Cisco 350-201 Practice Test

350-201 practice test: what's covered

• SOC Operations
• Threat Detection
• Forensics
• Incident Response
• Automation
• Cisco Security Stack

Free 350-201 sample questions

1. A SOC lead analyst is configuring alert correlation rules to map incoming security events against the Cyber Kill Chain and MITRE ATT&CK frameworks. During a multi-stage intrusion investigation, which action represents the MOST effective operational response?

   • A. Correlate observed endpoint telemetry with network flow logs to identify adversary tactics, then prioritize containment at early attack phases
   • B. Filter out all low-severity endpoint alerts and focus exclusively on high-volume network firewall logs
   • C. Disable correlation rules for internal IP addresses to prevent false positives during scheduled backup windows
   • D. Rely solely on CVSS base scores to determine triage priority regardless of adversary movement or threat context
   Show answer

   Correct: A. Correlating endpoint telemetry with network flow records provides full visibility into adversary tactics across the Cyber Kill Chain, enabling rapid containment before data exfiltration occurs. Option B is incorrect because discarding endpoint alerts removes crucial visibility into local execution. Option C is wrong because suppressing rules on internal IPs creates blind spots for lateral movement. Option D is incorrect because static CVSS base scores do not reflect active adversary behavior or temporal risk.

2. A Tier 2 SOC analyst detects a sudden spike in failed active directory logons across multiple user accounts originating from a single foreign IP subnet, followed by one successful logon to an executive account. Which response is the MOST appropriate immediate action?

   • A. Initiate account containment for the executive user, revoke active session tokens, and correlate identity logs with endpoint activity from that host
   • B. Classify the event as benign because a successful password authentication indicates valid user authorization
   • C. Block the entire Autonomous System Number (ASN) at the edge router without informing identity or incident response teams
   • D. Delete the logon audit logs to clear SIEM buffer capacity while awaiting user confirmation via phone
   Show answer

   Correct: A. Failed logon spikes followed by a successful authentication strongly indicate a password spraying or brute force attack. Immediate account containment, session revocation, and cross-layer correlation are essential to limit compromise. Option B is incorrect because successful auth after brute forcing is a critical indicator of compromise. Option C is wrong because blocking an entire ASN without identity verification causes broad service disruption and fails to contain the hijacked session. Option D is wrong because wiping audit logs destroys forensic evidence.

3. A security operations team receives an automated threat intelligence feed containing thousands of low-confidence IP indicators with high public infrastructure overlap. How should the senior analyst operationalize this data?

   • A. Ingest the indicators into the SIEM for telemetry enrichment and threat hunting queries rather than applying automated perimeter blocking
   • B. Configure perimeter firewalls to automatically drop all traffic matching any IP listed in the feed
   • C. Ignore the threat intelligence feed entirely because low-confidence indicators provide no analytical value
   • D. Generate high-priority incident tickets for every historic firewall event matching the feed items
   Show answer

   Correct: A. Low-confidence indicators with shared infrastructure overlap are best used for contextual enrichment and threat hunting to avoid blocking legitimate cloud services. Option B is wrong because blocking broad public IPs causes widespread false positives and outage. Option C is incorrect because low-confidence intelligence still aids threat hunting when correlated with internal anomalies. Option D is wrong because historic matches against noisy intelligence create severe alert fatigue.

4. A security engineer is designing risk-based alert scoring for a high-value e-commerce transactional environment. Which TWO factors should be combined to establish accurate threat impact ratings? (Choose TWO)

   • A. Asset business criticality ratings combined with vulnerability exploitability metrics
   • B. Observed threat behavior confidence and active adversary progression indicators
   • C. Static alphabetical rule naming schemas in the SIEM detection repository
   • D. Raw syslog message payload length in bytes across network sensors
   Show answer

   Correct: A and B. Combining asset business criticality with vulnerability exploitability, alongside threat confidence and adversary progression, ensures risk scores reflect real business risk and active threat dynamics. Option C is incorrect because rule naming schemas have no relation to threat risk or business impact. Option D is wrong because message payload length does not correlate with security severity or exploit risk.

5. A sandbox analysis of a suspicious email attachment reveals regular HTTP GET requests occurring every 300 seconds to a dynamic DNS host. Which threat hunting action should the analyst execute first?

   • A. Query proxy and DNS logs for periodic 300-second beaconing patterns across all enterprise endpoints to scope potential infection
   • B. Immediately issue a domain registration takedown notice to the registrar without internal scoping
   • C. Reimage all domain controllers in the organization as a precautionary measure
   • D. Disable DNS resolution enterprise-wide until the dynamic domain expires
   Show answer

   Correct: A. Querying proxy and DNS logs for matching 300-second beaconing intervals identifies infected endpoints across the organization before taking containment actions. Option B is wrong because external registrar requests take time and do not scope internal compromise. Option C is incorrect because reimaging domain controllers without evidence is unnecessary and disruptive. Option D is wrong because shutting down enterprise DNS causes a total infrastructure outage.

Last updated: 2026-10-19

350-201 practice test FAQ

Related practice tests

• CCIE Security Written 350-701 practice test
• CCNA 200-301 practice test
• Cisco 300-410 practice test
• CCNP ENCOR 350-401 practice test
• Cisco 100-160 practice test
• Cisco 200-201 practice test