Cisco CBRCOR 350-201 (Cybersecurity Professional) Practice Exam

What the Cisco CBRCOR 350-201 (Cybersecurity Professional) exam covers

• Fundamentals151 questions
• Techniques227 questions
• Processes228 questions
• Automation151 questions

Free Cisco CBRCOR 350-201 (Cybersecurity Professional) practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 757-question bank.

1. Question 1Fundamentals

   Which describes a security playbook in a SOC?

   • AA documented repeatable procedure for a defined incident classCorrect
   • BA record of every incident the SOC has handled in the last year
   • CA configuration file that tells the firewall which traffic to block
   • DA list of the assets the organisation considers most valuable
   ✓ Correct answer: A

   The point of writing it down is that a tier one analyst at three in the morning takes the same defensible steps as the senior analyst who wrote it, which is what makes SOC output consistent rather than dependent on who is on shift. An incident history, a firewall rule set and an asset register are three other artefacts, each useful and none of them a procedure.

   Why the other options are wrong

   • BA record of past incidents is a case history rather than a procedure to follow.
   • CA configuration file telling the firewall what to block is a control, not a playbook.
   • DA list of valuable assets is an asset register used during risk analysis.
2. Question 2Fundamentals

   Which control category does a SIEM correlation rule belong to?

   • ADetective, since it identifies activity that has already occurredCorrect
   • BPreventive, since it stops the activity from taking place
   • CCorrective, since it restores the system to a known state
   • DDeterrent, since it discourages an attacker from proceeding
   ✓ Correct answer: A

   The rule fires on evidence of activity that already took place, which is what makes detection coverage a separate question from control coverage and why an estate with strong prevention and no detection cannot tell whether it is under attack. Prevention, restoration and deterrence are three different roles.

   Why the other options are wrong

   • BA correlation rule does not stop the activity from taking place.
   • CA correlation rule does not restore the system to a known state.
   • DA correlation rule is invisible to an attacker and deters nobody.
3. Question 3Techniques

   Which describes a hardened machine image?

   • AA base image with unnecessary components removed and secure settings appliedCorrect
   • BA base image containing every package a team might later require
   • CA snapshot taken from a production host that is currently healthy
   • DA base image with the security agent uninstalled to improve performance
   ✓ Correct answer: A

   Building security into the image means every host starts from a known and defensible state rather than being repaired afterwards, which is the difference between a fleet that drifts and a fleet that can be reasoned about. A maximal package set, a snapshot of a running host and an image with the agent removed each start the fleet from a worse position.

   Why the other options are wrong

   • BAn image containing every package a team might need widens the attack surface.
   • CA snapshot of a healthy production host carries whatever drift that host has.
   • DRemoving the security agent from the image removes visibility from every host built.
4. Question 4Techniques

   Which describes the weakness of a flat network?

   • AAny compromised host reaches any other, so one foothold spreadsCorrect
   • BBroadcast traffic is eliminated, so hosts cannot discover each other
   • CRouting between hosts requires a firewall for every connection
   • DHosts are unable to communicate outside their own subnet
   ✓ Correct answer: A

   Without internal boundaries, a phishing click on a laptop places the attacker one hop from the domain controllers and the database servers, which is why flat networks turn small incidents into large ones. Eliminated broadcasts, a firewall per connection and an inability to leave the subnet are three descriptions that do not fit.

   Why the other options are wrong

   • BA flat network carries broadcast traffic rather than eliminating it.
   • CA flat network requires fewer firewalls rather than one per connection.
   • DHosts on a flat network communicate freely rather than being confined.
5. Question 5Techniques

   Which control protects data in motion most directly?

   • ATransport encryption between the communicating systemsCorrect
   • BFull disk encryption on the systems at each end
   • CMemory protection within the processing application
   • DRetention policy applied to the stored copies
   ✓ Correct answer: A

   Data in motion is exposed to anybody positioned on the path between the two systems, so the control that answers it has to protect the bytes while they are on that path. Transport encryption does that, and it holds even when the network in between is untrusted. At rest, in use and in motion are three distinct states of the same data, each with its own control. A control built for one state leaves the other two exposed.

   Why the other options are wrong

   • BFull disk encryption protects the data while it is at rest.
   • CMemory protection within the application addresses data in use.
   • DRetention policy governs how long stored copies are kept.
6. Question 6Processes

   Which describes the purpose of a threat model?

