CiscoProfessional level350-201

350-201 exam dumps: 288 free Cisco CBRCOR (CyberOps Professional Core) practice questions

Free 350-201 practice questions for the Cybersecurity Professional - Performing Cybersecurity Using Cisco Security Technologies exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 288 by number, or take a timed practice exam.

Question bank last updated February 2025

Start timed practice exam Browse all 288 questions

Free 350-201 practice questions

Questions 1 to 10 of 288

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

350-201 Question 1

Select 3

A security analyst at your organization is tasked with evaluating the effectiveness of the current cybersecurity framework. As part of the process, they must identify the three pillars of the CIA triad to ensure a robust security posture. Which of the following components are part of the CIA triad?

A
Confidentiality
B
Integrity
C
Accountability
D
Availability
E
Authentication
F
Non-repudiation

Show answer and explanation

Correct answers: A, B, D

Explanation

The CIA triad is a foundational concept in cybersecurity that stands for Confidentiality, Integrity, and Availability. These three components are essential for designing and maintaining secure systems. Confidentiality ensures that only authorized users can access sensitive information. Integrity guarantees that data remains unaltered and trustworthy. Availability ensures that authorized individuals can access information and resources when needed. While concepts like accountability, authentication, and non-repudiation are important in cybersecurity, they do not form part of the CIA triad framework.

A. Correct.
Confidentiality is a core component of the CIA triad and ensures that sensitive information is protected from unauthorized access.
B. Correct.
Integrity is a key element of the CIA triad, focusing on ensuring that data is accurate, consistent, and not altered by unauthorized individuals.
C. Incorrect.
Accountability is an important security principle, but it is not one of the three components of the CIA triad.
D. Correct.
Availability is a critical component of the CIA triad, which ensures that authorized users have access to information and resources when needed.
E. Incorrect.
Authentication is a fundamental security mechanism, but it is not part of the CIA triad. It is typically a means to enforce confidentiality, integrity, or availability.
F. Incorrect.
Non-repudiation is a vital security concept, especially in digital communications, but it is not one of the three pillars of the CIA triad.

350-201 Question 2

Select 3

A cybersecurity administrator is tasked with implementing a Zero Trust architecture in their network environment. As part of the initial steps, they need to identify the key principles of the Zero Trust model to ensure proper implementation. Which of the following are core principles of the Zero Trust framework?

A
Always trust devices that are part of the internal network
B
Verify explicitly by using strong authentication methods
C
Assume breach and design defenses accordingly
D
Enforce least privilege access for users and devices
E
Allow unrestricted access to critical systems for faster troubleshooting

Show answer and explanation

Correct answers: B, C, D

Explanation

The Zero Trust model is built on the principles of 'never trust, always verify,' assuming breach, and enforcing least privilege access to minimize security risks. These principles collectively ensure that security is maintained regardless of whether resources are inside or outside the traditional network perimeter.

A. Incorrect.
This option is incorrect because the Zero Trust model operates on the principle of 'never trust, always verify,' even for devices within the internal network.
B. Correct.
This option is correct as verifying explicitly, often through strong authentication and authorization, is a core principle of Zero Trust.
C. Correct.
This option is correct because assuming breach and preparing defenses accordingly is fundamental to the Zero Trust framework to mitigate risks effectively.
D. Correct.
This option is correct as enforcing least privilege ensures that users and devices only have access to the resources they need, reducing the attack surface.
E. Incorrect.
This option is incorrect since unrestricted access contradicts Zero Trust principles, which emphasize controlled and monitored access to critical systems.

350-201 Question 3

Single answer

You are a cybersecurity analyst tasked with implementing a zero-trust security model in your organization. As part of the initial step, you need to ensure proper segmentation and control of network traffic. Which fundamental concept of Cisco Security Technologies would be MOST crucial for achieving this goal?

A
Micro-segmentation using Cisco TrustSec
B
Cisco Secure Email Gateway configuration
C
Deploying endpoint protection with Cisco AMP for Endpoints
D
Monitoring network traffic using Cisco Stealthwatch

Show answer and explanation

Correct answer: A

Explanation

Zero-trust security relies heavily on network segmentation and strict access controls. Cisco TrustSec is a foundational technology for achieving micro-segmentation, which is a critical component of zero trust. It ensures that network traffic is controlled and authorized based on identity policies, aligning with the zero-trust principles.

