Cisco CCNP Cybersecurity CBRCOR (350-201)

Question 1

A SOC analyst is asked to detect previously unseen insider threats in authentication logs where no labeled examples of malicious behavior exist. Leadership wants an AI-powered analytic technique that can surface unusual login patterns without predefined signatures. Which technique should the analyst recommend?

Accepted Answer

Unsupervised anomaly detection that models a behavioral baseline and flags deviations

Answer

Supervised classification trained on a labeled dataset of known-bad logins

Answer

Static signature matching against a threat intelligence indicator feed

Answer

Regular expression parsing of log fields into a normalized schema

Question 2

A SOC lead wants to reduce the time analysts spend deciding which of thousands of daily alerts to investigate first. The team has years of historical incident data indicating which alerts previously led to confirmed incidents, along with contextual features (asset criticality, user role, time of day). Management asks the lead to recommend an AI-powered analytic technique that will automatically rank incoming alerts by their likelihood of being a genuine incident. Which technique best meets this need?

Accepted Answer

A supervised classification/scoring model trained on labeled historical alerts to output a risk-based priority score for each new alert

Answer

An unsupervised clustering model that groups alerts by similarity without reference to prior incident outcomes

Answer

A time-series forecasting model that predicts total alert volume for capacity planning

Answer

A natural language processing summarization model that condenses external threat intelligence reports

Question 3

A SOC analytics team wants to predict the expected volume of authentication requests for each hour of the coming week so capacity and staffing can be planned, and so that unusual spikes can later be flagged against the forecast. Historical hourly authentication counts spanning two years are available. Which AI/ML technique should the team recommend to produce these numeric hourly predictions?

Accepted Answer

Time-series regression (forecasting) trained on the historical hourly counts

Answer

K-means clustering to group similar authentication events

Answer

Binary classification trained on labeled malicious/benign logins

Answer

Association rule mining to find co-occurring login attributes

Question 4

A financial services SOC has a large historical dataset of transactions, each already labeled by fraud analysts as either 'fraudulent' or 'legitimate.' Leadership wants an AI-powered analytic capability that can automatically assign one of these two categories to each new incoming transaction in real time. Which machine learning technique should you recommend to meet this specific need?

Accepted Answer

Supervised classification using the labeled historical transactions as training data

Answer

Unsupervised clustering to group transactions by behavioral similarity

Answer

Reinforcement learning to reward the agent for exploring transaction states

Answer

Dimensionality reduction to compress transaction features before storage

Question 5

A SOC analyst at a large enterprise is overwhelmed by millions of unlabeled security events per day from firewalls, endpoints, and proxies. Leadership wants an AI-powered analytics approach that automatically groups related events into natural categories to surface previously unknown attack patterns and reduce alert volume — without requiring pre-defined labels or known signatures. Which AI-powered technique should the analyst recommend to meet this specific need?

Accepted Answer

Unsupervised clustering (e.g., k-means) to group similar events into behavioral categories

Answer

Supervised classification trained on a labeled dataset of known malware families

Answer

Linear regression to forecast the future daily volume of security events

Answer

A rule-based signature engine that matches events against known IOC lists

Question 6

A SOC lead is overwhelmed by the volume of unstructured threat intelligence reports, vendor advisories, and dark web forum posts arriving daily. She wants an AI-powered analytic technique that can automatically read this free-form text, extract key indicators and threat actor mentions, and produce concise summaries so analysts can triage faster. Which AI/ML technique best meets this specific need?

Accepted Answer

Natural language processing (NLP) with named-entity recognition and text summarization

Answer

Time-series regression forecasting on historical alert counts

Answer

Unsupervised clustering of NetFlow records by byte volume

Answer

Supervised binary classification trained on labeled malware hashes

Question 7

A SOC engineer is integrating a threat intelligence platform with an internal script. The vendor documentation shows that each request must include an 'Authorization' header containing a shared identifier plus a computed hash of the request body, timestamp, and a secret key that is never transmitted over the wire. Which authentication mechanism does this describe?

Accepted Answer

HMAC signature-based authentication

Answer

HTTP Basic authentication

Answer

Static API key authentication

Answer

Bearer token (OAuth) authentication

Question 8

A SOC engineer is writing a Python integration against a threat intelligence vendor's REST API. The vendor documentation states that each request must include the header 'X-API-Key: <value>' and that no username or password is transmitted. The engineer's colleague suggests using Python's requests library with the auth=(user, pass) parameter instead. Which statement correctly describes the authentication mechanism required and why the colleague's approach is inappropriate?

Accepted Answer

The API uses an API key mechanism; the key must be placed in a custom request header, and using auth=(user, pass) would send Basic authentication credentials the API does not expect.

Answer

The API uses HTTP Basic authentication; the colleague is correct, and the X-API-Key header is only optional metadata.

Answer

The API uses OAuth 2.0 bearer tokens; the key should be sent as 'Authorization: Bearer <value>' instead of a custom header.

