Cisco 350-201 Practice Test 8
Question 70
For an original CBRCOR educational scenario, consider: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant.
- Check: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario.
- Permanently deny all external traffic as the default reaction to any sudden increase in request volume.
- Change: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
- Check: Compare baseline and attack traffic, origin distribution, edge capacity and business request success before and after controls.
Explanation
Correct Answer
D:Acceptance: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Applied case: A provider detects an inbound packet flood on a regional edge but responders propose blocking the entire internet indefinitely.
E:Acceptance: Attack traffic is attenuated and agreed legitimate availability indicators recover without an uncontrolled network-wide outage. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
Incorrect Answers
A:Change: Map federal-system requirements to applicable FISMA and NIST risk-management guidance and verify FedRAMP authorization scope where relevant. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
B:Check: Test restored image integrity, credential invalidation, control alerts and service behavior with a staged re-entry scenario. Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
C:Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible. Use this instead: Validate the attack pattern and coordinate rate controls, upstream mitigation and service-health monitoring through the DDoS playbook.
Question 71
A SOC analyst is examining this cybersecurity operations situation: A public product page is replaced with an unauthorized message even though the web deployment pipeline reports a successful build. A proposed shortcut is: Replace the visible page and skip investigating the account or pipeline that wrote the malicious content. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
- Replace the visible page and skip investigating the account or pipeline that wrote the malicious content.
- Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations.
- Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Incorrect Answers
B:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Measure detection, acknowledgment, containment and recovery intervals with consistent event definitions and representative incident populations. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
D:Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 72
A Cisco cybersecurity incident response review finds: A public product page is replaced with an unauthorized message even though the web deployment pipeline reports a successful build. The team proposes: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
- GDPR concerns personal-data processing rights and duties, SOX centers on public-company financial controls and SOC reports assess defined service controls.
- Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
- Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
Explanation
Correct Answer
C:Demonstrable success requires: The site serves validated trusted content and the unauthorized change path is closed without losing investigative records. This principle explains the proposed technical approach, which is: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
Incorrect Answers
A:Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
B:This option addresses a different security operations topic (Privacy and financial assurance distinctions) rather than the documented Website-defacement response workflow decision.
D:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 73
The SOC team has not yet approved changes. Current evidence indicates: A public product page is replaced with an unauthorized message even though the web deployment pipeline reports a successful build. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Walk a mock alert through the entry conditions and ownership matrix while recording decisions and approvals.
- Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
Explanation
Correct Answer
B:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Confirm afterward that: The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
Incorrect Answers
A:Inventory sensor placement, DNS log fields, flow sampling and bounded packet capture coverage for a test event. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
C:This option addresses a different security operations topic (Playbook triggers and owners) rather than the documented Website-defacement response workflow decision.
D:Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 74
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A public product page is replaced with an unauthorized message even though the web deployment pipeline reports a successful build. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
- Trend metrics identify the specific stage that slows response and are reproducible from incident evidence.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
Explanation
Correct Answer
D:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
B:Trend metrics identify the specific stage that slows response and are reproducible from incident evidence. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
C:Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 75
An implementation sign-off request identifies the following problem: A public product page is replaced with an unauthorized message even though the web deployment pipeline reports a successful build. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook. Verify: Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Verify: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Change: Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Verify: Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Verify: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
Explanation
Correct Answer
A:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. The change is successful only when: The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
Incorrect Answers
B:Change: Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
C:This option addresses a different security operations topic (PaaS runtime and data-governance responsibility) rather than the documented Website-defacement response workflow decision.
D:Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 76
A SOC analyst is examining this cybersecurity operations situation: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs. A proposed shortcut is: Replace the visible page and skip investigating the account or pipeline that wrote the malicious content. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
- Replace the visible page and skip investigating the account or pipeline that wrote the malicious content.
- Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question.
- Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs.
Incorrect Answers
A:Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
B:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Applied case: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs.
C:Combine approved DNS telemetry, flow metadata and packet capture where available, choosing visibility according to the investigative question. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 77
A Cisco cybersecurity incident response review finds: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs. The team proposes: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes.
- Distributed floods require traffic characterization and scalable mitigation that keeps permitted business flows available when possible.
- Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Explanation
Correct Answer
C:Demonstrable success requires: The site serves validated trusted content and the unauthorized change path is closed without losing investigative records. Applied case: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs.
Incorrect Answers
A:Government assurance depends on designated system categorization, assessed controls and authorization scope; unrelated certificates are not substitutes. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
B:This option addresses a different security operations topic (DoS and DDoS response playbook) rather than the documented Website-defacement response workflow decision.
D:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 78
The SOC team has not yet approved changes. Current evidence indicates: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
Explanation
Correct Answer
D:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
A:Review agency system boundary, NIST control baseline, authorization package and cloud service FedRAMP listing. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
B:Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
C:Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 79
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
- The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
- Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use.
Explanation
Correct Answer
A:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. The approved implementation step was: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
Incorrect Answers
B:The residual-risk plan documents covered and uncovered exposures without removing essential security operations safeguards. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
C:The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
D:Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 80
For an original CBRCOR educational scenario, consider: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy.
- Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Change: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
- Check: Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Replace the visible page and skip investigating the account or pipeline that wrote the malicious content.
Explanation
Correct Answer
C:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Acceptance: The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
D:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Required intervention: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
Incorrect Answers
A:This option addresses a different security operations topic (False positives and alert quality metrics) rather than the documented Website-defacement response workflow decision.
B:Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
