350-201 CBRCOR — Cisco Certified Network Professional (CCNP) Cybersecurity

Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.

1. . A security engineer describes four types of threat intelligence to a SOC team. She explains that one type helps executives understand the motivations and capabilities of threat actors to inform long-term security investment decisions. Which threat intelligence type does this describe?

   • A. Tactical threat intelligence
   • B. Operational threat intelligence
   • C. Strategic threat intelligence(correct)
   • D. Technical threat intelligence

   Explanation: Strategic threat intelligence is high-level, non-technical information intended for executive and board-level audiences. It describes adversary motivations, geopolitical trends, and industry-specific targeting patterns to guide security investment and risk appetite decisions. Tactical intelligence describes TTPs (tactics, techniques, and procedures) for defenders. Operational intelligence supports specific incident response actions. Technical intelligence consists of machine-readable IOCs such as IP addresses, hashes, and domains.

2. . A CVSS v3.1 vulnerability score shows a Base Score of 9.8, a Temporal Score of 8.5, and an Environmental Score of 6.2. The SOC team prioritises remediation based on the Environmental Score. Why would the Environmental Score be lower than the Base Score?

   • A. The Environmental Score always rounds down the Base Score by a fixed percentage
   • B. The Environmental Score adjusts the Base Score based on the organisation's specific deployment context, such as compensating controls in place and the asset's criticality to the business(correct)
   • C. The Temporal Score reduces the Base Score because the exploit code is not yet public
   • D. The Environmental Score reflects the vendor's patch availability timeline

   Explanation: The CVSS Environmental Score allows organisations to customise the Base Score to reflect their specific environment. Factors include Modified Attack metrics (e.g., compensating controls that reduce exploitability) and Confidentiality/Integrity/Availability Requirements (e.g., a non-critical internal test server has lower CIA requirements than a production payment system). A lower Environmental Score means the vulnerability poses less risk in that specific context. The Temporal Score (option C) reflects exploit code maturity and patch availability, which is a separate metric.

3. . A threat analyst maps a recent intrusion to the MITRE ATT&CK framework and identifies that the adversary used a specific living-off-the-land technique. In ATT&CK terminology, what is the relationship between a tactic, a technique, and a sub-technique?

   • A. A tactic is the specific tool used; a technique is the adversary's goal; a sub-technique is the vulnerability exploited
   • B. A tactic is the adversary's high-level goal (the 'why'); a technique is the method used to achieve that goal (the 'how'); a sub-technique is a more specific implementation of a technique(correct)
   • C. Tactics, techniques, and sub-techniques are all synonyms for the same concept
   • D. A tactic is a specific CVE number; a technique is a CVSS score; a sub-technique is the remediation step

   Explanation: In the MITRE ATT&CK framework, tactics represent the adversary's tactical goals — what they are trying to achieve at each stage (e.g., Persistence, Privilege Escalation, Lateral Movement). Techniques describe how adversaries achieve their tactical goal (e.g., Scheduled Task/Job for Persistence). Sub-techniques provide a more granular description of a specific implementation variation within a technique (e.g., Scheduled Task/Job: Scheduled Task — T1053.005 — specifically for Windows Task Scheduler).

4. . A threat analyst describes the cyber kill chain to a junior analyst. The analyst asks what happens during the 'Weaponisation' phase. Which activity occurs in this phase?

   • A. The attacker sends a phishing email to a target employee
   • B. The attacker conducts reconnaissance to identify targets and vulnerable systems
   • C. The attacker creates a deliverable payload by coupling an exploit with a malicious backdoor into a document or executable(correct)
   • D. The attacker establishes a command-and-control channel to communicate with compromised systems

   Explanation: The Lockheed Martin Cyber Kill Chain defines Weaponisation as the phase where the attacker creates the attack weapon: combining an exploit (that takes advantage of a vulnerability) with a remote access trojan or backdoor into a deliverable payload such as a malicious PDF, Word document, or executable. Reconnaissance (phase 1) involves information gathering. Delivery (phase 3) is sending the phishing email. Command and Control (phase 6) establishes the C2 channel after exploitation.

