10 free Cisco 350-201 CBRCOR practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 228 questions. Work through them, then open each answer to check your reasoning.
Get all 228 questions (US$39) · Download these 10 as a PDF
Question 1
Refer to the exhibit. A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests.
These requests made the application unresponsive.
Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?
Show answer and explanation
Correct answer: A. Limit the number of API calls that a single client is allowed to make
The exhibit shows one threat actor flooding a cloud application with concurrent API requests until legitimate users are denied access, which is a single source denial of service condition. The countermeasure is API rate limiting, which caps how many calls any one client may issue in a given time window. Enforcing per-client quotas at the API layer keeps one caller from consuming all capacity and preserves equitable access for the rest of the user community.
Why the other options are wrong
- B. Edge router restrictions act on network flows without visibility into API calls or client identity, so they cannot enforce fair per-client request quotas for the application.
- C. Shrinking the amount of data returned to all active clients degrades service for legitimate users while leaving the flood of concurrent requests untouched.
- D. Adding application cache speeds up data retrieval but does nothing to limit request volume from an abusive client.
Question 2
A threat actor attacked an organization's Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded.
When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator's account was disabled.
Which activity triggered the behavior analytics tool?
Show answer and explanation
Correct answer: C. accessing multiple servers
Behavior analytics compares activity against a learned baseline for the account, and a single administrator account reaching three different servers from a remote location inside thirty minutes is the anomaly that stands out. That pattern matches lateral movement following credential theft, which is exactly what user and entity behavior analytics is tuned to detect. The response confirms it: the session was killed and the account disabled at the third server, not at the point of the file downloads.
Why the other options are wrong
- A. Administrative access to the Active Directory server is normal activity for that account and matches the existing baseline on its own.
- B. The financial server was simply where the session was terminated, and touching one server does not constitute the anomalous pattern being scored.
- D. Eleven file downloads within an authorized session is a lesser signal, and the tool did not act at that point since the session continued to a third server.
Question 3
Refer to the exhibit. A security analyst needs to investigate a security incident involving several suspicious connections with a possible attacker.
Which tool should the analyst use to identify the source IP of the offender?
Show answer and explanation
Correct answer: A. packet sniffer
The exhibit is a host connection table that lists the local host, remote host names and ports, and connection states, but it does not expose the actual packet contents or resolve the true remote addresses behind those sessions. A packet sniffer captures the live traffic for those sessions so the analyst can read the IP headers and pin down the offender's source IP. Packet level capture is the tool that turns an ambiguous connection listing into confirmed attacker addressing.
Why the other options are wrong
- B. Malware analysis examines binaries and their behavior, which does not yield the network addressing of the remote peer in these sessions.
- C. A SIEM reports on logs that have already been collected and normalized, so it cannot supply the packet level addressing detail this host based connection list is missing.
- D. A firewall manager administers rules and policy objects rather than capturing and inspecting the traffic needed to attribute a source IP.
Question 4
Refer to the exhibit. Cisco Advanced Malware Protection installed on an end-user desktop has automatically submitted a low prevalence file to the Threat Grid analysis engine for further analysis.
What should be concluded from this report?
Show answer and explanation
Correct answer: C. The prioritized behavioral indicators of compromise justify the execution of the "ransomware" because the scores are high and indicate the likelihood that malicious ransomware has been detected.
The Threat Grid analysis report demonstrates multiple high-severity behavioral indicators that collectively indicate malicious ransomware activity. The top-priority indicators include CTB Locker Detected (Severity: 100, Confidence: 100), Generic Ransomware Detected (Severity: 100, Confidence: 95), and Large Amount of High Entropy Artifacts Written (Severity: 100, Confidence: 80). These high severity and confidence scores, particularly the definitive detection of CTB Locker (a known ransomware family) and generic ransomware patterns, provide strong evidence that the file exhibits malicious ransomware behavior. The combination of high scores across multiple ransomware-specific indicators justifies the conclusion that malicious ransomware has been detected.
Why the other options are wrong
- A. This option incorrectly states the scores do not indicate likelihood of malicious ransomware, when in fact the high severity and confidence scores directly support ransomware detection.
- B. This option contains a logical contradiction by stating high scores do not indicate malicious ransomware likelihood, which contradicts how threat analysis scoring works.
- D. This option incorrectly claims low scores justify the ransomware conclusion, when the actual scores are predominantly high (80-100 severity range).
Question 5
The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze.
Which step should be taken at this stage?
Show answer and explanation
Correct answer: D. Identify movement of the attacker in the enterprise
The incident is a confirmed tailgating entry, and the specialist's first analytical task is to scope it by reconstructing where the unauthorized person went inside the facility. Badge readers, camera footage and door logs establish the path and dwell times, which defines every area and system that was within reach. Everything that follows, including asset exposure and control changes, depends on that movement timeline.
Why the other options are wrong
- A. Listing reachable assets cannot be done accurately until the areas the intruder actually entered are known.
- B. Determining what was handled or taken is a later forensic step that depends on the locations identified first.
