CertArea
All Cisco exams

Free 350-201 practice test: 30 questions with answers

30 original questions for Performing Cybersecurity Using Cisco Security Technologies (CBRCOR), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

350-201 exam guide: topics, cost and format

All 30 350-201 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Network Intrusion Analysis (6 questions)

  1. Question 1

    An IPS alert shows a signature match for an exploit against a web server. The analyst must decide whether the attack succeeded. Which evidence is most useful?

    1. AThe time of day alone, without the source host, destination, or session timing details
    2. BThe IPS signature name alone, as shown in the alert summary table rows
    3. CServer logs and subsequent outbound connections from the server after the alert
    4. DThe alert's severity colour in the console, which reflects the sensor's priority rating
    Show answer and explanation
    Correct answer: C

    Server logs and subsequent outbound connections show whether the exploit led to compromise. Colour, signature names and time alone do not confirm success.

  2. Question 2

    An IDS detects a series of TCP connections from one host to many ports on a server in a short time. Which activity does this most likely represent?

    1. AA time synchronization request to NTP
    2. BPort scanning or reconnaissance
    3. CA normal browsing session
    4. DA scheduled overnight backup to disk
    Show answer and explanation
    Correct answer: B

    Many connections to many ports in a short time is characteristic of port scanning. Browsing, backups and time sync do not produce that pattern.

  3. Question 3

    A packet capture shows a TCP stream where the server responds with a reset immediately after the client sends a request. What does this suggest?

    1. AThe connection completed a normal session with a graceful FIN and ACK exchange
    2. BThe client is set to a different time zone than the server
    3. CThe server sent a large file in chunks using TCP window scaling
    4. DThe connection was rejected or actively terminated by a device or the host
    Show answer and explanation
    Correct answer: D

    A reset indicates the connection was refused or terminated. A completed session would show normal closure, a large file is not signalled this way, and time zones are unrelated.

  4. Question 4

    An analyst needs to examine a suspicious DNS query pattern showing long random subdomain labels. What does this pattern most often indicate?

    1. ADNS tunnelling or data exfiltration over DNS
    2. BA printer mDNS service discovery
    3. CA normal CDN request for a cached static asset
    4. DA scheduled time synchronization event
    Show answer and explanation
    Correct answer: A

    Long random subdomains are a common sign of DNS tunnelling or exfiltration. CDN requests use recognizable names, time sync uses NTP, and printer discovery uses different protocols.

  5. Question 5

    An IPS blocks a packet based on a signature, and the team suspects a false positive. What is the correct first step?

    1. ARemove the signature database from the sensor and reload the engine to clear the blocked rule from memory
    2. BDisable the IPS engine on the affected sensor until a vendor patch is released on the appliance
    3. CIgnore the block because the IPS is generally right about its signatures and the packet is treated as hostile
    4. DReview the packet details and the signature, and tune or exempt the rule only after validation
    Show answer and explanation
    Correct answer: D

    Reviewing the packet and signature, then tuning after validation maintains protection. Disabling the IPS, ignoring and deleting signatures weaken defence.

  6. Question 6

    An analyst observes that a host repeatedly connects to an external IP address every five minutes, with a consistent small payload. Which behaviour is this?

    1. AA bulk file transfer to an external storage server
    2. BNormal user browsing with irregular gaps between tabs
    3. CA DHCP lease renewal request to the local server
    4. DBeaconing consistent with command-and-control
    Show answer and explanation
    Correct answer: D

    Regular intervals with small consistent payloads indicate beaconing. Browsing is irregular, file transfers are bursty, and DHCP renewals follow lease timing.

Security Monitoring (6 questions)

  1. Question 7

    A SOC analyst wants to correlate events from firewalls, endpoints, and identity systems in one place. Which technology is designed for this?

    1. AA web browser's bookmarks folder with saved pages and personal shortcuts
    2. BA printer log archive storing print job histories and device status
    3. CA SIEM platform with log normalization and correlation rules
    4. DA standalone spreadsheet of manually entered events
    Show answer and explanation
    Correct answer: C

    A SIEM normalizes and correlates events across sources. Spreadsheets, printer logs and bookmarks do not correlate security events.