Answer

The API uses a custom token mechanism requiring a prior login call to exchange the key for a session token before any header is sent.

Question 9

A SOC engineer writes a script that submits a list of 5,000 suspicious file hashes to a threat intelligence REST API in a single POST request. The API repeatedly returns HTTP 413 responses, and the script fails. The API documentation states that each request body may not exceed 100 hashes. What is the MOST appropriate modification to the script to resolve this issue?

Accepted Answer

Split the hash list into batches of 100 or fewer and submit each batch as a separate request

Answer

Add an Authorization header with a valid API key to each request

Answer

Implement an exponential backoff loop that retries the request after a delay

Answer

Change the request method from POST to GET and pass the hashes as query parameters

Question 10

A SOC engineer writes a Python script that queries a threat-intelligence API to enrich indicators. For a batch of 500 IOCs the request consistently fails after about 30 seconds, even though smaller batches succeed. The API documentation states responses are returned synchronously and connections are dropped if a single request exceeds a fixed server-side processing limit. Which API constraint is the engineer most likely encountering, and what is the best remediation?

Accepted Answer

A timeout constraint; break the batch into smaller chunks so each request completes within the server's processing window

Answer

A rate-limit constraint; add an Authorization header with a valid API key to raise the allowed request quota

Answer

A payload-size constraint; compress the request body with gzip to fit under the maximum accepted size

Answer

An authentication constraint; refresh the bearer token because it expires after 30 seconds

Question 11

A SOC analyst is writing a Bash script that calls a threat intelligence REST API. The API key must be available to a Python script launched from the same shell session, but the analyst does not want the key hard-coded in either file or visible in the script's source. Which Bash command correctly makes the key available to the child Python process?

Accepted Answer

export TI_API_KEY="a1b2c3d4"

Answer

TI_API_KEY="a1b2c3d4"

Answer

alias TI_API_KEY="a1b2c3d4"

Answer

echo TI_API_KEY="a1b2c3d4" > /dev/null

Question 12

During an investigation, a SOC analyst needs to identify all files larger than 100 MB inside the /var/log directory tree so they can archive and clear excessive log data that is filling a disk. Which Bash command correctly accomplishes this?

Accepted Answer

find /var/log -type f -size +100M

Answer

grep -r '100M' /var/log

Answer

ls -lR /var/log | sort +100M

Answer

du /var/log -size 100

Question 13

A SOC analyst is triaging a Linux authentication log at /var/log/auth.log during an incident. They need to quickly produce a count of how many distinct source IP addresses generated 'Failed password' entries. Which single Bash command pipeline accomplishes this most directly?

Accepted Answer

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq | wc -l

Answer

cat /var/log/auth.log | grep "Failed password" | wc -l

Answer

find /var/log/auth.log -name "Failed password" | sort -u

Answer

grep -c "Failed password" /var/log/auth.log | uniq

Question 14

During incident response, an analyst must relocate 40 suspicious log files from /var/log/incoming/ into a quarantine directory at /secure/quarantine/ on the same Linux host. The chain-of-custody procedure requires that the files' original modification timestamps and content remain unchanged, and the source directory must be empty afterward. Which single Bash command best accomplishes this?

Accepted Answer

mv /var/log/incoming/* /secure/quarantine/

Answer

cp /var/log/incoming/* /secure/quarantine/

Answer

cat /var/log/incoming/* > /secure/quarantine/all.log

Answer

scp /var/log/incoming/* /secure/quarantine/

Question 15

A security engineer has been tasked with hardening a fleet of newly deployed Ubuntu Linux servers before they enter production. Management wants the configuration baselines to follow an industry-recognized, consensus-developed standard that provides specific, prescriptive configuration settings and is freely available for reference. Which resource should the engineer use to obtain these prescriptive hardening guidelines?

Accepted Answer

CIS Benchmarks for the specific operating system platform

Answer

The vendor's end-user license agreement (EULA)

Answer

The organization's cyber-risk insurance policy documentation

Answer

The CVE database maintained by MITRE

Question 16

A SOC analyst receives an alert that a large volume of files from the company's SaaS-based file-sharing platform was downloaded and then shared externally by a single user account over a two-hour window. The security team suspects data exfiltration. Which action should the analyst take FIRST to investigate this potential cloud data loss event?

Accepted Answer

Review the CASB and SaaS platform audit logs to establish which files were accessed, the source IP, and the sharing scope

Answer

Immediately disable the user account and reimage the user's endpoint to eradicate any malware

Answer

Notify affected customers and regulators that a confirmed data breach has occurred

Answer

Deploy a DLP policy to block all external sharing across the entire organization

Question 17

During a data-loss investigation, an analyst reviews CASB logs and finds that a departing employee shared a folder from the corporate cloud storage tenant to a personal Gmail address, then downloaded 4 GB of files to an unmanaged device over the following two days. The security team wants to characterize the exfiltration modality to scope the investigation correctly. Which modality of data loss best describes this event?