A. Correct.
Micro-segmentation using Cisco TrustSec is a fundamental approach in implementing a zero-trust model by segmenting the network and enforcing access policies based on identity, ensuring only authorized traffic flows.
B. Incorrect.
Cisco Secure Email Gateway is focused on email security, which is not directly related to network segmentation or the zero-trust model.
C. Incorrect.
Deploying endpoint protection with Cisco AMP for Endpoints is valuable for endpoint security but does not address network segmentation or the enforcement of a zero-trust model.
D. Incorrect.
Monitoring network traffic using Cisco Stealthwatch helps with detecting and responding to threats but does not enforce segmentation or directly implement the zero-trust model.

350-201 Question 4

Single answer

An organization is implementing a cybersecurity solution using Cisco technologies. During a security review, the security team identifies that they need to establish a foundational security posture by integrating visibility, control, and automation across their environment. Which Cisco framework or architecture should they adopt to meet these requirements?

A
Cisco SecureX
B
Cisco Talos Intelligence
C
Cisco Umbrella
D
Cisco SD-WAN

Show answer and explanation

Correct answer: A

Explanation

Cisco SecureX is specifically designed to integrate security tools, provide centralized visibility, and enable automation across the security ecosystem, making it the most suitable choice for establishing a foundational security posture. Other options like Talos, Umbrella, and SD-WAN address specific aspects of security or networking but do not meet the broader requirements of integration and automation.

A. Correct.
Cisco SecureX is a cloud-native security platform that provides integration, visibility, automation, and control across Cisco security products and third-party tools, making it ideal for establishing a foundational security posture.
B. Incorrect.
Cisco Talos Intelligence focuses on threat intelligence and research but does not provide the integration and automation capabilities required for a foundational security framework.
C. Incorrect.
Cisco Umbrella is a cloud-delivered security solution focused on DNS-layer security and secure web gateways, but it does not offer comprehensive integration and automation features across the security environment.
D. Incorrect.
Cisco SD-WAN is a software-defined wide-area networking solution that optimizes network connectivity but is not designed as a foundational security architecture.

350-201 Question 5

Single answer

You are a security analyst tasked with analyzing a playbook designed to respond to phishing email incidents. The playbook includes the following steps: 'Email header analysis,' 'URL reputation check,' 'Quarantine email,' and 'User notification.' Which of the following best describes a critical component of this playbook?

A
The use of an automated system to execute all steps
B
The inclusion of specific, actionable steps to address the phishing email
C
The involvement of an external threat intelligence feed
D
The integration of a machine learning model to predict future phishing attempts

Show answer and explanation

Correct answer: B

Explanation

A playbook's primary purpose is to provide clear, actionable steps for responding to a specific incident type. In this case, the phishing email response playbook includes steps that guide the security team in analyzing, mitigating, and notifying stakeholders about the threat. While other tools and integrations can augment a playbook, the inclusion of actionable steps is the most critical component.

A. Incorrect.
While automation is valuable, it is not a critical requirement for a playbook. Playbooks can also involve manual processes.
B. Correct.
A playbook must include specific, actionable steps to guide the response process effectively. This is a critical component for ensuring consistency and clarity during incident response.
C. Incorrect.
Using an external threat intelligence feed can enhance the playbook but is not mandatory for its creation or functionality.
D. Incorrect.
Machine learning models may provide additional insights or predictions, but they are not essential components of a playbook's structure.

350-201 Question 6

Select 3

A cybersecurity team is tasked with automating their incident response process using a playbook. The team’s playbook includes components such as triggers, conditions, and actions. Which of the following elements are correctly interpreted as key components of a security playbook?

A
A trigger that initiates the playbook when specific conditions, such as an alert, are met.
B
A condition that defines contextual parameters, such as the severity of an alert or affected assets.
C
A manual step requiring an analyst to review and approve every action before execution.
D
An action that specifies the tasks to be executed, such as isolating a compromised endpoint or blocking an IP address.
E
A log of all past incidents and their resolutions for reference.

