Cisco 350-201 Practice Test 90
Question 890
For an original CBRCOR educational scenario, consider: An orchestration designer calls a daily CSV cleanup cron job a complete security incident workflow despite lacking alerts or responder approvals. Select TWO complementary steps: the targeted correction and its strongest prechange validation.
- Label any unattended script a complete SOAR playbook and ignore coordination or response authorization.
- Check: Compare parsed sample counts and fields for quoted CSV, nested JSON and namespaced XML reference records.
- Check: Trace one incident through trigger ingestion, contextual enrichment, analyst approval, action outcome and case closure.
- Change: Use a SOAR case workflow that coordinates enrichments, decisions, tickets and authorized response actions with visible state and handoffs.
- Change: Define desired collectors, roles and network policies in reviewed IaC with state, plans and idempotent convergence checks.
Explanation
Correct Answer
C:Acceptance: The team can distinguish individual automated jobs from a governed multi-step response with recoverable execution history. Applied case: An orchestration designer calls a daily CSV cleanup cron job a complete security incident workflow despite lacking alerts or responder approvals.
D:Acceptance: The team can distinguish individual automated jobs from a governed multi-step response with recoverable execution history. Automation performs a task, whereas orchestration coordinates dependent tasks, approvals and incident lifecycle across tools.
Incorrect Answers
A:Automation performs a task, whereas orchestration coordinates dependent tasks, approvals and incident lifecycle across tools. Applied case: An orchestration designer calls a daily CSV cleanup cron job a complete security incident workflow despite lacking alerts or responder approvals.
B:Check: Compare parsed sample counts and fields for quoted CSV, nested JSON and namespaced XML reference records. Automation performs a task, whereas orchestration coordinates dependent tasks, approvals and incident lifecycle across tools.
E:Change: Define desired collectors, roles and network policies in reviewed IaC with state, plans and idempotent convergence checks. Automation performs a task, whereas orchestration coordinates dependent tasks, approvals and incident lifecycle across tools.
Question 891
A SOC analyst is examining this cybersecurity operations situation: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander. A proposed shortcut is: Execute every destructive playbook step immediately and discard action logs after the run completes. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence.
- Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow.
- Execute every destructive playbook step immediately and discard action logs after the run completes.
- Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander.
Incorrect Answers
A:Quote variable expansions, validate paths, preserve logs and check command exit status before moving or deleting any evidence. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
B:Interpret authentication, authorization and resource-not-found status distinctly before remediating or escalating an API workflow. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
C:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. For this best change assessment, the shortcut changes or bypasses the necessary correctness, governance or operational boundary rather than correcting it.
Question 892
A Cisco cybersecurity incident response review finds: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander. The team proposes: Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes.
- Automation performs a task, whereas orchestration coordinates dependent tasks, approvals and incident lifecycle across tools.
- ML-assisted SOAR decisions depend on training quality and deployment context; poor labels or domain shift can propagate errors rapidly.
- Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Explanation
Correct Answer
D:Demonstrable success requires: Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes. Applied case: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander.
Incorrect Answers
A:CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
B:Automation performs a task, whereas orchestration coordinates dependent tasks, approvals and incident lifecycle across tools. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
C:ML-assisted SOAR decisions depend on training quality and deployment context; poor labels or domain shift can propagate errors rapidly. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 893
The SOC team has not yet approved changes. Current evidence indicates: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Trace one incident through trigger ingestion, contextual enrichment, analyst approval, action outcome and case closure.
- Compare running artifact hashes, pipeline history, monitoring results and recovery exercise for one staged playbook update.
- Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs.
- Test the supported batch threshold and a lost-response case while reconciling actual device action IDs and outcomes.
Explanation
Correct Answer
C:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Applied case: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander.
Incorrect Answers
A:Trace one incident through trigger ingestion, contextual enrichment, analyst approval, action outcome and case closure. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
B:Compare running artifact hashes, pipeline history, monitoring results and recovery exercise for one staged playbook update. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
D:Test the supported batch threshold and a lost-response case while reconciling actual device action IDs and outcomes. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 894
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Failed enrichments are visible while unaffected indicators continue according to documented policy.
- Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
- The team can distinguish individual automated jobs from a governed multi-step response with recoverable execution history.
- Unauthorized actions fail clearly and the selected remediation matches the observed error rather than blind retries.
Explanation
Correct Answer
B:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. The result must be validated using the documented device, service or access context.
Incorrect Answers
A:Failed enrichments are visible while unaffected indicators continue according to documented policy. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
C:The team can distinguish individual automated jobs from a governed multi-step response with recoverable execution history. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
D:Unauthorized actions fail clearly and the selected remediation matches the observed error rather than blind retries. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 895
An implementation sign-off request identifies the following problem: A phishing playbook disables a privileged account after one unconfirmed email report without asking an incident commander. Which paired technical change and validation should close the implementation review? Select ONE best answer.
- Change: Handle asynchronous acceptance and throttling according to provider documentation, tracking final job status and deferred lookup results. Verify: Emulate an accepted-then-failed action and a throttled lookup with Retry-After and inspect recorded states.
- Change: Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow. Verify: Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs.
- Change: Validate required environment values, handle missing variables explicitly and prevent secret values from entering command output or shell history. Verify: Exercise missing and set variable cases while checking permissions, output paths and redacted logs.