Accepted Answer

Cloud-based data loss through external sharing and unmanaged access

Answer

Endpoint exfiltration via removable media

Answer

Server-side database exfiltration via bulk query

Answer

Application-layer data loss through injection abuse

Question 18

A consortium of five regional hospitals wants to share a common infrastructure to run electronic health record applications. They require that the environment be governed by a shared set of HIPAA-aligned security and compliance policies, and that access be restricted only to the member organizations rather than the general public. Which cloud deployment model best fits these requirements?

Accepted Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Answer

Hybrid cloud

Question 19

A retail company processes credit card transactions through its e-commerce platform and stores cardholder data in a backend database. During an audit, the security team is asked to identify the compliance standard that specifically governs how this data must be protected. Which standard applies to this scenario?

Accepted Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Answer

FedRAMP

Question 20

A vulnerability analyst is scoring a newly disclosed flaw in an internet-facing web application. The vulnerability can be exploited by an unauthenticated remote attacker sending a crafted HTTP request, requires no user interaction, and results in full compromise of confidentiality, integrity, and availability of the application. Which CVSS v3.1 Base metric assignment most accurately reflects that the attack can be launched from anywhere on the internet without local or adjacent access?

Accepted Answer

Attack Vector (AV): Network (N)

Answer

Attack Complexity (AC): High (H)

Answer

Privileges Required (PR): High (H)

Answer

User Interaction (UI): Required (R)

Question 21

A mid-sized retailer's CISO is building the business case for purchasing a cyber risk insurance policy. During a board meeting, a director asks what the policy is fundamentally intended to accomplish for the organization, given that they already invest heavily in preventive controls. Which statement best describes the primary purpose of cyber risk insurance in this context?

Accepted Answer

It offsets the financial impact of a security incident by covering costs such as breach notification, legal fees, and recovery expenses

Answer

It eliminates the organization's residual risk by transferring all liability for breaches to the insurer

Answer

It replaces the need for technical controls by contractually obligating the insurer to prevent future attacks

Answer

It guarantees regulatory compliance with standards such as PCI DSS and GDPR by satisfying their control requirements

Question 22

A retail company has implemented layered defenses, an incident response plan, and regular vulnerability management. During a board meeting, the CISO recommends purchasing a cyber risk insurance policy despite these controls. A board member questions why insurance is necessary when strong security controls already exist. Which statement best explains the primary purpose of cyber risk insurance in this context?

Accepted Answer

It transfers the financial impact of residual risk that remains after security controls are applied, covering costs such as breach response, legal fees, and regulatory fines

Answer

It replaces the need for technical security controls by guaranteeing that all breaches will be prevented by the insurer's monitoring team

Answer

It eliminates the organization's compliance obligations under standards such as PCI DSS and GDPR by shifting accountability to the insurer

Answer

It reduces the likelihood of an attack occurring by actively patching vulnerabilities on the organization's behalf

Question 23

A SOC analyst is executing the organization's volumetric DDoS response playbook after monitoring shows a 40 Gbps UDP flood saturating the internet-facing links, causing the public web application to become unreachable. The on-premises firewall and IPS are already overwhelmed and dropping legitimate traffic along with attack traffic. The playbook step reads: 'Mitigate the attack volume before it reaches the enterprise edge.' Which tool or service should the analyst engage to satisfy this playbook step?

Accepted Answer

A cloud-based (upstream) DDoS scrubbing/mitigation service provided by the ISP or a mitigation provider

Answer

A host-based endpoint detection and response (EDR) agent deployed on the web servers

Answer

A local SIEM correlation rule to alert on the increased traffic volume

Answer

An internal network access control (NAC) solution to quarantine internal endpoints

Question 24

A SOC analyst responds to a suspected intrusion on a Windows desktop that is still powered on and connected to the network. Management wants the investigation to preserve the maximum amount of forensic evidence. According to the order of volatility, which data should the analyst collect FIRST during the endpoint investigation?

Accepted Answer

The contents of RAM, including running processes and active network connections

Answer

A full bit-for-bit forensic image of the system hard drive

Answer

Archived Windows event logs stored on a backup server

Answer

The system registry hive files copied from the disk

Question 25

During a hardening review of a production PostgreSQL database server, a SOC analyst discovers the host is also running an active SMTP relay, an FTP daemon, and the SNMP service with the default 'public' community string. The database application only requires inbound TCP 5432 from the application tier and outbound access to a patch repository. Following the principle of least functionality, which recommendation should the analyst make?

Accepted Answer

Disable and remove the SMTP relay, FTP daemon, and SNMP service, since none are required by the database role and each expands the attack surface

Answer

Leave SNMP running but change the community string, and keep FTP for transferring database backups more efficiently

Answer

Keep all services running and rely on host-based firewall rules to restrict which subnets can reach each service

Answer

Migrate the SMTP and FTP services to non-standard high ports to obscure them from automated scanners

Question 26

A security analyst is hardening a newly provisioned Linux web server that will only serve HTTPS traffic to the public internet. A port scan of the host reveals the following listening services: HTTPS (443), Telnet (23), FTP (21), SSH (22), and an unused SMTP relay (25). The organization requires remote administration to remain possible while eliminating unnecessary attack surface. Which services should the analyst disable to best harden this asset?

