Cisco 350-201 Practice Test 9
Question 80
For an original CBRCOR educational scenario, consider: A content-management account modifies production templates unexpectedly and the team wants to restore from backup without preserving access logs. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Track precision, missed detections, analyst workload and case outcomes together when measuring and tuning alert efficacy.
- Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM.
- Change: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
- Check: Compare known-good artifact hashes, content history, CMS authentication events and deployment approvals with the changed files.
- Replace the visible page and skip investigating the account or pipeline that wrote the malicious content.
Explanation
Correct Answer
C:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Acceptance: The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
D:Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active. Required intervention: Preserve web and identity evidence, remove unauthorized access, restore trusted content and validate integrity using the defacement playbook.
Incorrect Answers
A:This option addresses a different security operations topic (False positives and alert quality metrics) rather than the documented Website-defacement response workflow decision.
B:Check: Compare the service contract, guest patch inventory, security groups and administration paths for the vulnerable VM. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
E:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Restoration alone can reintroduce compromise when the entry point, credential abuse or altered deployment artifacts remain active.
Question 81
A SOC analyst is examining this cybersecurity operations situation: An online merchant stores payment-card account data and assumes a generic SOC report replaces all payment security obligations. A proposed shortcut is: Declare every system out of scope because the merchant uses a third-party payment page with no network review. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS.
- Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs.
- Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Declare every system out of scope because the merchant uses a third-party payment page with no network review.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
Incorrect Answers
A:Separate provider-managed runtime maintenance from customer responsibilities for application code, identities, secrets and data access on PaaS. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
B:Follow the privilege-escalation playbook by validating grant provenance, securing affected identities and preserving identity and endpoint logs. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 82
A Cisco cybersecurity incident response review finds: An online merchant stores payment-card account data and assumes a generic SOC report replaces all payment security obligations. The team proposes: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
- Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
- Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions.
- Time-sensitive response must balance business disruption against continuing harm with clear incident command and authority.
Explanation
Correct Answer
B:Demonstrable success requires: Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service. This principle explains the proposed technical approach, which is: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
Incorrect Answers
A:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
C:Insurance may offset defined losses but cannot prevent an intrusion or override exclusions, limits and incident-reporting conditions. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:This option addresses a different security operations topic (Proportionate containment authorization) rather than the documented PCI DSS and payment-card scope decision.
Question 83
The SOC team has not yet approved changes. Current evidence indicates: An online merchant stores payment-card account data and assumes a generic SOC report replaces all payment security obligations. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix.
- Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
Explanation
Correct Answer
B:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. Confirm afterward that: Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service.
Incorrect Answers
A:Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
C:Review runtime patch boundaries, service identities, secret storage, data grants and audit logs in the platform's responsibility matrix. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
Question 84
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An online merchant stores payment-card account data and assumes a generic SOC report replaces all payment security obligations. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use.
- The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure.
- Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service.
- The site serves validated trusted content and the unauthorized change path is closed without losing investigative records.
Explanation
Correct Answer
C:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Unauthorized grants are contained with approved access restoration and investigators preserve a sequenced record of use. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
B:The collection captures the needed volatile indicators without altering evidence beyond the authorized acquisition procedure. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:This option addresses a different security operations topic (Website-defacement response workflow) rather than the documented PCI DSS and payment-card scope decision.
Question 85
An implementation sign-off request identifies the following problem: An online merchant stores payment-card account data and assumes a generic SOC report replaces all payment security obligations. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Verify: Dry-run an affected host through collection, isolation, validated cleanup and signed closure using a timeline checklist.
- Change: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Verify: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Change: Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures. Verify: Trace workload locations, ownership, identity federation, physical administration and connectivity across a representative service.
- Change: Execute preparation, detection and analysis, containment, eradication, recovery and post-incident improvement with evidence at each stage. Verify: Reconstruct an incident timeline and check the recorded decision, evidence and closure prerequisites for each stage.
Explanation
Correct Answer
B:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. The change is successful only when: Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service.
Incorrect Answers
A:Change: Add evidence-preservation, safe containment, eradication verification and closure criteria as separate gated playbook stages. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
C:Change: Identify the deployment model and operational boundary for public, private, hybrid and multicloud architectures.
D:This option addresses a different security operations topic (Incident response lifecycle and documentation) rather than the documented PCI DSS and payment-card scope decision.
Question 86
A SOC analyst is examining this cybersecurity operations situation: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment. A proposed shortcut is: Declare every system out of scope because the merchant uses a third-party payment page with no network review. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure.
- Declare every system out of scope because the merchant uses a third-party payment page with no network review.
- Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy.
Explanation
Correct Answer
C:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment.
Incorrect Answers
A:Validate eradication, credential rotation, clean restoration and heightened post-recovery monitoring before formal closure. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
B:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. Applied case: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment.
D:Select a permitted endpoint-response collection tool and prioritize volatile evidence according to the case and chain-of-custody policy. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
Question 87
A Cisco cybersecurity incident response review finds: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment. The team proposes: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Different incident-response timing metrics describe separate delays and become misleading when timestamps or sample inclusion differ.
- Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
- A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise.
- Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure.
Explanation
Correct Answer
B:Demonstrable success requires: Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service. Applied case: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment.
Incorrect Answers
A:This option addresses a different security operations topic (Mean time to detect and respond metrics) rather than the documented PCI DSS and payment-card scope decision.
C:A smaller alert queue is not evidence of better coverage if true threats are suppressed alongside noise. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Containment reduces immediate exposure but does not replace forensic preservation, recovery testing or incident closure. A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment.
Question 88
The SOC team has not yet approved changes. Current evidence indicates: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
- Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Re-run a labeled set of benign and malicious activity against the rule and review precision, recall and handling effort.
- Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements.
Explanation
Correct Answer
A:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. This check tests the actual security, identity or operational boundary before an operationally risky response.
Incorrect Answers
B:Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment.
C:Re-run a labeled set of benign and malicious activity against the rule and review precision, recall and handling effort. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Compare modeled incident losses with coverage triggers, sublimits, deductibles and proof-of-controls requirements. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
Question 89
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Investigators can correlate the query source, destination, timing and relevant traffic while stating each source's limitations.
- Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report.
- Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service.
- Business functions recover and previously observed malicious access paths fail under documented checks.
Explanation
Correct Answer
C:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. The approved implementation step was: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
Incorrect Answers
A:This option addresses a different security operations topic (Network monitoring tool selection) rather than the documented PCI DSS and payment-card scope decision.
B:Owners receive the correct control requirements and gaps are not hidden behind an unrelated audit report. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Business functions recover and previously observed malicious access paths fail under documented checks. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
Question 90
For an original CBRCOR educational scenario, consider: A third-party checkout provider handles cards but a retailer has not mapped which systems can still impact its cardholder-data environment. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Change: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
- Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation.
- Declare every system out of scope because the merchant uses a third-party payment page with no network review.
- Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties.
- Check: Trace card data paths, payment integrations, service-provider attestations and relevant encryption and access controls.
Explanation
Correct Answer
A:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. Acceptance: Auditors can identify in-scope components, responsibility boundaries and objective PCI DSS evidence for the payment service.
E:Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label. Required intervention: Map the payment-data flows and contracted provider responsibilities to applicable PCI DSS controls and scope.
Incorrect Answers
B:Check: Compare directory audit events, cloud role grants, sign-in history and approved change tickets around the escalation. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
C:For this select two assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
D:Change: Treat cyber insurance as conditional financial risk transfer alongside preventative controls and verify policy coverage, retention and notification duties. Payment-card data environments require scoping and control evidence tied to card processing, storage and transmission, not a generic assurance label.