  2. Question 8

    A SIEM generates an alert for a login from an unusual location. The analyst needs to decide whether it is a true positive. Which evidence is most useful?

    1. AAuthentication details, device posture, and subsequent activity from that session
    2. BThe alert's font colour, background shade, icon style within the SIEM dashboard theme settings
    3. CThe number of other unrelated alerts raised overall on that same calendar day
    4. DThe time the SIEM server was installed, its original deployment date, and the license renewal period
    Show answer and explanation
    Correct answer: A

    Authentication details, device posture and subsequent activity show whether the login is malicious. Colour, unrelated counts and install dates are not evidence.

  3. Question 9

    Cisco Secure Network Analytics (Stealthwatch) analyses flow data to detect anomalies. Which data type does it primarily use?

    1. APhysical door badge access logs
    2. BNetFlow or IPFIX flow records
    3. CFull-content packet payload captures
    4. DEnterprise printer job logs
    Show answer and explanation
    Correct answer: B

    Secure Network Analytics relies on flow records such as NetFlow and IPFIX. Payload-only, printer and badge logs are not its primary input.

  4. Question 10

    An analyst wants to see the full history of an endpoint's processes and network connections during a suspected intrusion. Which Cisco technology provides endpoint telemetry for this?

    1. ACisco Secure Endpoint (formerly AMP for Endpoints)
    2. BCisco Webex Meetings for video conferencing and file sharing
    3. CCisco Meraki wireless dashboard for access point configuration
    4. DCisco Catalyst switch CLI for VLAN and port configuration
    Show answer and explanation
    Correct answer: A

    Secure Endpoint provides endpoint telemetry and process history for investigation. Wireless dashboards, meeting tools and switch CLIs do not provide endpoint process telemetry.

  5. Question 11

    A detection rule raises many false positives. The team wants to reduce noise without losing real detections. Which approach is most appropriate?

    1. ATune the rule using known benign patterns and validate against historical data
    2. BForward every alert from the rule to the executive leadership team
    3. CDisable the rule entirely until the next engineering review
    4. DIgnore every alert from the rule and close each without investigation
    Show answer and explanation
    Correct answer: A

    Tuning with benign patterns and validation keeps detection while reducing noise. Disabling or ignoring the rule loses coverage, and forwarding to executives does not reduce false positives.

  6. Question 12

    A security analyst must determine which hosts communicated with a known command-and-control domain during the last week. Which data source is most useful?

    1. ADNS logs and proxy logs filtered by the domain
    2. BThe office Wi-Fi password for the guest network SSID
    3. CThe company's regional holiday calendar
    4. DThe printer's current toner level and paper tray status
    Show answer and explanation
    Correct answer: A

    DNS and proxy logs show resolution and web requests to the domain, identifying affected hosts. Toner, passwords and calendars do not record communications.

Security Concepts (6 questions)

  1. Question 13

    An analyst must explain the difference between a vulnerability and an exploit. Which statement is accurate?

    1. AAn exploit is the weakness in a system, while a vulnerability is the attack tool used against it
    2. BA vulnerability is a weakness in a system, while an exploit is code or a technique that takes advantage of it
    3. CThey are identical and interchangeable labels, so analysts can use either term in place of the other
    4. DA vulnerability is a type of malware that spreads across networks and encrypts stored files
    Show answer and explanation
    Correct answer: B

    A vulnerability is a weakness, and an exploit is the means used to take advantage of it. The other definitions reverse or conflate the terms.

  2. Question 14

    In the CIA triad, which property is violated when unauthorized users read confidential customer records?

    1. AConfidentiality
    2. BAvailability
    3. CAccountability
    4. DData integrity
    Show answer and explanation
    Correct answer: A

    Confidentiality is violated when unauthorized parties view protected information. Integrity concerns unauthorized modification, availability concerns access, and accountability concerns attribution.

  3. Question 15

    A security team uses a risk formula to prioritize findings. Which combination is used to estimate risk?

    1. AAge of the device plus its colour
    2. BNumber of users multiplied by the server count
    3. CLikelihood multiplied by impact
    4. DBandwidth divided by latency
    Show answer and explanation
    Correct answer: C

    Risk is commonly estimated as likelihood times impact. The other combinations are not standard risk measures.