Accepted Answer

Disable Telnet (23), FTP (21), and SMTP (25)

Answer

Disable SSH (22), FTP (21), and SMTP (25)

Answer

Disable HTTPS (443), Telnet (23), and SMTP (25)

Answer

Disable Telnet (23), SSH (22), and SMTP (25)

Question 27

A SOC manager reviews the quarterly metrics report and notices that although the mean time to respond (MTTR) has steadily decreased, one attacker maintained access to a compromised server for 47 days before any alert was raised. The manager wants to select the single metric that best quantifies this specific problem and drive improvement toward closing the gap. Which metric most directly measures the length of time an adversary remained undetected inside the environment?

Accepted Answer

Dwell time

Answer

Mean time to contain (MTTC)

Answer

Number of tickets escalated to Tier 2

Answer

Mean time to acknowledge (MTTA)

Question 28

A financial analyst's laptop triggered a DLP alert indicating that a spreadsheet tagged as confidential was copied to an external device. As the SOC analyst assigned to investigate this potential endpoint data loss, which action should you take FIRST to confirm the exfiltration and preserve evidence?

Accepted Answer

Review the endpoint's device connection and file-transfer logs to correlate the removable-media insertion event with the file access and copy activity

Answer

Reimage the laptop immediately to eliminate any malware that may have facilitated the transfer

Answer

Block all USB mass-storage devices across the enterprise via group policy

Answer

Notify the analyst's manager and open an HR disciplinary case

Question 29

A SOC manager is reviewing quarterly incident response metrics. She notices that while MTTD and MTTR are within targets, a significant number of incidents that were declared 'closed' by the tier-1 team reopened within 30 days because the threat was not fully removed. Which incident response metric should she track to specifically measure and improve this problem?

Accepted Answer

Number of reopened/recurring incidents (containment or eradication quality)

Answer

Mean time to detect (MTTD)

Answer

Total alert volume per analyst shift

Answer

Dwell time from initial compromise to detection

Question 30

A security analyst is evaluating the controls of a manufacturing environment. During assessment, the analyst finds that endpoint antivirus is deployed and up to date, firewalls exist at the perimeter, and all servers are patched monthly. However, a recent penetration test showed that once a single workstation was compromised, the tester could reach the SCADA controllers, HR database, and financial systems without crossing any internal filtering point. Which control gap should the analyst prioritize in the improvement recommendation?

Accepted Answer

Lack of internal network segmentation between IT, OT, and sensitive business zones

Answer

Insufficient endpoint antivirus signature update frequency

Answer

Absence of a perimeter next-generation firewall

Answer

Monthly patch cadence being too aggressive for OT systems

Question 31

During a security controls assessment, an analyst finds that an enterprise deploys next-gen firewalls at the perimeter, EDR on all endpoints, and full inbound URL filtering. However, review of firewall logs shows that internal hosts can establish outbound HTTPS sessions directly to any external IP address without inspection. Two recent malware incidents used encrypted outbound channels to reach command-and-control servers undetected. Which control gap should the analyst prioritize recommending to close this weakness?

Accepted Answer

Deploy a forward web proxy with TLS inspection to broker and inspect outbound HTTPS traffic

Answer

Add another inbound URL filtering ruleset to the perimeter firewall

Answer

Increase EDR scan frequency on all endpoints to hourly

Answer

Enable multi-factor authentication on the VPN concentrator

Question 32

During a security control evaluation, an analyst finds that the company's remote-access VPN authenticates users with only a username and password. Credential-stuffing attacks against the VPN portal have already led to two unauthorized logins in the past quarter. Which recommendation most directly closes the diagnosed control gap?

Accepted Answer

Enforce multi-factor authentication (MFA) on all VPN logins

Answer

Increase the VPN session idle-timeout to reduce reconnection attempts

Answer

Rotate the VPN's pre-shared key (PSK) on a monthly schedule

Answer

Deploy a longer TLS certificate chain on the VPN concentrator

Question 33

A security analyst is tasked with evaluating the security posture of a newly deployed application server. The server team insists the host is fully patched, but the analyst wants the most accurate picture of missing patches and risky local configuration settings, including registry values and installed software versions. Which assessment approach should the analyst recommend to obtain this level of detail?

