Cisco 350-201 CBRCOR Exam Practice Questions
US$39
Every question with the correct answer and why the other options are wrong.
Card, Apple Pay, Google Pay or PayPal. Your PDF is prepared and emailed to you after checkout, usually within a few hours.
These practice files worked really well for me, they were actually not bad at all. The explanations were short and easy to understand. I liked the layout; it was simple but effective. They helped me clear my exam calmly and confidently.
Three of the 228 questions in this pack
Question 1
A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled. Which activity triggered the behavior analytics tool?
Show answer and explanation
Correct answer: D. downloading more than 10 files
Behavior analytics tools are designed to detect anomalous activities that deviate from normal user patterns. Downloading more than 10 files represents a quantifiable threshold that typically triggers alerts in such systems, as it indicates data exfiltration activity. While accessing multiple servers is suspicious, the downloading of a significant volume of files is the specific metric-based behavior that automated tools use to detect compromise. The other activities (accessing AD, accessing financial server, accessing multiple servers) represent contextual information but lack the specific threshold-based trigger that behavior analytics tools use.
Why the other options are wrong
- A. Accessing the Active Directory server alone would not necessarily trigger behavior analytics without additional suspicious activity.
- B. The session disconnection and account disabling were reactive responses, not the trigger itself.
- C. Accessing multiple servers is suspicious but lacks the specific quantifiable threshold that automated behavior analytics tools use for detection.
Question 2
The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?
Show answer and explanation
Correct answer: D. Identify movement of the attacker in the enterprise
In the initial analysis phase of a physical security incident, the security specialist must first understand what occurred and trace the unauthorized person's movement through the facility. Identifying the attacker's movement and access path is the critical first step before taking any remedial action. This establishes the scope of the incident and determines which areas may have been compromised. Only after understanding movement patterns can the organization determine which assets were accessed, what was handled, or what control changes are necessary.
Why the other options are wrong
- A. Determining asset access is a later step that depends on knowing the attacker's location and movement first.
- B. Identifying specific assets handled comes after establishing the scope of movement through the facility.
- C. Changing access controls is a remediation step that should only occur after the full scope of the incident is understood.
Question 3
A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment. The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)
Show answer and explanation
Correct answer: B, E. asset vulnerability assessment; malware analysis report
According to NIST risk assessment methodology, calculating risk requires: assets (provided), vulnerabilities (vulnerability assessment), and threat information. The two missing elements are the asset vulnerability assessment, which identifies what security weaknesses exist in the organization's assets, and a malware analysis report, which provides the threat information specific to the malware variant discovered. These elements allow the organization to assess the likelihood of exploitation and potential impact. Incident response playbooks, staff relations reports, and executive listings are not components of the risk calculation itself.
Why the other options are wrong
- A. Incident response playbooks address response procedures, not risk assessment components.
- C. Staff relations to assets are not required for calculating risk in the NIST framework.
- D. While key assets matter, this option is incomplete and doesn't address the specific missing technical components needed for risk calculation.
2 reviews for Cisco 350-201 CBRCOR Exam Practice Questions
Only logged in customers who have purchased this product may leave a review.
How much of the Cisco 350-201 CBRCOR bank is free?
228 questions in the bankEach step includes the one before, so buying only adds new questions.
- You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
- 5022% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
- 7734% of the bankHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
- 228100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
What’s in the Cisco 350-201 CBRCOR pack
- 228 questions across all four CBRCOR domains
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Delivered by email shortly after checkout
- Free monthly updates for as long as the exam is live
- Pass or your money back
A failed 350-201 attempt costs another US$400. This pack is US$39, paid once, and refunded if you fail.
What makes the CBRCOR hard
CBRCOR is the professional-level SOC exam, and since January 2025 it sits under a new name: the CyberOps Professional track became Cybersecurity Professional (renamed CCNP Cybersecurity in February 2026) and the exam moved to v1.2. The domains and weights did not move, but the v1.2 topics added AI to monitoring and analysis, so an older bank misses those items.
Techniques and Processes are 30% each. Techniques covers AI-powered data analytics, hardening machine images, DevSecOps, threat intelligence platforms, DLP, SIEM data management, and SOAR workflows. Processes is the investigative side: threat models, the full malware analysis sequence, predictive AI analysis of traffic patterns, endpoint intrusion, IOCs and IOAs, and CVSS triage. Fundamentals covers playbooks, compliance frameworks and cloud security operations. Automation expects you to read and modify Python, work with JSON, CSV and XML, use Bash, and describe CI/CD and infrastructure as code.
About the exam
350-201 (Performing Cybersecurity Using Cisco Security Technologies v1.2, CBRCOR) earns the Cisco Certified Specialist, Cybersecurity Core certification and is the core exam for CCNP Cybersecurity. It covers security operations fundamentals, hardening and detection techniques, investigation and malware analysis processes, and security automation. No prerequisites.
Questions before you buy
How quickly do I receive it?
Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.
Related products
-
Cisco 300-815 CLACC
245 questionsUpdated Nov 20264.0 (1) US$39 -
Cisco 300-410 ENARSI
620 questionsUpdated Nov 20265.0 (4) US$39 -
Cisco 300-620 DCACI
404 questionsUpdated Nov 20265.0 (1) US$39 -
Cisco 350-401 ENCOR
1,066 questionsUpdated Nov 20264.9 (11) US$39
Dev Dutt –
These practice files worked really well for me, they were actually not bad at all. The explanations were short and easy to understand. I liked the layout; it was simple but effective. They helped me clear my exam calmly and confidently.
Emily Adams –
I wasn’t sure what to expect with the 350-201 exam, but the practice questions helped clarify things. The practice questions were useful and gave me confidence going into the test.