Cisco 350-201 Practice Test 88
Question 870
For an original CBRCOR educational scenario, consider: A triage spreadsheet ranks vulnerabilities only by disclosure date even after CISA lists a critical gateway issue as known exploited. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window.
- Check: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
- Patch low-impact isolated assets first solely because their advisory was published one day earlier.
- Change: Combine CVSS vector characteristics with active exploitation, exposure, business impact and mitigation feasibility when planning remediation.
- Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners.
Explanation
Correct Answer
B:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Acceptance: Remediation order is defendable from technical and business evidence and high-risk exceptions have accountable owners.
D:A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence. Evidence: Review vector metrics, affected version, known-exploited status, internet exposure and business dependency for each candidate.
Incorrect Answers
A:Check: Compare switch-port location, device identity, traffic patterns, firmware version and documented maintenance window. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
E:Change: Rank modeled abuse cases by likelihood, reachability, control gaps and plausible organizational impact with named owners. A base severity score is general technical guidance; operational risk changes with environment, threat activity and system consequence.
Question 871
A SOC analyst is examining this cybersecurity operations situation: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested. A proposed shortcut is: Mark every finding fixed when the change request is approved even if the vulnerable software remains installed. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior.
- Mark every finding fixed when the change request is approved even if the vulnerable software remains installed.
- Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context.
- Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested.
Incorrect Answers
A:Use permitted disassembly or decompilation to inspect code paths and annotate observed routines before attributing runtime behavior. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
B:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
C:Validate complex indicators against benign reference telemetry and scope them with specific process, path or network context. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 872
A Cisco cybersecurity incident response review finds: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested. The team proposes: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
- Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time.
- Complex signatures need both malicious coverage and false-positive evaluation before production deployment.
- File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries.
Explanation
Correct Answer
A:Relevant validation before approval: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records. This principle explains the proposed technical approach, which is: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
Incorrect Answers
B:Threat infrastructure can be reused or reallocated; the same artifact may have different risk meaning over time. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
C:Complex signatures need both malicious coverage and false-positive evaluation before production deployment. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
D:File extraction from network captures depends on complete protocol visibility, correct reassembly and known transfer boundaries. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 873
The SOC team has not yet approved changes. Current evidence indicates: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Examine object access logs, policy history, credential use, request source and affected file classifications.
- Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance.
- Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Match call graphs and code references to observed sandbox traces without altering the original captured file.
Explanation
Correct Answer
C:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Applied case: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested.
Incorrect Answers
A:Examine object access logs, policy history, credential use, request source and affected file classifications. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
B:Trace report claims to static or dynamic artifacts and ensure indicators contain sufficient context and expiration guidance. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
D:Match call graphs and code references to observed sandbox traces without altering the original captured file. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 874
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes.
- Closed issues show tested remediation and overdue exceptions are transparent and time bounded.
- Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff.
- Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented.
Explanation
Correct Answer
B:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. The approved implementation step was: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
Incorrect Answers
A:The highest-impact reachable abuse paths receive prioritized, tracked and retested control changes. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
C:Invalid assumptions are corrected and exposed flows receive measurable safeguards before risk signoff. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
D:Incident owners can report confirmed versus potential exposed objects and verify unauthorized reads are prevented. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 875
An implementation sign-off request identifies the following problem: A critical vulnerability is accepted without an expiration date even though its compensating firewall rule was never tested. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Verify: Review MDM compliance, profile installation, app permissions, OS version and correlated cloud sign-ins.
- Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. Verify: Walk an authenticated and unauthenticated request through the data-flow diagram and record boundary enforcement at every crossing.
- Change: Reconstruct a timestamped attack hypothesis from network and identity events and validate model output against packet or flow evidence. Verify: Align endpoint, DNS, proxy and SIEM timestamps and compare candidate events to an approved workload baseline.
- Change: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Verify: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
Explanation
Correct Answer
D:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. The change is successful only when: Closed issues show tested remediation and overdue exceptions are transparent and time bounded.