Accepted Answer

Run an authenticated (credentialed) vulnerability scan against the host

Answer

Run an unauthenticated (network-based) vulnerability scan from an external subnet

Answer

Perform a passive traffic capture on the server's switch port and analyze flows

Answer

Query the CMDB to confirm the server's recorded patch and build status

Question 34

A security engineer is tasked with evaluating the security posture of a fleet of newly commissioned Linux web servers. The organization has an approved secure configuration baseline documented in its policy. The engineer wants to determine which servers deviate from the mandated settings (e.g., password policy, disabled services, file permissions, audit logging) without relying solely on generic vulnerability CVE detection. Which assessment approach BEST meets this specific need?

Accepted Answer

Perform a configuration compliance (audit) scan that compares each host against the approved baseline policy

Answer

Run an unauthenticated network vulnerability scan against each server and review the CVSS scores

Answer

Deploy a network IDS in front of the servers and monitor for anomalous inbound traffic patterns

Answer

Conduct a full penetration test attempting to exploit the servers from an external network

Question 35

A security analyst is asked to evaluate the security posture of a newly acquired company's public-facing customer portal server before it is integrated into the corporate network. The analyst has network access to the host but no documentation about its configuration, installed software, or exposure. Which action should the analyst perform FIRST to begin evaluating the asset's security posture?

Accepted Answer

Enumerate the asset's running services, open ports, and installed software versions to establish its attack surface

Answer

Immediately apply the corporate golden image to overwrite the existing configuration

Answer

Deploy the server into the production VLAN so live traffic can be monitored for anomalies

Answer

Purchase a cyber-risk insurance policy to transfer the residual risk of the unknown asset

Question 36

A SOC manager reviews quarterly metrics and finds that analysts are spending most of their shift closing alerts that turn out to be benign. Legitimate threats are being missed because analysts experience fatigue from the sheer volume of non-actionable tickets. Which incident response metric most directly quantifies this problem, and what improvement action does it point toward?

Accepted Answer

False positive rate — tune detection rules and correlation logic to reduce benign alerts

Answer

Mean time to detect (MTTD) — deploy additional sensors to shorten detection windows

Answer

Mean time to respond (MTTR) — add more analysts to speed up containment

Answer

Dwell time — improve threat hunting to find adversaries already inside the network

Question 37

A U.S.-based SaaS company wants to sell its cloud-hosted collaboration platform to multiple federal government agencies. During a compliance planning meeting, the security team is asked which authorization framework the company must satisfy before federal agencies can procure and use the cloud service. Which compliance standard applies to this scenario?

Accepted Answer

FedRAMP, because it standardizes security authorization for cloud services used by U.S. federal agencies

Answer

PCI DSS, because the platform processes user account data

Answer

SOX, because the company must protect financial reporting integrity

Answer

GDPR, because federal employees are data subjects with privacy rights

Question 38

A SOC analyst at a systems integrator is onboarding a new client that operates an information system on behalf of a U.S. federal executive branch agency. The client's contract requires them to categorize the system per FIPS 199, implement NIST SP 800-53 controls, and produce continuous monitoring reports for the agency's authorizing official. Which compliance framework is this client's program built around?

Accepted Answer

FISMA

Answer

PCI DSS

Answer

SOX

Answer

GDPR

Question 39

A SOC analyst at a European e-commerce company confirms that a breach exposed the names, addresses, and payment history of EU residents. The compliance officer asks how quickly the supervisory authority must be notified under the regulation that governs personal data of EU citizens. Which regulation applies, and what is the notification deadline?

Accepted Answer

GDPR, which requires notifying the supervisory authority within 72 hours of becoming aware of the breach

Answer

PCI DSS, which requires notifying the card brands within 24 hours of the breach

Answer

SOX, which requires notifying the SEC within 4 business days of the breach

Answer

HIPAA, which requires notifying affected individuals within 60 days of the breach

Question 40

A security engineer is asked to reduce the effort of securing hundreds of newly provisioned virtual servers that developers spin up daily. Each new server currently requires manual application of the OS baseline, removal of unnecessary packages, and configuration of logging before it can be approved for production. What approach best addresses this need while ensuring consistency across all deployments?

Accepted Answer

Create a hardened golden machine image with the baseline, minimized packages, and logging pre-configured, and deploy all new servers from it

Answer

Deploy servers from the vendor default image and run a vulnerability scan on each host after provisioning to catch misconfigurations

Answer

Require developers to complete a manual hardening checklist and submit it for review before each server is approved

Answer

Place all newly provisioned servers in an isolated VLAN and rely on network segmentation to compensate for host-level weaknesses

Question 41

A cloud engineering team plans to deploy a fleet of identical Linux web servers using an auto-scaling group that launches new instances from a single base machine image whenever load increases. The security team is asked to make a recommendation that ensures every newly launched instance already meets the organization's security standard the moment it comes online, without manual intervention after boot. Which recommendation best meets this need?