   • AIdentifying what could go wrong with a design, so it can be addressedCorrect
   • BRecording the vulnerabilities a scanner found in the deployed system
   • CListing the attackers who have previously targeted the organisation
   • DMeasuring how long an intrusion went undetected in production
   ✓ Correct answer: A

   The exercise is structured pessimism applied to a design while changing it is still cheap, and its output is a set of decisions rather than a document. Scanner findings, a list of past attackers and a dwell time measurement are three retrospective observations about a system that already exists.

   Why the other options are wrong

   • BScanner findings describe a deployed system rather than a design.
   • CA list of previous attackers is threat intelligence rather than a model.
   • DMeasuring undetected intrusion time is an operational metric.
7. Question 7Processes

   Which does examining the strings in a binary most often reveal?

   • ADestinations, file paths and commands the sample referencesCorrect
   • BThe exact sequence in which the sample's functions execute
   • CThe identity of the person who compiled the binary
   • DWhether the sample will succeed on a particular host
   ✓ Correct answer: A

   It is the cheapest static step and frequently the most productive, because a domain or a command line left in the binary answers in seconds what a detonation might take an hour to show. Execution order, author identity and success on a given host are three things strings do not establish.

   Why the other options are wrong

   • BThe order in which functions execute requires analysis of the code itself.
   • CThe identity of whoever compiled the binary is rarely present.
   • DWhether the sample succeeds on a host depends on that host's configuration.
8. Question 8ProcessesSelect all that apply

   Which TWO are indicators of compromise rather than of attack? (Choose TWO)

   • AA file hash matching a sample recovered from a previous incidentCorrect
   • BA registry key associated with a known persistence mechanismCorrect
   • CA process reading the memory of the authentication component
   • DAn office document spawning a scripting interpreter
   ✓ Correct answer: A, B

   A known hash and a known persistence key are artefacts. They sit on disk or in the registry, their presence says something has already happened, and that is what makes them searchable backwards across historical telemetry and stored images. An indicator of attack is behavioural and time bound: it describes an action while it is happening, so it drives detection in the present rather than a retrospective sweep.

   Why the other options are wrong

   • CReading the memory of the authentication component is a behaviour in progress.
   • DA document spawning a scripting interpreter is a behaviour in progress.
9. Question 9Processes

   Which summarises a defensible approach to vulnerability prioritisation?

   • ACombine severity with exposure, value and exploitationCorrect
   • BWork strictly in descending order of the published severity score
   • CWork in the order the findings were reported by the scanner
   • DWork only on whichever findings the owning teams volunteer to fix first
   ✓ Correct answer: A

   Each factor answers a different part of the question, and using only one of them produces a queue that is either unmanageably long or aimed at the wrong things. Strict severity order, report order and team volunteering are three approaches that ignore most of the available information.

   Why the other options are wrong

   • BStrict severity order ignores exposure, asset value and exploitation.
   • CThe order findings were reported reflects the scan rather than the risk.
   • DWorking on whatever teams volunteer to fix selects by convenience rather than risk.
10. Question 10Automation

    Which is the risk of passing a credential as a command line argument rather than in the environment?

    • AIt appears in the process listingCorrect
    • BIt cannot be read by the program that needs it
    • CIt must be shorter than a fixed number of characters
    • DIt prevents the command from being run again later
    ✓ Correct answer: A

    Any user on the system can see the arguments of a running process, and the shell records the line, which makes it one of the easiest credential exposures to create accidentally. Being unreadable, a length limit and preventing reuse are three claims that do not hold.

    Why the other options are wrong

    • BThe program reads command line arguments perfectly well.
    • CNo fixed character limit makes this the concern.
    • DThe command can be run again as often as required.

Who this Cisco CBRCOR 350-201 (Cybersecurity Professional) practice exam is for

This practice set is for anyone preparing for the Cisco CBRCOR 350-201 (Cybersecurity Professional) exam at the advanced level - from first-time candidates building a foundation to experienced Cisco practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Cisco CBRCOR 350-201 (Cybersecurity Professional) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Cisco CBRCOR 350-201 (Cybersecurity Professional) exam.

Related Cisco resources

• Cisco CBRCOR 350-201 (Cybersecurity Professional) study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Cisco CCNA 200-301 practice examRelated
• Cisco CCNA Automation (200-901 CCNAAUTO) practice examRelated
• Cisco CCNP Automation (350-901 AUTOCOR) practice examRelated

Cisco CBRCOR 350-201 (Cybersecurity Professional) practice exam FAQ