5. . An organisation implements DLP (Data Loss Prevention) on its email gateway. A DLP rule is configured to detect unencrypted documents containing credit card numbers sent to external recipients and block them. Which security objective does this control address?

   • A. Availability — ensuring systems remain online
   • B. Integrity — ensuring data is not modified in transit
   • C. Confidentiality — preventing sensitive data from leaving the organisation unauthorised(correct)
   • D. Authentication — verifying the identity of email senders

   Explanation: DLP controls are designed to prevent unauthorised disclosure of sensitive data, which directly serves the Confidentiality principle of the CIA triad. Blocking emails containing unencrypted credit card numbers from leaving the organisation prevents data exfiltration. Availability refers to system uptime. Integrity refers to data accuracy and completeness. Authentication verifies identity.

6. . A threat hunter analyses memory from a compromised Windows system and finds that a legitimate process (explorer.exe) has a section of executable code in its memory that does not correspond to any module on disk. The code appears to have been injected. Which malware technique does this indicate?

   • A. Pass-the-hash
   • B. Reflective DLL injection(correct)
   • C. SQL injection
   • D. ARP spoofing

   Explanation: Reflective DLL injection is an in-memory technique where a malicious DLL loads itself into the address space of a running process without writing the DLL to disk and without using the standard Windows loader. The injected code 'reflects' upon itself to resolve its own imports and relocations. This leaves no DLL file on disk, making it difficult to detect with file-based scanning. The presence of executable memory regions with no corresponding on-disk module is a key indicator. Pass-the-hash steals NTLM hashes for lateral movement. SQL injection targets databases. ARP spoofing operates at Layer 2.

7. . A SOC analyst performing network forensics captures a TCP stream between a compromised host and an external IP. The HTTP request headers show a 'Host:' value that does not match the IP address destination. The User-Agent string is an unusual combination of browser, OS, and version strings. Response bodies contain large amounts of Base64-encoded data embedded in seemingly normal JSON API responses that happen every 300 seconds. Which C2 technique does this MOST represent?

   • A. DNS tunnelling
   • B. ICMP-based C2
   • C. HTTP/S-based C2 beaconing with domain fronting indicators(correct)
   • D. SMB lateral movement

   Explanation: The pattern — regular 300-second intervals (beaconing), HTTP traffic with mismatched Host header and destination IP (domain fronting technique to evade domain blocklists), anomalous User-Agent (malware impersonating a browser), and Base64-encoded data in API responses — collectively indicate HTTP-based C2 beaconing. Domain fronting uses a CDN or cloud service as the apparent destination while routing traffic to the attacker's real server via the Host header. DNS tunnelling uses DNS queries. ICMP C2 encodes data in ICMP payloads. SMB lateral movement uses Windows file sharing protocols.

8. . A threat hunter is investigating lateral movement. An attacker obtained a valid NTLM password hash for a domain admin account from the memory of one compromised system. The attacker then authenticated to another system using only the hash, without cracking the password. Which technique was used?

   • A. Kerberoasting
   • B. Pass-the-hash(correct)
   • C. Golden Ticket attack
   • D. LLMNR poisoning

   Explanation: Pass-the-hash (PtH) is a lateral movement technique where an attacker uses a captured NTLM password hash to authenticate to a remote system or service without knowing the plaintext password. Windows NTLM authentication accepts the hash directly. Kerberoasting targets Kerberos service account TGS tickets to crack offline. A Golden Ticket attack forges a Kerberos TGT using the krbtgt account hash. LLMNR poisoning captures hashes through rogue name resolution responses, but is an initial capture technique, not the lateral movement step.

9. . A SOC analyst performs static malware analysis on a suspicious Windows executable. Which two artefacts would a static analysis step extract WITHOUT executing the file? (Choose 2)

   • A. The SHA-256 hash of the file(correct)
   • B. The list of network connections the malware opens during execution
   • C. Printable strings embedded in the binary (e.g., URLs, registry keys, error messages)(correct)
   • D. The exact registry keys modified when the malware runs
   • E. The process tree spawned during live detonation

   Explanation: Static analysis examines a file without executing it. Computing a cryptographic hash (SHA-256) and extracting printable strings from the binary are both static techniques — they require only the file itself. Strings often reveal embedded URLs, IP addresses, registry key names, function imports, and error messages that provide attribution and behavioural clues. Network connections (B), registry modifications (D), and process spawning (E) are all observed during dynamic analysis (running the sample in a sandbox).