Accepted Answer

Harden the base machine image against a recognized benchmark, then use that pre-hardened image as the source for all auto-scaled instances

Answer

Allow instances to launch from the default vendor image and run a manual hardening checklist on each server after it registers with the load balancer

Answer

Deploy a network intrusion prevention appliance in front of the auto-scaling group so unhardened instances are protected at the perimeter

Answer

Schedule a weekly vulnerability scan of the running fleet and remediate findings on whichever instances happen to be active at scan time

Question 42

A SOC engineer writes a Python client that queries a threat-intelligence REST API for indicators matching a submitted hash. When the engineer submits a hash that the platform does not track, the API returns an HTTP status of 200 with a body of '[]' (an empty JSON array). The engineer's script currently treats any 200 response as 'indicator found and enriched' and creates a case. What is the correct interpretation of this response, and what should the script do?

Accepted Answer

The 200 status confirms the request succeeded, but the empty array body means no indicators matched; the script must inspect the body and skip case creation when the array is empty

Answer

The 200 status indicates the resource was created; the script is correct to create a case for every 200 response

Answer

A 200 with an empty body is actually an error condition and should be handled identically to a 404, so the script should retry the request

Answer

The empty array means the server timed out mid-query; the script should resend the request with a longer timeout value

Question 43

A SOC engineer writes a Python script to pull alerts from a threat intelligence REST API. Instead of the expected JSON alert data, the script receives an HTTP 302 status code with a 'Location' header pointing to a login portal, and the body contains HTML. What is the MOST likely cause and correct interpretation of this response?

Accepted Answer

The API session or token is invalid/expired, so the server is redirecting the unauthenticated request to a login page instead of returning data

Answer

The API is rate limiting the request and expects the client to wait before retrying

Answer

The server encountered an internal error while processing the query and could not build the JSON response

Answer

The requested alert resource was successfully created and the client should follow up with a GET request

Question 44

A SOC engineer writes a Python script that pulls indicators from a threat intelligence REST API using an API key passed in the request header. The script worked yesterday, but today every request returns HTTP 401 with a body message of {"error":"invalid or expired credentials"}. The endpoint URL and payload are unchanged. What is the MOST likely cause the engineer should investigate first?

Accepted Answer

The API key used for authentication is no longer valid and must be regenerated or renewed

Answer

The account is authenticated but lacks permission to access the requested indicator resource

Answer

The script is exceeding the API's request rate limit and should honor the Retry-After header

Answer

The requested indicator resource does not exist at the specified endpoint path

Question 45

A SOC engineer writes a script that submits indicators to an internal threat-intelligence REST API. The same request that worked yesterday now returns an HTTP 500 status code, while requests to other endpoints on the same server succeed and the engineer's token is still valid. What does the 500 response indicate the engineer should do?

Accepted Answer

Escalate to the API's server/application team, because a 500 indicates an unexpected server-side error that the client cannot fix by changing its request

Answer

Regenerate the authentication token, because a 500 means the credentials presented were rejected

Answer

Reduce the request rate and honor the Retry-After header, because a 500 signals the client exceeded the rate limit

Answer

Fix the malformed JSON in the request body, because a 500 means the payload failed client-side validation

Question 46

A SOC engineer writes a Python script that submits a suspicious file hash to a threat intelligence platform's REST API using a POST request to create a new watchlist entry. The API returns a status code of 201 along with a Location header. What does this response indicate the engineer should do next?

Accepted Answer

Recognize the watchlist entry was successfully created and use the Location header to reference the new resource

Answer

Treat the request as failed and retry, because 201 indicates the payload was malformed

Answer

Wait and resend the request after the interval in the Retry-After header, because 201 signals rate limiting

Answer

Re-authenticate with a fresh API token, because 201 means the credentials were rejected

Question 47

A SOC analyst writes a script that queries a threat intelligence platform's REST API using the endpoint /api/v2/indicators/{id}. For most indicator IDs the script works correctly, but for one specific ID the server consistently returns an HTTP 404 response with a JSON body of {"error": "resource not found"}. The analyst has confirmed the API token is valid and other endpoints respond normally. What is the MOST likely cause of the 404 response?

Accepted Answer

The requested indicator ID does not exist on the server

Answer

The API token has insufficient privileges to read that indicator

Answer

The client exceeded the API rate limit for that endpoint

Answer

The server encountered an internal error while processing the request

Question 48

A retail company runs its core inventory database in an on-premises data center for latency and control reasons, but during seasonal sales it dynamically extends the front-end web application into a public cloud provider to absorb traffic spikes. Sensitive processing stays internal while burst capacity is offloaded externally. Which cloud deployment model does this architecture best describe?

Accepted Answer

Hybrid cloud

Answer

Community cloud

Answer

Public cloud

Answer

Private cloud

Question 49

A security operations team is migrating a web application to a cloud provider. Under the Platform as a Service (PaaS) model they selected, the team wants to clarify which security responsibilities remain with them versus the cloud provider. Which task remains the responsibility of the customer's security operations team in a PaaS environment?