Incorrect Answers
A:Change: Correlate mobile device management posture, installed profiles, app provenance, identity logins and available mobile telemetry. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
B:Change: Identify valuable data and entry points, draw trust boundaries and map potential abuse paths before selecting controls. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
C:This option addresses a different security operations topic (AI-assisted traffic attack timeline reconstruction) rather than the documented Vulnerability remediation SLA and exception tracking decision.
Question 876
A SOC analyst is examining this cybersecurity operations situation: A high-impact identity-service patch misses the organization SLA and the ticket is silently marked resolved to improve dashboard metrics. A proposed shortcut is: Mark every finding fixed when the change request is approved even if the vulnerable software remains installed. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation.
- Mark every finding fixed when the change request is approved even if the vulnerable software remains installed.
- Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment.
- Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Incorrect Answers
A:Correlate process trees, file writes, registry or task persistence and outbound activity during isolated behavioral observation. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
B:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Use this instead: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
C:Preserve container image identity, runtime events, orchestrator audit and ephemeral artifacts before controlled replacement or redeployment. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 877
A Cisco cybersecurity incident response review finds: A high-impact identity-service patch misses the organization SLA and the ticket is silently marked resolved to improve dashboard metrics. The team proposes: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
- IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes.
- Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable.
- Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents.
Explanation
Correct Answer
A:Relevant validation before approval: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records. Demonstrable success requires: Closed issues show tested remediation and overdue exceptions are transparent and time bounded.
Incorrect Answers
B:IOCs identify specific observable artifacts while IOAs characterize suspicious actions or sequences that may survive simple artifact changes. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
C:Mobile intrusion visibility differs from desktop EDR; configuration profiles and identity compromise can reveal abuse when full host artifacts are unavailable. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
D:Data volume alone cannot establish malicious exfiltration; authorization, sensitivity and destination context discriminate incidents. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 878
The SOC team has not yet approved changes. Current evidence indicates: A high-impact identity-service patch misses the organization SLA and the ticket is silently marked resolved to improve dashboard metrics. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation.
- Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries.
- Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window.
Explanation
Correct Answer
A:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. If confirmed, the proportionate intervention is: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
Incorrect Answers
B:Verify network isolation, process monitoring, snapshot integrity and blocked access to corporate resources before a harmless simulation. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
C:Record cryptographic hash, signer trust, compile metadata and comparison with authorized known-good binaries. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
D:Capture pod metadata, image digest, runtime process traces, service identity and cluster API events from an incident window. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 879
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A high-impact identity-service patch misses the organization SLA and the ticket is silently marked resolved to improve dashboard metrics. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Responders retain defensible evidence and remove the compromised workload through a trusted deployment path.
- Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable.
- Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary.
- Closed issues show tested remediation and overdue exceptions are transparent and time bounded.
Explanation
Correct Answer
D:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Responders retain defensible evidence and remove the compromised workload through a trusted deployment path. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
B:Unauthorized persistence or role changes are contained and legitimate maintenance actions remain attributable. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
C:Reviewers can locate sensitive flows and propose testable controls for each relevant entry point and trust boundary. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
Question 880
For an original CBRCOR educational scenario, consider: A high-impact identity-service patch misses the organization SLA and the ticket is silently marked resolved to improve dashboard metrics. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool.
- Change: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
- Check: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
- Mark every finding fixed when the change request is approved even if the vulnerable software remains installed.
- Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events.
Explanation
Correct Answer
B:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Evidence: Compare scan findings, actual versions, ticket due dates, firewall test results and exception approval records.
C:Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure. Required intervention: Tie vulnerability priority to risk-based deadlines, verified mitigations, accountable exception approvals and post-change rescan.
Incorrect Answers
A:Check: Compare import symbols, section entropy, readable references and trusted metadata under a nonexecuting analysis tool. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
D:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
E:Change: Compare service health, source distribution, protocol anomalies and traffic baseline before classifying and escalating availability events. Vulnerability management needs verified remediation and governance for overdue exposure rather than cosmetic ticket closure.
