Free 350-201 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Pretty sure it should be C. To see if risk mitigation is really working, you have to look at whether the controls are actually cost-effective and reducing risk, not just if systems are documented (D is more about asset inventory). Seen similar questions in practice material. Anyone see an argument for B here?

Had something like this in a mock recently. The main goal of hardening is to securely configure devices to minimize vulnerabilities, so limiting the attack surface. Option A lines up with that. The others are more about detection or analysis after the fact, not prevention.

Option D might fit if the question was asking about incident response, but since it's about hardening, do they mean "best purpose" or just "one of the purposes"? That would change things here.

Pretty sure it's C. Privilege escalation fits because of the system setting changes, that's a key sign from similar practice exams. You see DoS errors, but with those mods it's usually more than just denial-of-service. Disagree?

I kind of see why C might seem right since HTTP status codes are part of the protocol, but for REST APIs, 2xx usually signals the request was handled successfully. Not totally convinced though-depends how strict they want to be with wording here. Agree?

D imo makes sense if the focus was on fixing payments quickly, but since it's asking what to do first, A fits better because you need to figure out what happened before jumping to manual fixes. Is there a specific company policy that prioritizes incident escalation over initial investigation?

Shouldn't we clarify exactly what caused the payment misdirection before alerting IR? If the SaaS tool was down and it's not confirmed as a breach, jumping straight to B seems premature. Anyone else think gathering info from the SaaS team (A) makes more sense as a first step?

Shouldn't we check with the SaaS tool team first to figure out what went wrong before escalating? Jumping to B seems like an easy trap here, since you don’t know the scope or if it’s a breach yet.

B tbh makes sense, since after behavioral analysis you'd typically want to unpack the specimen and dig into memory forensics to see any code or artifacts loaded in RAM. You get more insight before moving on to code-level static or dynamic analysis (A). That's the standard progression from what I've seen in Cisco-style guides. Pretty sure B is right, but open to comments if I missed something.

Why wouldn’t unpacking and memory forensics (B) come before code analysis here? Analyzing packed or obfuscated malware statically (A) seems premature unless the specimen’s already been fully extracted. Seen Cisco stress this order in exam reports. Anyone see it asked another way?

Why does Cisco still make these questions so vague? B/D.

I matched 'large amount of data leaving the network through unusual ports' with actions on objectives and 'open port scans and multiple failed logins from the website' to exploitation. I figured data exfiltration is usually the final goal, so it fits actions on objectives. Not fully sure since some reports show open scans as recon or exploitation. Open to debate here.

Pretty sure this one follows the NIST order: Prepare goes with employee training, Analyze to identifying how/where the breach was hit, Contain is about stopping it from spreading, Eradicate is root cause removal, Recover is restoring ops, and Post-Incident Handling is for improving after. I matched based on that process. Anyone disagree?

• Conduct incident response role training for employees → Prepare
• Determine how the breach was discovered and the areas that were impacted → Analyze
• Determine where it started and prevent spread → Contain
• Eliminate root cause and update system → Eradicate
• Get ops going, prevent recurrence → Recover
• Analyze/document/strengthen after attack → Post-Incident Handling

Nice and clear question layout. Mapping is:
Analyze and document the breach, and strengthen systems against future attacks → Post-Incident Handling
Conduct incident response role training for employees → Prepare
Determine where the breach started and prevent the attack from spreading → Contain
Determine how the breach was discovered and the areas that were impacted → Analyze
Eliminate the root cause of the breach and app updates to the system → Eradicate
Get systems and business operations up and running, and ensure that the same type of attack does not occur again → Recover

Had something like this in a mock. Mapping seems solid if you know the NIST flow: Prepare is training, Analyze covers how/where breach hit, Contain stops spread, Eradicate removes root cause, Recover gets ops going, and Post-Incident Handling is all about learning/improving after. Don't think there's much room for debate here but open to corrections if someone spots a mismatch.

• Prepare → Conduct incident response role training
• Analyze → How breach was discovered/areas impacted
• Contain → Prevent attack from spreading
• Eradicate → Remove root cause/update system
• Recover → Restore ops/prevent recurrence
• Post-Incident Handling → Analyze/document/strengthen systems post-event

Yeah, for incidents like this Stealthwatch alert, you really want to do the search and investigation steps before jumping into containment. So it's: Search for infected hosts → Investigate infected hosts → Investigate and classify the exposure → Examine returned results → Execute rapid threat containment. Makes sense given you need to know what you're dealing with first. If anyone has seen a scenario where you'd contain right away, let me know.

Looks like standard mapping from official guide labs. App control for desktops, patching for vulnerabilities, restrict admin for privilege, MFA for weak auth, backups for data loss.

Yeah, this mapping makes sense. App control lines up with stopping non-approved desktop apps, patching is standard for app vulnerabilities, limiting admin rights handles privilege issues, MFA addresses weak verification, and backups are your answer for data loss. Seen similar matches on other practice sets, but open if someone has a different logic!

Pretty sure the mapping is: app control for blocking non-approved desktop apps, patching for app vulnerabilities, restrict admin for privilege account risks, MFA fixes weak single-factor auth, and backup retention covers data loss. That's what I'd expect from Cisco best practices. Let me know if you see a better fit.

Is the question asking for the traditional order of CI/CD pipeline phases, or do we need to match the phases based on a specific Cisco DevSecOps model shown in that linked image? The mapping could change depending on which convention they're testing.