Cisco 350-201: Performing Cybersecurity Using Cisco Security Technologies (CBRCOR)

Last checked October 22, 2026 against the official Cisco exam page.

1. Question 1Network Intrusion Analysis

   An IPS alert shows a signature match for an exploit against a web server. The analyst must decide whether the attack succeeded. Which evidence is most useful?

   1. AThe time of day alone, without the source host, destination, or session timing details
   2. BThe IPS signature name alone, as shown in the alert summary table rows
   3. CServer logs and subsequent outbound connections from the server after the alert
   4. DThe alert's severity colour in the console, which reflects the sensor's priority rating
   Show answer and explanationHide answer

   Correct answer: C

   Server logs and subsequent outbound connections show whether the exploit led to compromise. Colour, signature names and time alone do not confirm success.

2. Question 2Security Monitoring

   A SOC analyst wants to correlate events from firewalls, endpoints, and identity systems in one place. Which technology is designed for this?

   1. AA web browser's bookmarks folder with saved pages and personal shortcuts
   2. BA printer log archive storing print job histories and device status
   3. CA SIEM platform with log normalization and correlation rules
   4. DA standalone spreadsheet of manually entered events
   Show answer and explanationHide answer

   Correct answer: C

   A SIEM normalizes and correlates events across sources. Spreadsheets, printer logs and bookmarks do not correlate security events.

3. Question 3Security Concepts

   An analyst must explain the difference between a vulnerability and an exploit. Which statement is accurate?

   1. AAn exploit is the weakness in a system, while a vulnerability is the attack tool used against it
   2. BA vulnerability is a weakness in a system, while an exploit is code or a technique that takes advantage of it
   3. CThey are identical and interchangeable labels, so analysts can use either term in place of the other
   4. DA vulnerability is a type of malware that spreads across networks and encrypts stored files
   Show answer and explanationHide answer

   Correct answer: B

   A vulnerability is a weakness, and an exploit is the means used to take advantage of it. The other definitions reverse or conflate the terms.

4. Question 4Host-Based Analysis

   An analyst finds a process running from a temporary folder with a random name, started by an office application. What is the most suspicious aspect?

   1. AThe process is clearly listed in the task manager under a plausible system name
   2. BA document-handling application spawning an unusual process from a temporary location
   3. CThe process uses a small amount of memory and a modest share of CPU time
   4. DThe file has a recent modification date and a timestamp that falls within normal business hours
   Show answer and explanationHide answer

   Correct answer: B

   An office application spawning an unusual process from a temporary location is a common malware pattern. Small memory use, appearing in task manager and recent dates are not strong indicators alone.

5. Question 5Security Policies and Procedures

   A company's security policy requires that all remote access uses multi-factor authentication. An audit finds that a vendor's account is exempt. What is the most appropriate response?

   1. AKeep the exemption because the vendor is a trusted long-term partner with a good record
   2. BRemove the vendor's access without prior notice by disabling the account and revoking active sessions now
   3. CDocument the exception, require MFA or a compensating control, and set a review date with approval
   4. DDelete the policy so that the vendor exemption no longer appears in audit findings
   Show answer and explanationHide answer

   Correct answer: C

   Documenting the exception with compensating controls, approval and a review date follows policy governance. Keeping an undocumented exemption, deleting policy and abrupt removal without notice are inappropriate.