Cisco 350-201 Practice Test 81
Question 800
For an original CBRCOR educational scenario, consider: A phishing domain has changed ownership and an analyst has not checked whether its present use matches the historical incident. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Change: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry.
- Result: Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
- Check: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Result: High-confidence indicators drive targeted controls with low collateral impact and stale entries are retired.
- Check: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners.
Explanation
Correct Answer
A:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. Evidence: Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
C:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. Required intervention: Attach confidence, source, first-seen and last-seen details and scope actions to contextual indicators with review or expiry.
D:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. Result: High-confidence indicators drive targeted controls with low collateral impact and stale entries are retired.
Incorrect Answers
B:Result: Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary. Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
E:Check: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available. Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
F:Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners. Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
Question 801
A SOC analyst is examining this cybersecurity operations situation: A standard employee account performs a rare administrative grant followed by automated remote commands across several servers. A proposed shortcut is: Close every incident without investigation unless a signature engine reports a known malware filename. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Close every incident without investigation unless a signature engine reports a known malware filename.
- Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles.
- Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Incorrect Answers
B:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 802
A Cisco cybersecurity incident response review finds: A standard employee account performs a rare administrative grant followed by automated remote commands across several servers. The team proposes: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
- Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
- Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens.
Explanation
Correct Answer
A:Relevant validation before approval: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline. Demonstrable success requires: The case identifies material unauthorized behavior and preserves evidence for further containment.
Incorrect Answers
B:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Phishing investigation requires both delivery context and downstream identity behavior because removing the message does not invalidate stolen tokens. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 803
The SOC team has not yet approved changes. Current evidence indicates: A standard employee account performs a rare administrative grant followed by automated remote commands across several servers. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
Explanation
Correct Answer
D:This check tests the actual security, identity or operational boundary before an operationally risky response. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Incorrect Answers
A:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
B:Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 804
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A standard employee account performs a rare administrative grant followed by automated remote commands across several servers. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable.
- Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match.
Explanation
Correct Answer
B:The approved implementation step was: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Incorrect Answers
A:Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Only corroborated suspicious remote actions become confirmed attack steps and legitimate changes remain distinguishable. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 805
An implementation sign-off request identifies the following problem: A standard employee account performs a rare administrative grant followed by automated remote commands across several servers. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Reconstruct authorized files or streams from packet evidence, verify completeness and hash recovered objects before isolated analysis. Verify: Compare content length, stream integrity, capture drops and recovered digest against source evidence when available.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Verify: Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Verify: Examine object access logs, policy history, credential use, request source and affected file classifications.
- Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Verify: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
Explanation
Correct Answer
D:The change is successful only when: The case identifies material unauthorized behavior and preserves evidence for further containment.
Incorrect Answers
A:Change: Reconstruct authorized files or streams from packet evidence, verify completeness and hash recovered objects before isolated analysis.
B:Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Change: Correlate cloud audit, identity, object sensitivity and network activity to define exposure and revoke unauthorized access. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 806
A SOC analyst is examining this cybersecurity operations situation: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds. A proposed shortcut is: Close every incident without investigation unless a signature engine reports a known malware filename. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination.
- Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
- Close every incident without investigation unless a signature engine reports a known malware filename.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds.
Incorrect Answers
B:Acquire a permitted copy to isolated evidence storage with cryptographic hashes, timestamps and custody records before examination. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Applied case: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds.
Question 807
A Cisco cybersecurity incident response review finds: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds. The team proposes: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries.
- Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
- Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
- Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes.
Explanation
Correct Answer
B:Relevant validation before approval: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline. Applied case: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds.
Incorrect Answers
A:File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Static artifacts reveal potential capabilities but cannot prove when or whether a code path executes. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 808
The SOC team has not yet approved changes. Current evidence indicates: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
- Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Review token validation, authorization decisions and service account grants for negative identity and permission tests.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
Explanation
Correct Answer
A:This check tests the actual security, identity or operational boundary before an operationally risky response. Applied case: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds.
Incorrect Answers
B:Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:Review token validation, authorization decisions and service account grants for negative identity and permission tests. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 809
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Closed issues show tested remediation and overdue exceptions are transparent and time bounded.
- The case identifies material unauthorized behavior and preserves evidence for further containment.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
- Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented.
Explanation
Correct Answer
B:The approved implementation step was: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Applied case: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds.
Incorrect Answers
A:Closed issues show tested remediation and overdue exceptions are transparent and time bounded. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
C:The resulting report separates code-capability findings from verified executions and documents uncertainty. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 810
For an original CBRCOR educational scenario, consider: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Check: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Close every incident without investigation unless a signature engine reports a known malware filename.
Explanation
Correct Answer
A:Evidence: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
C:Required intervention: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
Incorrect Answers
B:Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