  4. Question 16

    A company must protect data at rest on laptops. Which control best addresses this threat?

    1. AA firewall on the laptop's router
    2. BFull-disk encryption with managed keys
    3. CA banner on the login screen
    4. DAntivirus scanning of network traffic only
    Show answer and explanation
    Correct answer: B

    Full-disk encryption protects stored data if a device is lost. Firewalls on routers, network-only scanning and banners do not protect data at rest.

  5. Question 17

    A hash function is used to verify that a downloaded file has not been altered. Which property of the hash makes it useful for this?

    1. AThe hash embeds the file's author name in its digest
    2. BThe hash is identical for every file of the same byte length
    3. CThe hash encrypts the file with a secret key so it cannot be read
    4. DAny change to the file produces a different hash value
    Show answer and explanation
    Correct answer: D

    Cryptographic hashes change significantly with any change to the input, which makes tampering detectable. Hashes do not encrypt, depend on size, or reveal authors.

  6. Question 18

    An attacker sends a flood of requests that exhaust a web server's capacity, making the service unavailable. Which attack category is this?

    1. AData exfiltration
    2. BPrivilege escalation
    3. CDenial of service
    4. DCredential stuffing
    Show answer and explanation
    Correct answer: C

    A flood that exhausts capacity is a denial-of-service attack. Privilege escalation gains higher access, exfiltration steals data, and credential stuffing uses stolen credentials.

Host-Based Analysis (6 questions)

  1. Question 19

    An analyst finds a process running from a temporary folder with a random name, started by an office application. What is the most suspicious aspect?

    1. AThe process is clearly listed in the task manager under a plausible system name
    2. BA document-handling application spawning an unusual process from a temporary location
    3. CThe process uses a small amount of memory and a modest share of CPU time
    4. DThe file has a recent modification date and a timestamp that falls within normal business hours
    Show answer and explanation
    Correct answer: B

    An office application spawning an unusual process from a temporary location is a common malware pattern. Small memory use, appearing in task manager and recent dates are not strong indicators alone.

  2. Question 20

    Which TWO are useful host-based indicators of compromise? (Choose two.)

    1. AThe computer name being shorter than usual
    2. BUnexpected scheduled tasks or services created by an unknown account
    3. CNew autorun entries pointing to unusual executables
    4. DA user changing the screen resolution
    5. EThe desktop wallpaper changing once after a restart
    Show answer and explanation
    Correct answer: B, C

    Unexpected scheduled tasks and new autorun entries are persistence indicators. Wallpapers, resolution and name length are not indicators of compromise.

  3. Question 21

    An analyst must verify that a Windows binary is the legitimate, signed version from the vendor. Which check is most reliable?

    1. AVerify the digital signature and publisher of the binary
    2. BRead the file name aloud and match it to a catalogue
    3. CCheck the file's size against the mirror download
    4. DCheck the file's creation and modified timestamps
    Show answer and explanation
    Correct answer: A

    Digital signature verification confirms the publisher and integrity. File size, creation date and file names do not establish authenticity.

  4. Question 22

    Which TWO artifacts can show that a program was executed on a Windows host? (Choose two.)

    1. AThe program's file size alone
    2. BThe program's icon on the desktop only
    3. CThe program's author name in the file metadata only
    4. DPrefetch or execution artefacts for the program
    5. EProcess creation events in the security or endpoint logs
    Show answer and explanation
    Correct answer: D, E

    Prefetch and process creation events record execution. An icon, file size and author metadata do not prove the program ran.

  5. Question 23

    An endpoint is suspected of running cryptomining malware that consumes high CPU. Which evidence most strongly supports this?

    1. AA high screen brightness setting that drains the battery faster during extended use on a laptop
    2. BA network printer in the finance office that is out of paper and offline
    3. CA process with high CPU connected to a known mining pool or with a mining-related binary
    4. DA user's desktop wallpaper change made through the personalisation settings during the afternoon
    Show answer and explanation
    Correct answer: C

    A high-CPU process connected to mining infrastructure is strong evidence. Wallpaper, brightness and printer status are unrelated.

