Domain 1: Fundamentals
- A playbook is a repeatable procedure for one class of incident. The components that matter are the trigger that says when it applies, ordered steps with explicit decision points, the evidence to collect, escalation and handoff conditions, and closure criteria.
- Playbook selection follows the observed trigger rather than the analyst's theory. An investigation may hand off to another playbook later, which is exactly what the handoff section exists for.
- Compliance regimes map to industries: PCI DSS to cardholder data, FISMA to US federal agencies, FedRAMP to cloud services sold to them, SOC 2 to service organisations, SOX to financial reporting controls, HIPAA to health information, GDPR to personal data of people in the EU, and ISO 27001 to a risk-driven management system.
- Cyber risk insurance is risk transfer. It funds forensic work, notification and third party liability, and it changes nothing about how likely an incident is. Underwriters increasingly require named controls, and a statutory notification duty cannot be transferred by contract.
- Risk needs an asset of value, a vulnerability and a threat able to exploit it. Severity alone is not risk, which is why a critical finding on an isolated laboratory host can wait behind a medium one on a payment server.
- The four treatments are avoid, mitigate, transfer and accept. An acceptance needs a named owner, a stated rationale and a review date, or it becomes a hidden liability.
- The response phases run preparation, detection and analysis, containment, eradication, recovery and post-incident review, and the review feeds back into preparation. Containment buys time; eradication removes access, tooling and persistence.
- Know the metrics and their traps: time to detect measures the detection estate, dwell time measures the cost of a gap, and alert volume measures activity. A programme managed by alert volume rewards closing alerts rather than finding intrusions.
Domain 2: Techniques
- Hardening belongs in the image rather than in a remediation step afterwards. Remove what the workload does not need, apply a documented baseline, rebuild the image on a schedule and verify the build before publishing it.
- CIS Benchmarks and DISA guides are consensus configuration guidance, not law. Assess each item against the workload and document the exceptions, because blanket application causes outages and blanket dismissal wastes the work.
- Prioritise patching by exploitation and exposure rather than by base score alone. Virtual patching with a network or application control buys time; it does not remove the flaw.
- Segmentation bounds lateral movement. Microsegmentation applies policy per workload, which is the movement a perimeter model cannot see, and the only proof a boundary works is testing reachability from inside each segment.
- Egress filtering with default deny is among the highest value controls available, because most intrusions depend on the compromised host reaching outward.
- Data exists at rest, in motion and in use. Data loss prevention covers host, network, application and cloud channels, and each has a blind spot: an offline laptop, sharing inside a service, or a photograph of a screen.
- Tuning means adjusting logic, thresholds or scope so a rule fires on what matters. Narrow exclusions preserve coverage; broad ones remove it. Always re-run the technique afterwards to confirm the rule still fires.
- Behavioural intelligence outlasts indicators, because rotating a domain costs an attacker minutes while rebuilding a technique costs them weeks. Treat generated analysis as a hypothesis and require it to cite its evidence.
Domain 3: Processes
- A threat model needs the assets and the trust boundaries. Threat categories map to answering controls: spoofing to authentication, tampering to integrity protection, repudiation to audit logging, and elevation of privilege to authorisation.
- Investigation sequence is set by the case type and bounded by the telemetry. The first questions for a phishing report are whether anybody interacted and how widely it was delivered; for malware, whether it executed or was blocked.
- Acquire a sample safely with its hash recorded and without executing it. Detonate in an isolated snapshot-restorable sandbox with simulated network access, and treat a clean report on a suspicious sample as probable evasion rather than proof of innocence.
- Static analysis answers what a sample could do where dynamic analysis answers what it did. Strings, imports and embedded configuration are cheap and productive; full reverse engineering is slow and reserved for the questions that need it.
- Reconstruct a sequence from host telemetry and network telemetry together. Beaconing shows as regular, uniform, low volume traffic; staging shows as bulk internal movement to an unusual host; exfiltration shows as outbound volume exceeding inbound.
- An indicator of compromise is an artefact showing something happened; an indicator of attack is behaviour showing something is happening. Search history for the first, and build detection from the second.
- Endpoint investigation asks the same questions on every platform while the evidence differs enormously - an agent on a workstation, a management platform on a mobile device, and network telemetry alone for an embedded one.