Show answer and explanation

Correct answers: A, B, D

Explanation

A playbook is a predefined workflow that automates incident response processes. Key components include triggers to initiate the playbook, conditions to evaluate the context, and actions to execute specific tasks. These elements work together to streamline and standardize responses to cybersecurity incidents, reducing reaction time and minimizing human error.

A. Correct.
A trigger is a valid component of a playbook as it defines the event or condition that initiates the workflow.
B. Correct.
Conditions are used to determine whether specific criteria are met before proceeding with actions, making them an essential part of a playbook.
C. Incorrect.
While manual interventions can occur in incident response, requiring an analyst to review every action negates the automation purpose of a playbook. Thus, this is not a key playbook component.
D. Correct.
Actions are critical components of a playbook as they define the tasks to be carried out during incident response.
E. Incorrect.
A log of past incidents is useful for reference and analysis but does not constitute a key component of a playbook.

350-201 Question 7

Select 3

You are a security analyst reviewing a playbook created for responding to phishing email incidents. The playbook includes the following components: identifying the malicious email, isolating affected endpoints, notifying affected users, and collecting evidence for further analysis. Which components of the playbook are essential for ensuring proper incident response and mitigation?

A
Identifying the malicious email
B
Isolating affected endpoints
C
Notifying affected users
D
Configuring network firewall rules
E
Collecting evidence for further analysis

Show answer and explanation

Correct answers: A, B, E

Explanation

In an effective playbook, components must focus on immediate response actions to mitigate the attack, such as identification, containment, and evidence gathering. While notifying users and firewall configurations are important in broader security contexts, they are not directly critical to phishing mitigation in this scenario.

A. Correct.
Identifying the malicious email is a critical first step to determine the scope and nature of the incident.
B. Correct.
Isolating affected endpoints helps prevent the spread of the phishing attack, making it an essential mitigation step.
C. Incorrect.
While notifying affected users is important, it is not a direct response or mitigation action in this specific incident context.
D. Incorrect.
Configuring network firewall rules, while useful in other scenarios, is not directly relevant in most phishing email responses unless the attack involves malicious traffic.
E. Correct.
Collecting evidence for further analysis ensures that the incident can be properly investigated and lessons learned for future prevention.

350-201 Question 8

Select 3

You are part of a security operations team and are tasked with automating the response to a phishing email incident. The playbook you are reviewing includes steps such as 'Email Header Analysis,' 'URL Reputation Check,' 'Quarantine Email,' and 'Notify Affected Users.' Which of the following are key components of this playbook that ensure an effective and automated response?

A
Triggers that define when the playbook is initiated
B
Defined steps for each action to be taken during the response
C
A list of unaffected users to exclude from notifications
D
Integration points with tools like email gateways and SIEM platforms
E
Manual intervention steps to ensure human oversight at every stage

Show answer and explanation

Correct answers: A, B, D

Explanation

An effective playbook for phishing email incidents should include clearly defined triggers, step-by-step actions, and integration with relevant tools to ensure automation and efficiency. These components allow the playbook to be executed systematically and consistently. Manual steps can be included sparingly but are not required at every stage in an automated playbook.

A. Correct.
Triggers are essential as they define the conditions under which the playbook is executed, ensuring timely response to incidents.
B. Correct.
Defined steps outline the sequence of actions to be performed, making the playbook actionable and structured.
C. Incorrect.
While excluding unaffected users could be important in some scenarios, it is not a core component of the playbook itself. This is more of a detail within a specific action in the playbook.
D. Correct.
Integration points with relevant tools like email gateways and SIEM platforms are critical for automating processes and gathering necessary data.
E. Incorrect.
Manual intervention at every stage negates the purpose of automation in playbooks. While human oversight might be needed at key decision points, it is not a requirement for every step.

350-201 Question 9

Select 3

An organization has observed a spike in suspicious outbound traffic from multiple endpoints. According to the incident response playbook, the team needs to analyze network traffic for potential data exfiltration and identify the affected endpoints. Which tools should be used to fulfill the requirements outlined in the playbook?