- C. Modifying access controls is remediation and belongs after the analysis establishes what was exposed.
Question 6
A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment.
The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)
Show answer and explanation
Correct answer: B, E
B. asset vulnerability assessment E. malware analysis report According to NIST risk assessment methodology, calculating risk requires threat, vulnerability, and impact analysis. The scenario provides the threat (malware in pirated software) and the asset inventory. Missing are the vulnerability assessment (which identifies weaknesses in those assets that the malware could exploit) and the malware analysis report (which details the threat's capabilities, behavior, and potential impact). These two elements are essential to complete the risk equation: Risk = Threat × Vulnerability × Impact.
Why the other options are wrong
- A. Incident response playbooks are part of response procedures, not the foundational elements needed to calculate initial risk.
- C. Staff member relationships to assets are not a core NIST requirement for risk assessment calculations.
- D. While asset inventory was provided, identifying key assets and executives separately is not a distinct missing element required by NIST for this calculation.
Question 7
Refer to the exhibit. At which stage of the threat kill chain is an attacker, based on these URIs of inbound web requests from known malicious Internet scanners?
Show answer and explanation
Correct answer: D. reconnaissance
These URIs represent reconnaissance activity. The first URI references JMX invoker functionality, the second targets an admin interface, and the third contains a malicious script payload attempting SQL injection and file system access (referencing /etc/passwd). These are characteristic of attackers probing systems to gather information about vulnerabilities, services, and security posture, the hallmark of the reconnaissance stage. Reconnaissance occurs early in the kill chain when attackers scan and identify potential targets and weaknesses before attempting to exploit them.
Why the other options are wrong
- A. Exploitation involves actually executing code or leveraging vulnerabilities to gain unauthorized access; these URIs are probing attempts, not active exploits being executed.
- B. Actions on objectives occur after successful compromise when attackers achieve their goals like data exfiltration or system damage; these requests are preliminary scanning.
- C. Delivery refers to transmitting malware or exploit code to a target; these are reconnaissance scans gathering information about systems rather than delivering malicious payloads.
Question 8
Refer to the exhibit.
How must these advisories be prioritized for handling?
Show answer and explanation
Correct answer: B. Vulnerability #2 is the highest priority for every type of institution
Vulnerability #2 is exploitable by any attacker who can reach TCP port 80 on the device, with no login required, and it allows configuration changes, account creation, disclosure of sensitive data and loss of availability. Vulnerability #1 requires the attacker to already hold an authenticated high privilege administrative session over telnet, SSH or the console, which is a far higher bar. Vulnerability #2 also has no fix available, only the option to disable the web management interface, so it demands immediate handling in every environment.
Why the other options are wrong
- A. The gap between unauthenticated remote exploitation and a privileged authenticated prerequisite is decisive on its own, so institution type does not change the ordering.
- C. The two advisories carry very different exploitability, since one needs no credentials at all while the other needs full administrative access first.
- D. Vulnerability #1 can only be triggered by an already authenticated administrator and it has a released fix, which places it below the unauthenticated issue.
Question 9
Refer to the exhibit.
Which two steps mitigate attacks on the webserver from the Internet? (Choose two.)
Show answer and explanation
Correct answer: A, B
A. Create an ACL on the firewall to allow only TLS 1.3 B. Implement a reverse server in the DMZ network Option A mitigates attacks by restricting the firewall to allow only secure TLS 1.3 connections, which protects against older protocol vulnerabilities and man-in-the-middle attacks. Option B implements a reverse proxy server in the DMZ, which shields the actual web server from direct internet exposure by acting as an intermediary that receives and filters incoming requests before they reach the internal web server, significantly reducing attack surface. Together, these controls implement defense-in-depth by combining protocol-level security with architectural isolation.
Why the other options are wrong
- C. Creating an ACL to allow only external connections does nothing to prevent attacks; it would actually allow attacks from the internet while blocking internal access.
- D. Moving the webserver to the internal network would break its accessibility to internet users and defeats the purpose of having a web server.
- E. Moving the webserver to the external network exposes it directly to the internet with no firewall or DMZ protection, dramatically increasing attack exposure.
Question 10
According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?
Show answer and explanation
Correct answer: B. Conduct a data protection impact assessment
A Data Protection Impact Assessment (DPIA) is the GDPR-mandated process for evaluating how data handling practices ensure confidentiality, integrity, and availability. The DPIA examines risks to data and determines appropriate safeguards to protect personal data throughout its lifecycle, directly addressing the CIA triad requirements under GDPR.
Why the other options are wrong
- A. Vulnerability assessments identify technical weaknesses but are not the GDP-pecific mechanism for ensuring data protection.
- C. Penetration testing is a security validation tool but not the GDPR-designated approach for ensuring data confidentiality, integrity, and availability.
- D. Awareness testing measures employee knowledge but does not systematically ensure data protection controls are in place.
That was 10 of 228.
The full Cisco 350-201 CBRCOR pack has all 228 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.