10. . A threat hunter forms the following hypothesis: 'An adversary has compromised an endpoint and is abusing PowerShell to download and execute payloads from the internet.' Which MITRE ATT&CK technique ID and tactic BEST matches this hypothesis?

    • A. T1059.001 (Command and Scripting Interpreter: PowerShell) under the Execution tactic(correct)
    • B. T1078 (Valid Accounts) under the Initial Access tactic
    • C. T1110 (Brute Force) under the Credential Access tactic
    • D. T1021.002 (Remote Services: SMB/Windows Admin Shares) under Lateral Movement

    Explanation: Using PowerShell to download and execute code from the internet is a well-documented technique catalogued in MITRE ATT&CK as T1059.001 — Command and Scripting Interpreter: PowerShell. The tactic is Execution because the adversary's goal at this stage is to run malicious code on the compromised endpoint. T1078 covers using stolen credentials for access. T1110 covers password brute-forcing. T1021.002 covers lateral movement via SMB shares.

11. . A SOC analyst is enriching a SIEM alert with threat intelligence. The indicator in question is a domain name (evil-c2.example.com) observed in DNS queries from an internal host. Which SIEM enrichment step adds the MOST context to this indicator?

    • A. Checking the domain against a threat intelligence platform (TIP) for known malicious classification, WHOIS registration details, and associated malware families(correct)
    • B. Pinging the domain to check if it resolves
    • C. Searching for the domain in Windows Event Logs on the querying host
    • D. Blocking the domain in the firewall before completing analysis

    Explanation: Threat intelligence enrichment involves querying a Threat Intelligence Platform (TIP) or threat feeds (such as Cisco Talos, VirusTotal, or WHOIS databases) to determine the domain's reputation, registration history, associated malware families, and linked infrastructure. This context helps the analyst assess severity and prioritise the response. Simply pinging provides little actionable intelligence. Searching Windows Event Logs confirms which process made the query but does not enrich the indicator itself. Blocking before completing analysis may cause alert fatigue and misses the investigation step.

12. . A forensic analyst is performing TCP stream reassembly on a packet capture. In the reassembled stream, she observes HTTP POST requests to /upload.php with a body parameter containing 'cmd=whoami' and the server responding with the output of the 'whoami' command. What type of attack is in progress?

    • A. SQL injection — the attacker is injecting SQL commands into a web form
    • B. Web shell — the attacker has uploaded a PHP file that executes OS commands on the server(correct)
    • C. Cross-site scripting (XSS) — the attacker is injecting scripts into web responses
    • D. CSRF — the attacker is forging requests on behalf of an authenticated user

    Explanation: A web shell is a malicious script (in this case, likely a PHP file: upload.php) uploaded to a web server that provides the attacker with remote code execution by accepting OS commands as HTTP parameters and returning the output. The 'cmd=whoami' pattern and the server returning command output are classic web shell indicators. SQL injection targets database query syntax. XSS injects client-side scripts into web pages viewed by other users. CSRF tricks authenticated users into making unintended requests.

13. . A threat hunter investigates Kerberoasting. An attacker with a domain user account requests service tickets (TGS) for several Service Principal Names (SPNs) and exports the encrypted tickets offline. What is the attacker's goal in extracting these tickets?

    • A. To replay the tickets on the network to authenticate as a domain administrator without a password
    • B. To crack the service account passwords offline, since the tickets are encrypted with the service account's NTLM hash(correct)
    • C. To extract the krbtgt account hash and forge Golden Tickets
    • D. To obtain the plaintext Kerberos pre-authentication password directly from the ticket

    Explanation: In Kerberoasting, any authenticated domain user can request TGS tickets for accounts with Service Principal Names. These tickets are encrypted using the service account's NTLM hash. The attacker exports the tickets and performs offline password cracking (using tools like Hashcat or John the Ripper) to recover the service account's plaintext password. Service accounts often have weak passwords and elevated privileges, making them high-value targets. Replaying TGS tickets directly is a different attack (pass-the-ticket). Extracting the krbtgt hash is required for Golden Ticket attacks, not Kerberoasting.