A
NetFlow or Secure Network Analytics
B
Cisco Advanced Malware Protection (AMP) for Endpoints
C
Wireshark or packet capture tools
D
Cisco Umbrella
E
Cisco Identity Services Engine (ISE)
F
Endpoint Detection and Response (EDR) tools

Show answer and explanation

Correct answers: A, C, F

Explanation

To address the playbook scenario, tools like NetFlow or Secure Network Analytics, Wireshark, and EDR are essential. NetFlow or Secure Network Analytics offers high-level visibility into network traffic, Wireshark provides granular packet-level analysis, and EDR tools help investigate and remediate affected endpoints. These tools together fulfill the requirements of detecting data exfiltration and identifying impacted endpoints.

A. Correct.
NetFlow or Secure Network Analytics provides visibility into network traffic patterns and can help identify anomalous or suspicious outbound traffic indicative of data exfiltration.
B. Incorrect.
Cisco Advanced Malware Protection (AMP) for Endpoints focuses on malware detection and remediation on endpoints, but it does not analyze network traffic for data exfiltration.
C. Correct.
Wireshark or packet capture tools allow for detailed inspection of network traffic, making them essential for analyzing data exfiltration incidents.
D. Incorrect.
Cisco Umbrella provides DNS-layer security and blocks malicious domains, but it is not designed for in-depth traffic analysis during an incident response.
E. Incorrect.
Cisco Identity Services Engine (ISE) focuses on network access control and policy enforcement but does not provide tools for analyzing network traffic or endpoints during incidents.
F. Correct.
Endpoint Detection and Response (EDR) tools help identify and investigate compromised endpoints, making them useful for addressing affected endpoints as per the playbook.

350-201 Question 10

Select 2

During an active ransomware attack, a cybersecurity team is following a playbook for incident response. The playbook specifies identifying the affected systems, isolating them from the network, and collecting forensic evidence. Which tools would be most appropriate to use in this scenario?

A
Cisco Secure Endpoint
B
Cisco Umbrella
C
Wireshark
D
Cisco Secure Malware Analytics (Threat Grid)
E
Cisco Secure Firewall

Show answer and explanation

Correct answers: A, D

Explanation

The playbook specifies identifying affected systems, isolating them from the network, and collecting forensic evidence. Cisco Secure Endpoint is an effective tool for identifying and isolating compromised devices, while Cisco Secure Malware Analytics (Threat Grid) supports forensic analysis of malware. These tools align closely with the steps outlined in the playbook.

A. Correct.
Cisco Secure Endpoint is a suitable tool for identifying affected systems and isolating them from the network, as it provides endpoint detection and response (EDR) capabilities.
B. Incorrect.
Cisco Umbrella is primarily used for DNS-layer security and blocking malicious domains but does not directly assist in identifying or isolating affected systems or collecting forensic evidence during an active ransomware attack.
C. Incorrect.
Wireshark is a network protocol analyzer that can capture network traffic for analysis but does not provide direct tools for identifying or isolating affected systems or collecting forensic evidence in this scenario.
D. Correct.
Cisco Secure Malware Analytics (Threat Grid) is highly useful for analyzing suspicious files and collecting forensic evidence, which aligns with the playbook's steps for this scenario.
E. Incorrect.
Cisco Secure Firewall is primarily used for perimeter defense and segmentation. While it can block malicious traffic, it is not directly relevant to identifying affected systems or collecting forensic evidence during an active ransomware attack.

Timed practice exam

Take a 350-201 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

350-201 practice questions 1 to 100 of 288

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 3 pages of up to 100 questions.

350-201 exam dumps FAQ

Are these 350-201 dumps real exam questions?

No. These are original practice questions written to the Cybersecurity Professional - Performing Cybersecurity Using Cisco Security Technologies exam objectives, not questions copied from a live exam. Memorising leaked questions violates Cisco's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many 350-201 practice questions are there?

288 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the 350-201 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed 350-201 practice test?

Sign in and start the Cybersecurity Professional - Performing Cybersecurity Using Cisco Security Technologies exam on HydraNode. A session gives you 75 questions drawn from this bank in 120 minutes, then a score report with a per-question review.