exceptions are transparent and time bounded.
- The published indicator preserves measured coverage without overwhelming legitimate workstation activity.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
Explanation
Correct Answer
A:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Closed issues show tested remediation and overdue exceptions are transparent and time bounded. A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app.
C:The published indicator preserves measured coverage without overwhelming legitimate workstation activity. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
D:Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 755
An implementation sign-off request identifies the following problem: A managed smartphone shows an unexpected profile granting broad device configuration rights after installation of an unapproved app. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Verify: Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Verify: Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Verify: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Verify: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
Explanation
Correct Answer
B:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. The change is successful only when: Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
Incorrect Answers
A:This option addresses a different security operations topic (Suspicious data-transfer investigation) rather than the documented Mobile device compromise indicators decision.
C:Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
D:Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 756
A SOC analyst is examining this cybersecurity operations situation: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago. A proposed shortcut is: Assume a mobile phone is unhackable and close every case because it lacks a traditional Windows process tree. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Establish the authenticated actor and change provenance, then examine persistence, privileges and lateral activity using approved logs.
- Assume a mobile phone is unhackable and close every case because it lacks a traditional Windows process tree.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago.
Incorrect Answers
B:Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
C:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented Mobile device compromise indicators decision.
D:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. Applied case: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago.
Question 757
A Cisco cybersecurity incident response review finds: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago. The team proposes: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
- A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries.
Explanation
Correct Answer
A:Demonstrable success requires: Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. Applied case: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago.
Incorrect Answers
B:A trusted identity claim cannot originate solely from attacker-controlled input and permissions should match the operation's intended scope. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
C:This option addresses a different security operations topic (AI-assisted traffic attack timeline reconstruction) rather than the documented Mobile device compromise indicators decision.
D:File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 758
The SOC team has not yet approved changes. Current evidence indicates: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
Explanation
Correct Answer
C:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
B:Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
D:Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 759
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
- The published indicator preserves measured coverage without overwhelming legitimate workstation activity.
- Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
- Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
Explanation
Correct Answer
A:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. The approved implementation step was: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
Incorrect Answers
B:The published indicator preserves measured coverage without overwhelming legitimate workstation activity. A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago.
C:Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
D:Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
Question 760
For an original CBRCOR educational scenario, consider: A mobile user reports repeated unauthorized account prompts while MDM inventory says the device stopped checking in days ago. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Check: Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Assume a mobile phone is unhackable and close every case because it lacks a traditional Windows process tree.
Explanation
Correct Answer
B:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. Acceptance: Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
D:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. Required intervention: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
Incorrect Answers
A:Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
C:Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