14. . A SOC team uses STIX 2.1 to represent threat intelligence and TAXII 2.1 to share it with partners. Which statement correctly describes the role of each standard?

    • A. STIX is the transport protocol; TAXII is the data format
    • B. STIX is the structured language for describing threat intelligence objects (indicators, malware, campaigns, etc.); TAXII is the protocol for sharing STIX content over HTTPS(correct)
    • C. STIX and TAXII are both firewall rule formats used by Cisco products
    • D. TAXII defines the indicator format; STIX defines the API endpoints

    Explanation: STIX (Structured Threat Information eXpression) is a standardised language and serialisation format (JSON) for representing cyber threat intelligence objects such as Indicators, Malware, Threat Actors, Attack Patterns, and Campaigns. TAXII (Trusted Automated eXchange of Intelligence Information) is the application protocol (built on HTTPS) used to transport STIX content between servers and clients. The two standards are complementary: STIX defines what the data looks like; TAXII defines how it is exchanged.

15. . After a major ransomware incident, the CISO holds a post-incident review. The team documents what controls failed, what the attacker's entry point was, and which detection rules would have caught the attack earlier. Which incident response phase does this activity belong to?

    • A. Containment
    • B. Eradication
    • C. Recovery
    • D. Post-incident activity (Lessons Learned)(correct)

    Explanation: The post-incident activity phase (also called 'Lessons Learned' in NIST SP 800-61) occurs after an incident is fully resolved. The team documents what happened, what the root cause was, what detection gaps existed, and what improvements should be made to prevent or detect similar incidents in the future. Containment limits the spread of an active incident. Eradication removes the threat from affected systems. Recovery restores systems to normal operation.

16. . A vulnerability manager must prioritise remediation of 500 newly discovered vulnerabilities. She decides to use the CVSS Environmental Score combined with asset criticality ratings. A CVSS 9.8 vulnerability on a non-internet-facing test server with compensating controls rates 5.2 after environmental scoring. A CVSS 7.2 vulnerability on a public-facing payment processing server rates 8.9 after environmental scoring. Which should be remediated FIRST?

    • A. The CVSS 9.8 vulnerability, because it has a higher Base Score
    • B. The CVSS 7.2 vulnerability on the payment server, because it has a higher Environmental Score reflecting actual business risk(correct)
    • C. Both vulnerabilities simultaneously, because CVSS scores above 7 are all equally critical
    • D. Neither — both should be assigned to a vendor for remediation

    Explanation: Environmental Scoring contextualises a vulnerability's risk to the specific organisation. The payment server's vulnerability scores 8.9 environmentally, reflecting higher real-world risk due to internet exposure, business criticality (payment processing), and fewer compensating controls. The test server's 9.8 base vulnerability drops to 5.2 environmentally due to isolation, non-critical role, and existing compensating controls. Effective vulnerability management prioritises based on environmental risk, not raw base scores alone.

17. . A SOC receives an alert at 2 AM: a domain admin account is running PowerShell on 30 workstations simultaneously, downloading executables from an external IP. The on-call analyst must decide whether to escalate to P1 immediately or investigate further. Which P1 escalation criteria does this scenario MOST satisfy?

    • A. A single user is experiencing an application error
    • B. Multiple systems are potentially compromised in an active, widespread attack involving privileged credentials — meeting the threshold for immediate P1 escalation and incident commander activation(correct)
    • C. The alert should be dismissed because domain admins regularly run PowerShell on workstations
    • D. This should be queued as a P3 for morning shift review because no data exfiltration is confirmed yet

    Explanation: P1 (Priority 1 / Critical) escalation criteria typically include: active widespread compromise, use of privileged credentials (domain admin), lateral movement across multiple systems, and potential data exfiltration. All these indicators are present. Waiting until data exfiltration is confirmed would allow significant additional damage. Dismissing or downgrading based on the absence of confirmed exfiltration is a dangerous assumption — the urgency and impact indicators clearly warrant immediate P1 escalation and incident commander activation.