- Change: Use a SOAR case workflow that coordinates enrichments, decisions, tickets and authorized response actions with visible state and handoffs. Verify: Trace one incident through trigger ingestion, contextual enrichment, analyst approval, action outcome and case closure.
Explanation
Correct Answer
B:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. The change is successful only when: Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
Incorrect Answers
A:Change: Handle asynchronous acceptance and throttling according to provider documentation, tracking final job status and deferred lookup results.
C:Change: Validate required environment values, handle missing variables explicitly and prevent secret values from entering command output or shell history.
D:Change: Use a SOAR case workflow that coordinates enrichments, decisions, tickets and authorized response actions with visible state and handoffs.
Question 896
A SOC analyst is examining this cybersecurity operations situation: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned. A proposed shortcut is: Execute every destructive playbook step immediately and discard action logs after the run completes. What should the SOC analyst recommend as the narrowly scoped correction? Select ONE best answer.
- Execute every destructive playbook step immediately and discard action logs after the run completes.
- Respect published quota and Retry-After behavior, use bounded backoff and distinguish lookup failure from indicator verdict.
- Use a durable event identifier, bounded retry semantics and complete response traversal when modifying the incident workflow.
- Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow.
Explanation
Correct Answer
D:This targeted action addresses the observed security or operational control gap without discarding necessary controls. Applied case: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned.
Incorrect Answers
A:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Applied case: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned.
B:Respect published quota and Retry-After behavior, use bounded backoff and distinguish lookup failure from indicator verdict. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
C:Use a durable event identifier, bounded retry semantics and complete response traversal when modifying the incident workflow. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 897
A Cisco cybersecurity incident response review finds: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned. The team proposes: Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow. Which engineering principle most strongly supports the recommended response? Select ONE best answer.
- Network timeouts may hide a committed server action, while oversized requests can be rejected or partially processed.
- Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping.
- Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
- CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes.
Explanation
Correct Answer
C:Demonstrable success requires: Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes. Applied case: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned.
Incorrect Answers
A:Network timeouts may hide a committed server action, while oversized requests can be rejected or partially processed. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
B:Basic credentials are only encoded, not encrypted, and transport protection does not replace authorization scoping. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
D:CSV uses quoting and delimiter rules, JSON expresses structured arrays or objects, and XML uses elements and attributes. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 898
The SOC team has not yet approved changes. Current evidence indicates: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned. Which evidence best tests the technical diagnosis before approving a disruptive change? Select ONE best answer.
- Exercise malformed indicators, valid samples and an induced error while inspecting outbound requests and sanitized logging.
- Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs.
- Simulate 429 and timeouts against a mock enrichment provider and inspect retry intervals and result classification.
- Compare running artifact hashes, pipeline history, monitoring results and recovery exercise for one staged playbook update.
Explanation
Correct Answer
B:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Confirm afterward that: Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
Incorrect Answers
A:Exercise malformed indicators, valid samples and an induced error while inspecting outbound requests and sanitized logging. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
C:Simulate 429 and timeouts against a mock enrichment provider and inspect retry intervals and result classification. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
D:Compare running artifact hashes, pipeline history, monitoring results and recovery exercise for one staged playbook update. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 899
A candidate correction has been tested and the platform team requires a post-change acceptance check. Original problem: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned. The response owner needs positive and negative results and evidence that legitimate security and business workflows still function. Which acceptance result demonstrates correct security operations behavior without disrupting authorized workflows? Select ONE best answer.
- Operations and engineering can reproduce, diagnose and safely roll back the same release.
- Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
- The workflow reduces toil without allowing uncertain classification to trigger unreviewed account or network disruption.
- Tested detection logic is deployed with traceable results and failing rules remain blocked from promotion.
Explanation
Correct Answer
B:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. The approved implementation step was: Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow.
Incorrect Answers
A:Operations and engineering can reproduce, diagnose and safely roll back the same release. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
C:The workflow reduces toil without allowing uncertain classification to trigger unreviewed account or network disruption. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
D:Tested detection logic is deployed with traceable results and failing rules remain blocked from promotion. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
Question 900
For an original CBRCOR educational scenario, consider: An automation removes a suspicious firewall rule but cannot restore the prior policy when its threat intelligence verdict is overturned. Select THREE compatible elements: a proper correction, a targeted diagnostic and an acceptance result.
- Check: Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs.
- Change: Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow.
- Result: Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
- Result: New environments acquire intended telemetry and least-privilege access and repeated runs introduce no unexpected changes.
- Change: Validate status and media type before decoding an optional body, and follow documented headers for limits and continuation.
- Check: Run the script against a fixture with successes, failures, missing fields and nested JSON values and compare expected counts.
Explanation
Correct Answer
A:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Acceptance: Authorized urgent containment occurs while benign evidence does not trigger uncontrolled administrative changes.
B:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Evidence: Replay false-positive and confirmed malicious cases and inspect approval, timeout, cancellation and rollback outputs.
C:Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible. Required intervention: Introduce confidence gates, human approval for disruptive actions, recorded decision provenance and supported rollback in the SOAR workflow.
Incorrect Answers
D:Result: New environments acquire intended telemetry and least-privilege access and repeated runs introduce no unexpected changes. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
E:Change: Validate status and media type before decoding an optional body, and follow documented headers for limits and continuation. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
F:Check: Run the script against a fixture with successes, failures, missing fields and nested JSON values and compare expected counts. Orchestration can magnify an incorrect detector decision unless risky response actions are controlled and reversible.