  6. Question 24

    A Windows analyst needs to see which DLLs were loaded by a suspicious process. Which tool or method provides this detail?

    1. AThe Windows Calculator app, which displays arithmetic results and keeps a short history panel
    2. BA process inspection tool such as Process Explorer or endpoint process telemetry
    3. CThe Notepad application, which edits and saves plain text files
    4. DThe Windows calendar, which schedules appointments and sends alerts
    Show answer and explanation
    Correct answer: B

    Process inspection tools and telemetry list loaded modules. Notepad, Calculator and the calendar do not show loaded modules.

Security Policies and Procedures (6 questions)

  1. Question 25

    A company's security policy requires that all remote access uses multi-factor authentication. An audit finds that a vendor's account is exempt. What is the most appropriate response?

    1. AKeep the exemption because the vendor is a trusted long-term partner with a good record
    2. BRemove the vendor's access without prior notice by disabling the account and revoking active sessions now
    3. CDocument the exception, require MFA or a compensating control, and set a review date with approval
    4. DDelete the policy so that the vendor exemption no longer appears in audit findings
    Show answer and explanation
    Correct answer: C

    Documenting the exception with compensating controls, approval and a review date follows policy governance. Keeping an undocumented exemption, deleting policy and abrupt removal without notice are inappropriate.

  2. Question 26

    A security policy defines acceptable use of company email. Which element makes it enforceable?

    1. AA policy with no enforcement consequences, no defined terms, and no stated scope
    2. BA policy written only for the IT operations team, with no input from legal or HR
    3. CA policy that is never reviewed after its initial publication, even when regulations or business processes change
    4. DClear statements of required behaviour, approval by management, and communication to employees
    Show answer and explanation
    Correct answer: D

    Clear requirements, management approval and communication make policies enforceable. IT-only, unreviewed and undefined policies lack enforceability.

  3. Question 27

    A company wants to standardize how security incidents are classified. Which document provides this consistency?

    1. AAn incident classification standard with severity definitions and examples
    2. BA list of favourite tools and utilities that analysts prefer to use
    3. CA marketing brochure describing product features and pricing tiers
    4. DThe printer's manual for the network device, covering paper trays and toner levels
    Show answer and explanation
    Correct answer: A

    An incident classification standard with definitions and examples provides consistency. Tool lists, brochures and manuals do not standardize classification.

  4. Question 28

    A security team must comply with a regulation that requires encryption of personal data at rest. Which action demonstrates compliance?

    1. AEncrypt only the nightly backup archives and not the production databases or file servers
    2. BState verbally in the quarterly audit meeting that personal data is encrypted and secure today
    3. CMaintain evidence of encryption settings and periodic verification of the controls
    4. DAssume encryption exists across the hosted platform because the vendor's sales team said so
    Show answer and explanation
    Correct answer: C

    Evidence and periodic verification show compliance. Verbal statements and vendor assumptions are not evidence, and encrypting only backups leaves production data exposed.

  5. Question 29

    A compliance manager wants to demonstrate that vendors meet security requirements. Which document is typically reviewed?

    1. AThe vendor's sales deck and product brochure summarizing platform features, pricing tiers, and roadmap
    2. BA verbal promise from the account manager that the platform meets the requirements during renewal
    3. CA vendor's independent assurance report, such as a SOC report, reviewed against requirements
    4. DThe vendor's company logo displayed prominently on the website footer, marketing banners, and conference badges
    Show answer and explanation
    Correct answer: C

    Independent assurance reports reviewed against requirements provide objective evidence. Sales decks, verbal promises and logos do not.

  6. Question 30

    A company needs a rule for how long security logs are retained to satisfy investigations and compliance. Which policy element defines this?

    1. ALog retention requirements by log type with defined periods
    2. BAn unlimited retention rule applied to every log type with no review
    3. CStoring logs only on the originating server that generated them locally
    4. DDeleting logs after one day regardless of type or source system
    Show answer and explanation
    Correct answer: A

    Retention requirements by log type with periods define the rule. Unlimited retention without review, one-day deletion and local-only storage do not meet investigation and compliance needs.