18. . A SOAR playbook is triggered automatically when a phishing email is reported. The playbook extracts URLs from the email body, checks them against a threat intelligence feed, and, if malicious, blocks the sender domain in the email gateway and quarantines similar emails from the last 24 hours. Which SOAR concept does the automatic URL-checking and blocking step represent?

    • A. A manual analyst review step requiring human approval
    • B. An automated action (automated enrichment and response) within a SOAR orchestration workflow(correct)
    • C. A SIEM correlation rule that generates alerts
    • D. A vulnerability scan triggered by the phishing email

    Explanation: SOAR (Security Orchestration, Automation, and Response) platforms automate repetitive, well-defined response actions. The described steps — extracting URLs, querying threat intelligence, and blocking domains — are automated actions within an orchestration workflow (playbook). No human is required for each individual step once the playbook is triggered. A manual review step would require an analyst to approve an action. A SIEM correlation rule generates alerts but does not take automated blocking actions. A vulnerability scan is a different process.

19. . After remediating a critical vulnerability, a vulnerability manager runs a follow-up scan to confirm the patch was applied successfully. Which vulnerability management lifecycle phase does this represent?

    • A. Discovery/Scanning
    • B. Prioritisation
    • C. Remediation
    • D. Validation(correct)

    Explanation: The vulnerability management lifecycle consists of discovery/scanning (identify vulnerabilities), prioritisation (rank by risk), remediation (apply fixes), and validation (verify that the fix was successful and the vulnerability is no longer present). Running a follow-up scan after patching to confirm the vulnerability is gone is the Validation phase. Without validation, the team cannot confirm that remediation was effective.

20. . A security team uses a qualitative risk scoring methodology. A vulnerability is rated 'Critical' (likelihood: High, impact: High), while another is rated 'Low' (likelihood: Low, impact: Low). What is the primary limitation of qualitative risk scoring compared to quantitative methods?

    • A. Qualitative methods produce exact financial loss estimates, which are harder to communicate
    • B. Qualitative methods are subjective and cannot express risk in financial terms, making it difficult to directly compare cost of controls against potential losses(correct)
    • C. Qualitative methods require complex mathematical formulas that most security teams cannot perform
    • D. Qualitative methods always underestimate risk compared to quantitative methods

    Explanation: Qualitative risk assessment uses descriptive categories (Low/Medium/High/Critical) based on expert judgement, making it accessible and fast but inherently subjective — two analysts may rate the same risk differently. It does not produce monetary risk values, which makes it difficult to justify security investment in financial terms or perform cost-benefit analysis of controls. Quantitative methods (e.g., Annual Loss Expectancy) use numerical estimates to express risk in financial terms but require more data and effort.

21. . A security automation script receives a JSON response from a threat intelligence API. The response contains a key called 'indicators' whose value is a list of objects. Each object has 'type' and 'value' keys. Which Python code snippet correctly extracts and prints all indicator values where the type is 'domain'?

    • A. for item in response['indicators']: if item.type == 'domain': print(item.value)
    • B. for item in response['indicators']: if item['type'] == 'domain': print(item['value'])(correct)
    • C. print(response.indicators.domain)
    • D. response.filter(type='domain').print()

    Explanation: When a JSON response is parsed with Python's json.loads() or requests.json(), it becomes a Python dictionary. Dictionary keys are accessed with square bracket notation: item['type'], not item.type (which is attribute access for objects). The correct pattern iterates over the list response['indicators'], checks if item['type'] == 'domain', and prints item['value']. Option A uses attribute access (incorrect for dicts). Options C and D are not valid Python for this data structure.

22. . A security engineer uses the Cisco SecureX platform to build an automated workflow. The workflow triggers when a Cisco Secure Endpoint alert fires, automatically queries Cisco Talos for the associated file hash, and if the verdict is malicious, isolates the endpoint via the Secure Endpoint API. Which SecureX capability does this workflow leverage?

