Cisco 350-201 Practice Test 86
Question 850
For an original CBRCOR educational scenario, consider: An API with inadequate object authorization returns another customer's records, but teams monitor only bulk network-transfer size. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Declare no breach because the network export was small and the application server still runs normally.
- Check: Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file.
- Change: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
- Check: Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
Explanation
Correct Answer
C:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Acceptance: The exposure report identifies confirmed unauthorized access, bounded data scope and validated control fixes.
D:Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected. Required intervention: Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
Incorrect Answers
A:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
B:Check: Compute acquisition and verification hashes, inspect evidence metadata and review storage access using a harmless test file. Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
E:Change: Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Data loss can arise from application authorization flaws or database misuse even when no suspicious executable is detected.
Question 851
A SOC analyst is examining this cybersecurity operations situation: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule. A proposed shortcut is: Ignore exposure and rely solely on an antivirus scan while leaving a known remotely exploitable service publicly accessible. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Ignore exposure and rely solely on an antivirus scan while leaving a known remotely exploitable service publicly accessible.
- Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval.
- Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule.
Incorrect Answers
A:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
B:Investigate using device-supported logs, network telemetry, firmware integrity and vendor-safe containment with operational stakeholder approval. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
D:Validate the transfer destination, identity, data classification and approved business purpose before deciding containment and impact. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 852
A Cisco cybersecurity incident response review finds: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule. The team proposes: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
- Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators.
- Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output.
- Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Explanation
Correct Answer
D:Demonstrable success requires: Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. This principle explains the proposed technical approach, which is: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
Incorrect Answers
A:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
B:Hash identity is exact-file evidence while family similarity and actor attribution require corroborated, discriminating indicators. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
C:Actionable analysis communicates validated findings and limits to each audience instead of only raw tool output. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 853
The SOC team has not yet approved changes. Current evidence indicates: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
- Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
- Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
Explanation
Correct Answer
C:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Applied case: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule.
Incorrect Answers
A:Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
B:This option addresses a different security operations topic (Denial-of-service incident investigation) rather than the documented Vulnerability mitigation and defense layers decision.
D:Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 854
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Cases use artifact and behavior evidence proportionately and avoid confident attribution based on a single low-quality match.
- Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
- Malicious sessions or grants are restricted and all observed affected accounts are documented without unnecessary bulk reset.
Explanation
Correct Answer
C:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. The approved implementation step was: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
Incorrect Answers
A:This option addresses a different security operations topic (IOC versus behavioral IOA interpretation) rather than the documented Vulnerability mitigation and defense layers decision.
B:Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
D:This option addresses a different security operations topic (Phishing-led credential compromise investigation) rather than the documented Vulnerability mitigation and defense layers decision.
Question 855
An implementation sign-off request identifies the following problem: A vendor fix for a remotely exposed service is temporarily unavailable and the security team has not considered a targeted protective rule. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Verify: Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Verify: Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Change: Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Verify: Examine timestamped process lineage, created artifacts and relevant configuration changes from the sandbox telemetry.
- Change: Model identity spoofing and privilege escalation at the specific component interfaces and enforce server-side authorization and restricted service roles. Verify: Review token validation, authorization decisions and service account grants for negative identity and permission tests.
Explanation
Correct Answer
A:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. The change is successful only when: Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
Incorrect Answers
B:Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
C:This option addresses a different security operations topic (Behavioral process and persistence observation) rather than the documented Vulnerability mitigation and defense layers decision.
D:This option addresses a different security operations topic (Threat modeling spoofing and elevation risks) rather than the documented Vulnerability mitigation and defense layers decision.
Question 856
A SOC analyst is examining this cybersecurity operations situation: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port. A proposed shortcut is: Ignore exposure and rely solely on an antivirus scan while leaving a known remotely exploitable service publicly accessible. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Ignore exposure and rely solely on an antivirus scan while leaving a known remotely exploitable service publicly accessible.
- Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement.
- Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port.
Incorrect Answers
B:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Use this instead: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
C:Trace source queries, API authorization, generated artifacts and egress logs to determine actual affected records and data movement. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
D:Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 857
A Cisco cybersecurity incident response review finds: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port. The team proposes: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
- A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
- Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Explanation
Correct Answer
A:Demonstrable success requires: Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. Applied case: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port.
Incorrect Answers
B:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
C:Threat models connect assets, actors, entry points and boundaries to plausible failure or abuse scenarios rather than treating all components equally. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
D:Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 858
The SOC team has not yet approved changes. Current evidence indicates: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines.
- Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking.
- Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline.
- Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
Explanation
Correct Answer
D:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Applied case: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port.
Incorrect Answers
A:Join proxy, DLP, cloud object, user and change-ticket events for the relevant upload and compare authorized baselines. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
B:Check current resolution, hosting, traffic, original report and benign shared-service use before enforcing broad blocking. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
C:Reconcile query audit, request principals, application logs, file hashes and destination transfers across a consistent timeline. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 859
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
- The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes.
- The resulting report separates code-capability findings from verified executions and documents uncertainty.
- Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation.
Explanation
Correct Answer
A:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. The result must be validated using the documented device, service or access context.
Incorrect Answers
B:The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
C:The resulting report separates code-capability findings from verified executions and documents uncertainty. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
D:Unauthorized enrollment or grants are revoked with preserved evidence and supported device remediation. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 860
For an original CBRCOR educational scenario, consider: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Check: Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Ignore exposure and rely solely on an antivirus scan while leaving a known remotely exploitable service publicly accessible.
Explanation
Correct Answer
C:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Required intervention: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
D:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Acceptance: Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
Incorrect Answers
A:Check: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
B:Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
