Cisco 350-201 Practice Test 87
Question 860
For an original CBRCOR educational scenario, consider: An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it.
- Check: Verify affected versions, reachable services, control enforcement and vendor remediation status with a safe test.
- Change: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Ignore exposure and rely solely on an antivirus scan while leaving a known remotely exploitable service publicly accessible.
Explanation
Correct Answer
C:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Required intervention: Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
D:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. Acceptance: Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
Incorrect Answers
A:Check: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
B:Change: Use static metadata, signature validation, hashes and reputable intelligence to triage the sample without running it. An outdated application library is patched but the same vulnerable service remains directly reachable through an unmonitored legacy port.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
Question 861
A SOC analyst is examining this cybersecurity operations situation: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image. A proposed shortcut is: Patch low-impact isolated assets first solely because their advisory was published one day earlier. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated.
- Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
- Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Patch low-impact isolated assets first solely because their advisory was published one day earlier.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image.
Incorrect Answers
A:Use a risk-based combination of vendor fixes, exposure restrictions, compensating controls and verification until the vulnerable path is eliminated. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
B:Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
D:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 862
A Cisco cybersecurity incident response review finds: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image. The team proposes: Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty.
- Data exposure requires both effective permissions and observed access paths; a public setting alone does not prove every file was downloaded.
- Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized.
- A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Explanation
Correct Answer
D:Demonstrable success requires: Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners. Applied case: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image.
Incorrect Answers
A:Effective mitigation addresses exploitability at its exposed path while preserving necessary business functions and documenting residual uncertainty. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
B:This option addresses a different security operations topic (Cloud object storage suspected data loss) rather than the documented CVSS vector and exploit context prioritization decision.
C:Administrative actions require contextual authorization and sequencing; a valid login does not prove every later action was authorized. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 863
The SOC team has not yet approved changes. Current evidence indicates: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
- Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
- Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
Explanation
Correct Answer
D:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Applied case: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image.
Incorrect Answers
A:Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
B:Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:This option addresses a different security operations topic (Malware reverse engineering output communication) rather than the documented CVSS vector and exploit context prioritization decision.
Question 864
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Risky connections are restricted safely while essential device functionality and forensic observations remain preserved.
- Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
- Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure.
- Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
Explanation
Correct Answer
B:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Risky connections are restricted safely while essential device functionality and forensic observations remain preserved. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:Attack exposure declines with measurable control coverage and the underlying fix is tracked to closure. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
D:Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 865
An implementation sign-off request identifies the following problem: Two findings have similar CVSS base scores but one is exploited against a public identity service and the other affects an isolated retired lab image. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Establish the authenticated actor and change provenance, then examine persistence, privileges and lateral activity using approved logs. Verify: Review session origin, identity events, task creation, process trees and approved change records for the same time span.
- Change: Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Verify: Replay representative benign installer traces and malicious test artifacts and compare true and false matches.
- Change: Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation. Verify: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Verify: Examine HTTP status, WAF counters, connection rates, geographic distribution and provider telemetry around the event.
Explanation
Correct Answer
C:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. The change is successful only when: Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
Incorrect Answers
A:Change: Establish the authenticated actor and change provenance, then examine persistence, privileges and lateral activity using approved logs. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
B:Change: Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
D:Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 866
A SOC analyst is examining this cybersecurity operations situation: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited. A proposed shortcut is: Patch low-impact isolated assets first solely because their advisory was published one day earlier. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Patch low-impact isolated assets first solely because their advisory was published one day earlier.
- Reconstruct authorized files or streams from packet evidence, verify completeness and hash recovered objects before isolated analysis.
Explanation
Correct Answer
A:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited.
Incorrect Answers
B:Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Applied case: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited.
D:Reconstruct authorized files or streams from packet evidence, verify completeness and hash recovered objects before isolated analysis. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 867
A Cisco cybersecurity incident response review finds: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited. The team proposes: Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs.
- Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical.
- AI can highlight anomalies but does not replace ordered causal reconstruction or evidence of intent and data movement.
- A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Explanation
Correct Answer
D:Demonstrable success requires: Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners. Applied case: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited.
Incorrect Answers
A:Organic demand and deliberate floods can produce high volume but differ in source behavior, effectiveness and mitigation needs. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
B:Short-lived workloads can disappear faster than traditional endpoint evidence; platform audit trails and image provenance are critical. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:This option addresses a different security operations topic (AI-assisted traffic attack timeline reconstruction) rather than the documented CVSS vector and exploit context prioritization decision.
Question 868
The SOC team has not yet approved changes. Current evidence indicates: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation.
- Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
- Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting.
Explanation
Correct Answer
C:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Confirm afterward that: Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
Incorrect Answers
A:Compare repeated sandbox runs, host artifacts, DNS requests and source-event timestamps under controlled isolation. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
B:Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
D:Compare function structure, persistence behavior, network patterns and independently sourced campaign reporting. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 869
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
- The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained.
- The published indicator preserves measured coverage without overwhelming legitimate workstation activity.
- The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering.
Explanation
Correct Answer
A:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. The approved implementation step was: Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
Incorrect Answers
B:The case identifies confirmed malicious actions and coverage gaps while necessary evidence is retained. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:The published indicator preserves measured coverage without overwhelming legitimate workstation activity. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
D:The analysis captures linked behavior and preserves artifacts needed for follow-up detection engineering. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 870
For an original CBRCOR educational scenario, consider: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
- Check: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
- Patch low-impact isolated assets first solely because their advisory was published one day earlier.
- Change: Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners.
Explanation
Correct Answer
B:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Acceptance: Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
D:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Evidence: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
Incorrect Answers
A:Check: Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
E:Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.