Cisco 350-201 Practice Test 78
Question 770
For an original CBRCOR educational scenario, consider: A medical sensor begins scanning adjacent management networks and the SOC considers factory-resetting it during clinical use. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Check: Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
- Change: Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Install unsupported desktop security agents or reboot safety-critical devices without operational coordination.
Explanation
Correct Answer
B:Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling. Acceptance: Risky connections are restricted safely while essential device functionality and forensic observations remain preserved.
C:Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling. Evidence: Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
Incorrect Answers
A:Check: Match call graphs and code references to observed sandbox traces without altering the original captured file. Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling.
D:Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. A medical sensor begins scanning adjacent management networks and the SOC considers factory-resetting it during clinical use.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling.
Question 771
A SOC analyst is examining this cybersecurity operations situation: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state. A proposed shortcut is: Delete every affected container and its logs before checking which image or credential enabled the compromise. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
- Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery.
- Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination.
- Delete every affected container and its logs before checking which image or credential enabled the compromise.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state.
Incorrect Answers
B:Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
C:Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 772
A Cisco cybersecurity incident response review finds: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state. The team proposes: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
- Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
- Security design assurances must account for reachable adversary paths and observable implementation, not idealized topology labels.
Explanation
Correct Answer
C:Demonstrable success requires: Responders retain defensible evidence and remove the compromised workload through a trusted deployment path. Applied case: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state.
Incorrect Answers
A:This option addresses a different security operations topic (Threat modeling assets and trust boundaries) rather than the documented Container and ephemeral workload intrusion triage decision.
B:Constrained IoT and OT devices may require passive monitoring and safety-preserving response rather than normal workstation tooling. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Security design assurances must account for reachable adversary paths and observable implementation, not idealized topology labels. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 773
The SOC team has not yet approved changes. Current evidence indicates: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
Explanation
Correct Answer
A:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Applied case: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state.
Incorrect Answers
B:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
C:Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 774
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Responders retain defensible evidence and remove the compromised workload through a trusted deployment path.
- The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes.
- Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
Explanation
Correct Answer
A:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
C:Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 775
An implementation sign-off request identifies the following problem: A Kubernetes workload spawns an unauthorized shell, but the container is recreated before investigators capture its process state. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. Verify: Match call graphs and code references to observed sandbox traces without altering the original captured file.
- Change: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Verify: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Verify: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Verify: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
Explanation
Correct Answer
C:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. The change is successful only when: Responders retain defensible evidence and remove the compromised workload through a trusted deployment path.
Incorrect Answers
A:This option addresses a different security operations topic (Reverse-engineering triage without unsafe execution) rather than the documented Container and ephemeral workload intrusion triage decision.
B:Change: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 776
A SOC analyst is examining this cybersecurity operations situation: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs. A proposed shortcut is: Delete every affected container and its logs before checking which image or credential enabled the compromise. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
- Delete every affected container and its logs before checking which image or credential enabled the compromise.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs.
Incorrect Answers
A:Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
B:Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Applied case: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs.
Question 777
A Cisco cybersecurity incident response review finds: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs. The team proposes: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
- Security design assurances must account for reachable adversary paths and observable implementation, not idealized topology labels.
- Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Explanation
Correct Answer
D:Demonstrable success requires: Responders retain defensible evidence and remove the compromised workload through a trusted deployment path. Applied case: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs.
Incorrect Answers
A:This option addresses a different security operations topic (Suspicious administrator activity investigation) rather than the documented Container and ephemeral workload intrusion triage decision.
B:Security design assurances must account for reachable adversary paths and observable implementation, not idealized topology labels. A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs.
C:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 778
The SOC team has not yet approved changes. Current evidence indicates: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks.
- Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
Explanation
Correct Answer
B:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order. A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs.
C:Correlate parent-child processes, script content, EDR tampering, login timeline and known authorized tasks. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 779
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Responders retain defensible evidence and remove the compromised workload through a trusted deployment path.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation.
- Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive.
Explanation
Correct Answer
A:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. The approved implementation step was: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
Incorrect Answers
B:The case identifies material unauthorized behavior and preserves evidence for further containment. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
C:The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
D:Responders can prioritize safe containment and test detections without assuming every speculative indicator is conclusive. A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs.
Question 780
For an original CBRCOR educational scenario, consider: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Delete every affected container and its logs before checking which image or credential enabled the compromise.
- Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
Explanation
Correct Answer
D:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Required intervention: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
E:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Evidence: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
Incorrect Answers
A:Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
C:Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