Accepted Answer

Securing the application code and managing user access to the application

Answer

Patching the underlying operating system and runtime frameworks

Answer

Maintaining the physical security of the data center hosting the platform

Answer

Patching and configuring the virtualization hypervisor layer

Question 50

A SOC analyst receives an automated SIEM alert indicating multiple failed logins followed by a successful login on a domain controller. Before escalating or taking any containment action, the analyst reviews correlated logs, verifies the source IP reputation, and confirms whether the activity represents genuine malicious behavior. According to the incident response workflow, which phase is the analyst currently performing?

Accepted Answer

Identification (detection and analysis)

Answer

Containment

Answer

Eradication

Answer

Preparation

Question 51

A SOC analyst is writing a parser for threat feed data. When inspecting one feed's payload, they observe records structured with angle-bracket element tags, nested child elements, and metadata expressed as name="value" pairs inside the opening tags. Which data format is this feed using?

Accepted Answer

XML, because it uses tag pairs with attributes inside opening tags

Answer

JSON, because it supports nested key-value objects

Answer

CSV, because it stores structured records in fields

Answer

YAML, because it uses indentation for nested structure

Question 52

During an active malware outbreak, a SOC analyst confirms that three endpoints in the finance department are communicating with a known command-and-control server. The incident response team wants to stop the spread and preserve the infected systems for later forensic analysis without alerting the attacker prematurely. According to the incident response workflow, which action best represents the current phase the team should execute?

Accepted Answer

Isolate the affected endpoints on a quarantine VLAN to halt lateral movement while retaining system state

Answer

Reimage the affected endpoints and restore them from clean backups to return to normal operations

Answer

Conduct a lessons-learned meeting to document how the malware bypassed existing controls

Answer

Deploy updated antivirus signatures across the entire enterprise to remove the malware from all hosts

Question 53

A SOC team has confirmed a malware infection on several endpoints. They have already isolated the affected hosts from the network and preserved forensic images. The team now needs to remove the malicious files, delete attacker-created accounts, and close the vulnerabilities the attacker exploited before restoring systems to production. According to the NIST incident response workflow, which phase are they entering?

Accepted Answer

Eradication

Answer

Containment

Answer

Recovery

Answer

Detection and Analysis

Question 54

A newly hired SOC manager reviews the organization's incident response program and discovers that analysts frequently waste time during active incidents locating contact information for legal counsel, deciding which forensic tools to use, and clarifying who has authority to disconnect production systems. The manager wants to address the root cause by strengthening a specific phase of the incident response workflow. Which phase should the manager focus on to resolve these recurring issues?

Accepted Answer

Preparation

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 55

A SOC team has removed malware and closed the exploited vulnerability on several compromised web servers. Management now wants the servers returned to production. Before restoring them, the incident response lead insists on monitoring the systems in a controlled manner and confirming they behave normally. Which incident response phase does this activity represent, and what is its primary goal?

Accepted Answer

Recovery — safely restore affected systems to normal operations while validating they are no longer compromised

Answer

Eradication — remove all traces of the threat from the environment before any restoration

Answer

Containment — limit the spread of the incident by isolating affected hosts

Answer

Lessons learned — document the incident and improve future response processes

Question 56

A SOC analyst writes a Python script to consume a threat intelligence REST API. The script sends a GET request and receives a response with status code 200. When the script tries to call response.json() to parse the body, it raises a JSONDecodeError even though the request succeeded. Inspecting the raw response, the analyst sees the following header: Content-Type: application/xml. Which conclusion best explains the failure?

Accepted Answer

The server returned the payload in XML format, so the analyst must parse it with an XML parser rather than calling response.json().

Answer

The 200 status code is incorrect and the server actually returned an authentication error that corrupted the body.

Answer

The Content-Length header is missing, so the body was truncated and cannot be parsed as JSON.

Answer

The API rate limit was exceeded, and the Retry-After header caused the JSON body to be malformed.

Question 57

During an investigation, a SOC analyst reviews EDR telemetry from a compromised workstation. The analyst notes two distinct findings: (1) a specific SHA-256 hash matching a file quarantined on the host, and (2) a PowerShell process spawning from a Word document and immediately establishing an encoded outbound connection while attempting to disable logging. The analyst must classify these findings correctly to inform detection strategy. How should the analyst categorize the two findings?

Accepted Answer

Finding 1 is an Indicator of Compromise (IOC); Finding 2 is an Indicator of Attack (IOA)

Answer

Finding 1 is an Indicator of Attack (IOA); Finding 2 is an Indicator of Compromise (IOC)

Answer

Both findings are Indicators of Compromise (IOCs) because they were both observed on the endpoint

Answer

Both findings are Indicators of Attack (IOAs) because they both indicate malicious intent

Question 58

A SOC analyst receives an alert that a networked smart thermostat (an embedded Linux IoT device) in a corporate facility is beaconing to an unfamiliar external IP over an encrypted channel. The device has no traditional EDR agent, limited storage, and a read-only firmware partition. The analyst must begin investigating the potential endpoint intrusion. Given the platform constraints, what is the MOST appropriate first investigative step?