- For a data loss case, establish what data, whose, and whether it actually left before any notification decision. Missing access auditing on the affected store is the single most common reason that question cannot be answered.
Domain 4: Automation
- Orchestration coordinates several tools into a workflow; automation performs one task without a person. Automate the deterministic front of an investigation and leave consequential decisions with people.
- Automated containment needs a confidence threshold, a reversible action and a full record. Silent failure is the most dangerous mode, so alert when a workflow stops succeeding.
- Read scripts for behaviour and for defects. Building a shell command by concatenating user input allows arbitrary commands; passing a list with no shell removes the injection entirely.
- Requests need a timeout, a status check before parsing, backoff on retry and validation of the fields the script relies on. Credentials come from the environment or a secret store, never from the source file.
- Know the response classes: two hundred success, three hundred redirection, four hundred client error, five hundred server error. Four hundred and one means authenticate; four hundred and three means insufficient rights; four hundred and twenty nine means slow down and honour the stated wait.
- Basic authentication encodes rather than encrypts, so transport security is essential. A bearer token authorises whoever holds it, which is why tokens are short lived and never written into logs or command lines.
- Match the data format to the shape of the data: structured object notation for nested records, comma separated for flat tabular exports with quoting for embedded delimiters, and one object per line for streaming.
- A pipeline gives a single controlled path to production where checks can be placed. Infrastructure as code adds a reviewable declarative definition, idempotent application and drift detection, at the cost of a pipeline credential that can change everything.
Cisco CBRCOR 350-201 (Cybersecurity Professional) exam tips
- Read every scenario for what has actually been observed, not what might be true. Several options are usually real Cisco or industry concepts; only one answers the question asked.
- When a question asks for the first action, prefer the step that preserves evidence and establishes scope over the one that feels decisive. Reimaging and resetting come later.
- Severity is not risk and detection is not prevention. Where an option combines exposure with exploitation, it usually outranks one that quotes a higher score in isolation.
- For automation questions, ask whether the step is deterministic. If it needs judgement or carries business impact, the answer is almost always to hand over to a person.
- Watch for options that overstate: guarantees, complete coverage, or a control removing the need for another. The correct answer in this exam is usually the measured one.
- Learn the response code families properly. Several questions turn on knowing whether the client or the server needs to change, and on whether retrying the identical request could ever help.
- Distinguish compromise indicators from attack indicators in your head as you read. It decides whether the answer is to hunt through history or to write a detection.
- In v1.2 the AI topics are about judgement, not magic. Generated analysis is a hypothesis to test, prioritisation orders a queue rather than emptying it, and a model trained during a compromise learns the intrusion as normal.
Study guide FAQ
What is the CBRCOR 350-201 exam format?
It is a 120-minute exam associated with the Cisco Cybersecurity Professional certification. Cisco uses scaled scoring and does not publish a fixed cut score, so the figure shown here is a practice threshold rather than an official pass mark.
Has the certification been renamed?
Yes. The CyberOps Professional certification became the Cisco Cybersecurity Professional certification effective 21 January 2025. The exam code 350-201 and the CBRCOR name are unchanged, and the current topic version is v1.2.
What are the domain weightings?
Fundamentals 20 percent, Techniques 30 percent, Processes 30 percent and Automation 20 percent, taken from Cisco's published exam topic sheet. The two thirty percent domains carry most of the exam, so scenario reasoning about techniques and investigation processes deserves most of the study time.
How much scripting knowledge does the exam expect?
Enough to read a short Python fragment and say what it does, to spot an obvious defect such as building a shell command from user input, and to describe what a modification would change. You are not expected to write a program from scratch, but you should be comfortable with shell basics, common data formats and how a script calls a web interface.
Do I need to know specific Cisco products?
Less than the exam name suggests. The blueprint is written in vendor-neutral operational terms - playbooks, hardening, threat intelligence platforms, SIEM, SOAR, sandboxes, indicators - and the questions test what a senior analyst would do rather than which menu to click in a particular product.
What is the most common reason candidates lose marks?
Choosing an answer that is true but does not address the scenario. Almost every question offers several defensible security statements; the one that scores is the one that answers the specific situation, which is usually a trade-off between evidence, exposure and disruption rather than a fact to recall.