Cisco 350-201 Practice Test 79
Question 780
For an original CBRCOR educational scenario, consider: A cloud autoscaling service terminates an affected instance and the team loses its ephemeral disk without collecting orchestration audit logs. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Delete every affected container and its logs before checking which image or credential enabled the compromise.
- Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Check: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
Explanation
Correct Answer
D:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Required intervention: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
E:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Evidence: Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
Incorrect Answers
A:Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
B:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
C:Check: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation. Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Question 781
A SOC analyst is examining this cybersecurity operations situation: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest. A proposed shortcut is: Treat any unknown IP address as indisputable proof of a completed compromise. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
- Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion.
- Treat any unknown IP address as indisputable proof of a completed compromise.
- Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest.
Incorrect Answers
A:Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
C:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
D:This option addresses a different security operations topic (Database and application data leakage investigation) rather than the documented IOC versus behavioral IOA interpretation decision.
Question 782
A Cisco cybersecurity incident response review finds: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest. The team proposes: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries.
- IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
- Data exposure requires both effective permissions and observed access paths; a public setting alone does not prove every file was downloaded.
- A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Explanation
Correct Answer
B:Relevant validation before approval: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Applied case: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest.
Incorrect Answers
A:File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
C:Data exposure requires both effective permissions and observed access paths; a public setting alone does not prove every file was downloaded. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
D:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 783
The SOC team has not yet approved changes. Current evidence indicates: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts.
Explanation
Correct Answer
B:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Applied case: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest.
Incorrect Answers
A:Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
C:Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
D:Compare tool execution records, service accounts, destination processes and ordered connections for representative hosts. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 784
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match.
- Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
- Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable.
- Investigators can reproduce findings from an untampered original while analysis copies remain isolated.
Explanation
Correct Answer
A:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
C:Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
D:Investigators can reproduce findings from an untampered original while analysis copies remain isolated. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 785
An implementation sign-off request identifies the following problem: A detection rule matches a malicious file hash but fails when the same behavior appears in a repacked file with a different digest. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Verify: Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Change: Preserve the message and identity evidence, identify affected principals and sessions, revoke abuse pathways and inspect follow-on actions. Verify: Correlate message headers, URL reputation, consent records, sign-ins, mailbox rules and authorized user confirmation.
- Change: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion. Verify: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. Verify: Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
Explanation
Correct Answer
C:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. The change is successful only when: Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match.
Incorrect Answers
A:This option addresses a different security operations topic (Behavioral process and persistence observation) rather than the documented IOC versus behavioral IOA interpretation decision.
B:This option addresses a different security operations topic (Phishing-led credential compromise investigation) rather than the documented IOC versus behavioral IOA interpretation decision.
D:Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 786
A SOC analyst is examining this cybersecurity operations situation: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned. A proposed shortcut is: Treat any unknown IP address as indisputable proof of a completed compromise. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion.
- Treat any unknown IP address as indisputable proof of a completed compromise.
- Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval.
- Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned.
Incorrect Answers
B:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Applied case: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned.
C:Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
D:This option addresses a different security operations topic (Malware reverse engineering output communication) rather than the documented IOC versus behavioral IOA interpretation decision.
Question 787
A Cisco cybersecurity incident response review finds: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned. The team proposes: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
- Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset.
- Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
- Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
Explanation
Correct Answer
A:Relevant validation before approval: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Applied case: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned.
Incorrect Answers
B:Dynamic analysis may execute harmful behavior and therefore requires containment, telemetry and controlled environment reset. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
C:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
D:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 788
The SOC team has not yet approved changes. Current evidence indicates: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order.
- Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Examine object access logs, policy history, credential use, request source and affected file classifications.
Explanation
Correct Answer
C:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Compare authentication boundaries, privileged operations, exposure and threat evidence before choosing mitigation order. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
B:Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test. Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned.
D:Examine object access logs, policy history, credential use, request source and affected file classifications. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 789
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed.
- The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation.
- The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes.
- Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match.
Explanation
Correct Answer
D:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. The approved implementation step was: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion.
Incorrect Answers
A:Behavioral evidence is collected without exposing production identities or leaving the analysis host permanently changed. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
B:The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
C:The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
Question 790
For an original CBRCOR educational scenario, consider: Investigators see an unfamiliar outbound address and classify it as a confirmed attack without checking whether the service is sanctioned. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Combine concrete compromise artifacts with behavior-based attack indicators and context, separating match strength from proof of intrusion.
- Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Treat any unknown IP address as indisputable proof of a completed compromise.
- Change: Examine strings, imports, sections and packing indicators in an isolated static-analysis workflow while avoiding unsupported behavior claims.
Explanation
Correct Answer
B:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Evidence: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
C:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
Incorrect Answers
A:Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
E:This option addresses a different security operations topic (Malware strings and import-table analysis) rather than the documented IOC versus behavioral IOA interpretation decision.