    • A. SecureX Threat Response — a manual investigation console only
    • B. SecureX Orchestration — automated workflow execution integrating multiple Cisco and third-party security products(correct)
    • C. SecureX Device Insights — an asset inventory view
    • D. Cisco Identity Services Engine (ISE) — endpoint posture assessment

    Explanation: Cisco SecureX Orchestration (formerly part of the SecureX platform) provides a workflow automation engine that can integrate Cisco security products (Secure Endpoint, Umbrella, SecureX Threat Response, Talos) and third-party tools via pre-built or custom connectors. The described workflow — trigger on alert, query Talos, conditionally isolate endpoint via API — is an orchestration workflow. SecureX Threat Response is a pivot-based investigation tool. Device Insights is an asset inventory feature. Cisco ISE handles network access control and posture.

23. . A security developer calls the Cisco Secure Endpoint (formerly AMP for Endpoints) REST API to retrieve all events for a specific computer GUID in the last hour. The API endpoint is GET /v1/computers/{connector_guid}/trajectory. The developer receives a 401 Unauthorized response. What is the MOST likely cause?

    • A. The endpoint GUID does not exist in the Secure Endpoint console
    • B. The API credentials (API key/client ID and secret) are missing, incorrect, or the API key does not have the required scope for trajectory data(correct)
    • C. The trajectory endpoint requires a POST request, not GET
    • D. The Secure Endpoint API does not support trajectory queries

    Explanation: HTTP 401 Unauthorized indicates an authentication failure — the request did not include valid credentials or the provided credentials lack the required permission scope. The Cisco Secure Endpoint API uses HTTP Basic Authentication with a client ID and API key (or OAuth depending on version). A missing, expired, or low-privilege API key returns 401. A non-existent GUID would return 404 Not Found. The /v1/computers/{guid}/trajectory endpoint does use GET. The endpoint does support trajectory queries as part of the Secure Endpoint API.

24. . A security engineer designs an automated phishing triage workflow. When a user reports a phishing email, the workflow should extract the sender address, all URLs, and any file attachments; check them against threat intelligence; and produce a verdict. If malicious, the workflow should quarantine similar emails from the sender. Which sequence of automated steps is in the CORRECT order?

    • A. Quarantine emails → Check threat intel → Extract IOCs → Receive report
    • B. Receive report → Extract IOCs (URLs, sender, attachments) → Check IOCs against threat intel → If malicious: quarantine and block sender(correct)
    • C. Extract IOCs → Receive report → Check threat intel → Quarantine emails
    • D. Check threat intel → Extract IOCs → Receive report → Quarantine emails

    Explanation: The correct automated phishing triage sequence is: (1) Receive the user report/trigger event; (2) Extract indicators of compromise (IOCs) — sender address, URLs, file attachment hashes; (3) Enrich/check those IOCs against threat intelligence feeds; (4) Apply verdict-based actions (quarantine, block sender, notify SOC). Each step depends on the output of the previous one, so the order is not interchangeable. Quarantining before extraction or intel checks would cause false positives and block legitimate mail.

25. . A STIX 2.1 bundle contains an Indicator object with the following pattern: [domain-name:value = 'malicious-c2.example.com']. A related Malware object is linked to the Indicator via a 'indicates' relationship. What does this STIX structure represent and how would an automated system use it?

    • A. The structure defines a firewall rule syntax to block the domain at the network perimeter
    • B. The Indicator object contains a detection pattern (the malicious domain); the Malware object provides context about what malware uses this domain; an automated system would ingest this via TAXII, extract the domain, and add it to DNS blocklists or SIEM watchlists(correct)
    • C. The STIX bundle is a log file format that replaces syslog for network devices
    • D. The Indicator object contains vulnerability CVE data; the Malware object contains the patch to apply

    Explanation: In STIX 2.1, an Indicator object contains a pattern (using the STIX Pattern Language) that describes a detectable observable — in this case, a specific domain name. The 'indicates' relationship links it to a Malware object describing what threat the indicator is associated with. An automated TIP or SOAR system ingests this bundle via TAXII, parses the pattern, extracts the domain, and distributes it as a block rule to DNS sinkholes, proxy URL filters, or adds it to SIEM watchlists for alert generation when observed in network traffic.