Accepted Answer

Capture and analyze network traffic to and from the device from a mirrored switch port or upstream tap

Answer

Install a lightweight EDR agent on the thermostat to collect process and file telemetry

Answer

Perform a full forensic disk image of the device's read-only firmware partition

Answer

Immediately reflash the firmware to a known-good image to remove any implant

Question 59

A multinational manufacturing company that also runs an e-commerce site is preparing for a formal certification that demonstrates it has a systematic, auditable Information Security Management System (ISMS) covering risk assessment, controls, and continual improvement across all business units. The board wants a globally recognized standard that is not tied to any single industry vertical. Which standard best fits this requirement?

Accepted Answer

ISO/IEC 27001

Answer

PCI DSS

Answer

HIPAA

Answer

SOX

Question 60

A SOC analyst receives the following API response body while integrating a threat intelligence feed into a SOAR playbook:

{
  "indicators": [
    { "value": "198.51.100.5", "type": "ipv4", "confidence": 85 },
    { "value": "evil.example.com", "type": "domain", "confidence": 60 }
  ],
  "count": 2
}

Based on the structure of this data, which statement most accurately describes the format so the analyst can select the correct parsing approach in the playbook?

Accepted Answer

It is JSON, using key-value pairs with an array of nested objects that can be accessed by keys such as indicators[0].value

Answer

It is XML, using opening and closing tags to define a hierarchy of elements

Answer

It is CSV, using delimiters to separate rows and columns of flat tabular data

Answer

It is HTML, using markup tags intended to render structured content in a browser

Question 61

A SOC analyst is dispatched to investigate a corporate laptop suspected of running fileless malware. The user reports the machine is still powered on and connected to the network, and threat intel indicates the malware injects into legitimate processes and leaves minimal disk artifacts. To preserve the most relevant evidence for this type of intrusion, what should the analyst prioritize first?

Accepted Answer

Perform a live acquisition of volatile memory (RAM) before any other action

Answer

Immediately power off the laptop and create a forensic disk image

Answer

Run a full antivirus scan to quarantine the malicious files on disk

Answer

Reimage the laptop from a known-good baseline to restore operations quickly

Question 62

During dynamic analysis of a suspicious executable, an analyst notices that the sample runs briefly, performs no observable network or file activity, and then exits cleanly in the sandbox. However, endpoint telemetry from an infected production host shows extensive persistence and C2 traffic from the same binary. Which conclusion best explains this discrepancy, and what is the appropriate next step?

Accepted Answer

The malware employs anti-analysis/VM-evasion techniques and detected the sandbox; the analyst should modify the environment to defeat evasion checks or use bare-metal analysis before drawing conclusions.

Answer

The sandbox produced a false negative due to insufficient run time; simply re-run the sample with a longer detonation timeout to capture the behavior.

Answer

The production infection is unrelated to this binary; the analyst should discard the sample as benign since the sandbox showed no malicious activity.

Answer

The static analysis phase was skipped; the analyst should submit the file hash to a threat intelligence feed instead of performing any further behavioral analysis.

Question 63

During malware analysis, an analyst detonates a suspicious executable in a sandbox. The behavioral report shows the sample creates a scheduled task, writes to the Run registry key, injects code into explorer.exe, and beacons to an external domain every 60 seconds. Before writing the final report, the analyst wants to classify the sample's primary threat behavior to prioritize the response. Which observed behavior most directly indicates the sample's persistence mechanism?

Accepted Answer

Writing to the Run registry key and creating a scheduled task

Answer

Beaconing to an external domain every 60 seconds

Answer

Injecting code into explorer.exe

Answer

The executable being flagged as suspicious on initial upload

Question 64

A malware analyst has already completed static triage (hashing, string extraction) and dynamic execution in a sandbox for a suspicious binary. The behavioral report shows the sample connects to a C2 server, but the exact command structure and encryption routine used for exfiltration remain unclear because the traffic is encoded. The analyst needs to fully understand the algorithm the malware uses to encode its C2 payloads. Which analysis technique should be performed next to obtain this level of detail?

Accepted Answer

Perform code analysis by disassembling/decompiling the binary to reverse engineer the encoding routine

Answer

Re-run the sample in the sandbox with extended runtime to capture more network traffic

Answer

Extract additional ASCII and Unicode strings from the binary using a static string tool

Answer

Submit the file hash to threat intelligence feeds to identify the malware family

Exam domain	Exam weight	Practice
Fundamentals	20%	Practice this topic
Techniques	30%	Practice this topic
Processes	30%	Practice this topic
Automation	20%	Practice this topic

Cisco CCNP Cybersecurity CBRCOR (350-201) (350-201) practice exam & study guide

Start studying 350-201

All 350-201 study resources

350-201 exam domains

Sample 350-201 questions

Key 350-201 terms

350-201 frequently asked questions

Fundamentals (20%)

Techniques (30%)

Processes (30%)

Automation (20%)