Cisco 350-201 Practice Test 82
Question 810
For an original CBRCOR educational scenario, consider: An endpoint launches an unusual interpreter and creates a scheduled task but no known-bad hash appears in antivirus feeds. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Check: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Close every incident without investigation unless a signature engine reports a known malware filename.
Explanation
Correct Answer
A:Evidence: Join authentication, access changes, process ancestry and change approvals for one principal over a bounded incident timeline.
C:Required intervention: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
Incorrect Answers
B:Check: Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
D:Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Behavior-based detection can recognize attack progress even when exact files and addresses are unknown.
Question 811
A SOC analyst is examining this cybersecurity operations situation: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP. A proposed shortcut is: Publish only the first sandbox IP as a permanent universal indicator and omit supporting host evidence. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry.
- Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
- Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
- Publish only the first sandbox IP as a permanent universal indicator and omit supporting host evidence.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP.
Incorrect Answers
A:Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
C:Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 812
A Cisco cybersecurity incident response review finds: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP. The team proposes: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
- Reverse engineering can reveal logic and conditions, but static possibilities require evidence before being reported as executed acts.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
Explanation
Correct Answer
A:Demonstrable success requires: Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity. Applied case: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP.
Incorrect Answers
B:This option addresses a different security operations topic (Reverse-engineering triage without unsafe execution) rather than the documented Sandbox-derived multi-artifact IOC production decision.
C:AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 813
The SOC team has not yet approved changes. Current evidence indicates: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions.
- Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment.
- Examine object access logs, policy history, credential use, request source and affected file classifications.
Explanation
Correct Answer
B:Confirm afterward that: Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity. Applied case: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP.
Incorrect Answers
A:Compare hash, DNS, process behavior, privileged changes and threat intelligence freshness against known benign conditions. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
C:Trace contractor-origin traffic and encryption termination across gateways, proxies and backend services in a test environment. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Examine object access logs, policy history, credential use, request source and affected file classifications. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 814
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity.
- The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation.
- Investigators can reproduce findings from an untampered original while analysis copies remain isolated.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Explanation
Correct Answer
A:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Applied case: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP.
Incorrect Answers
B:The incident record distinguishes attack traffic from legitimate demand and supports proportionate mitigation. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
C:Investigators can reproduce findings from an untampered original while analysis copies remain isolated. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:This option addresses a different security operations topic (Phishing-led credential compromise investigation) rather than the documented Sandbox-derived multi-artifact IOC production decision.
Question 815
An implementation sign-off request identifies the following problem: A suspicious sample in an isolated lab creates a new service, contacts a domain and writes a distinctive file, but analysts record only one IP. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Verify: Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Verify: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Verify: Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Verify: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
Explanation
Correct Answer
B:The change is successful only when: Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity.
Incorrect Answers
A:Change: Run only authorized samples in an isolated, instrumented, disposable sandbox with egress controls and snapshot recovery. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
C:Change: Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 816
A SOC analyst is examining this cybersecurity operations situation: A test program changes its network endpoint each run while retaining consistent persistence and process behavior. A proposed shortcut is: Publish only the first sandbox IP as a permanent universal indicator and omit supporting host evidence. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence.
- Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
- Publish only the first sandbox IP as a permanent universal indicator and omit supporting host evidence.
- Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance.
Explanation
Correct Answer
B:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A test program changes its network endpoint each run while retaining consistent persistence and process behavior.
Incorrect Answers
A:Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
C:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Applied case: A test program changes its network endpoint each run while retaining consistent persistence and process behavior.
D:Produce a concise defensive summary with observed behavior, confidence, hashes, infrastructure context and detection or containment guidance. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 817
A Cisco cybersecurity incident response review finds: A test program changes its network endpoint each run while retaining consistent persistence and process behavior. The team proposes: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
- Complex signatures need both malicious coverage and false-positive evaluation before production deployment.
- Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
Explanation
Correct Answer
C:Demonstrable success requires: Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity. Applied case: A test program changes its network endpoint each run while retaining consistent persistence and process behavior.
Incorrect Answers
A:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
B:Complex signatures need both malicious coverage and false-positive evaluation before production deployment. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 818
The SOC team has not yet approved changes. Current evidence indicates: A test program changes its network endpoint each run while retaining consistent persistence and process behavior. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file.
Explanation
Correct Answer
C:Confirm afterward that: Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity. Applied case: A test program changes its network endpoint each run while retaining consistent persistence and process behavior.
Incorrect Answers
A:Replay representative benign installer traces and malicious test artifacts and compare true and false matches. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
B:Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 819
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A test program changes its network endpoint each run while retaining consistent persistence and process behavior. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The case identifies whether protected data left the approved boundary and preserves evidence for affected records.
- Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity.
- Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access.
- The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering.
Explanation
Correct Answer
B:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:The case identifies whether protected data left the approved boundary and preserves evidence for affected records. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
C:Unauthorized callers cannot impersonate another user or promote a low-trust processing component to administrator access. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
Question 820
For an original CBRCOR educational scenario, consider: A test program changes its network endpoint each run while retaining consistent persistence and process behavior. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence.
- Check: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Check: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Publish only the first sandbox IP as a permanent universal indicator and omit supporting host evidence.
- Change: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
Explanation
Correct Answer
C:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Acceptance: Detection content identifies the behavioral pattern without confusing transient infrastructure with immutable identity.
E:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Evidence: Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
Incorrect Answers
A:Change: Correlate suspicious behavioral chains and distinguish authorized automation from adversary tradecraft using actor and timing evidence. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
B:Check: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline. Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist.
D:Combining network, file and persistence observations supports richer defensive detections than a brittle single-address blocklist. Use this instead: Capture multiple corroborated sandbox indicators with confidence and classify which are stable enough for detection engineering.
