Free 350-201 Practice Test Questions and Answers (2026)

Last Update Check

View Mode
Q: 1
A company’s web server availability was breached by a DDoS attack and was offline for 3 hours because it was not deemed a critical asset in the incident response playbook. Leadership has requested a risk assessment of the asset. An analyst conducted the risk assessment using the threat sources, events, and vulnerabilities. Which additional element is needed to calculate the risk?
Options
11 comments in the community discussion
2
Option D. The risk model framework's needed to actually do the calculation. Methodology matters for leadership, so D fits better than B.
D , though I kinda see why some might pick B. Risk model framework gives you the actual structure for calculation here.
Q: 2
What is needed to assess risk mitigation effectiveness in an organization?
Options
19 comments in the community discussion
7
Option C makes sense because just following standards or tracking KPIs doesn't directly tell you if controls are actually reducing risk cost-effectively. For risk mitigation, the effectiveness of controls vs their expense is what matters. I've seen similar questions in practice tests, and they focus on actual control o
2
D tbh, because an updated list of vulnerable systems (D) helps you spot ongoing exposure and new risks. C looks tempting but feels more like a cost review step than actual effectiveness monitoring. Not 100% sure, anyone see it differently?
Q: 3
The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?
Options
11 comments in the community discussion
5
D . The specialist needs to map the attacker's route before figuring out assets touched or changing controls. That's standard investigation flow. Pretty sure that's what they're looking for here, but could see how B might confuse some folks.
1
D . Specialist needs to trace the intruder's movement before jumping to controls or asset inventory. B is tempting but you can't ID handled assets until you know where they went, right? Open to disagreement though.
Q: 4
What is the purpose of hardening systems?
Options
11 comments in the community discussion
1
C, saw a similar question in some practice exams where vulnerability identification was marked important for system security steps.
1
C tbh, since identifying vulnerabilities is a key step before you actually harden a system. Seen similar logic in some official guides, so maybe check Cisco's book or practice exams for wording.
Q: 5
Refer to the exhibit. CISCO 350-201 question An engineer received multiple reports from employees unable to log into systems with the error: The Group Policy Client service failed to logon – Access is denied. Through further analysis, the engineer discovered several unexpected modifications to system settings. Which type of breach is occurring?
Options
18 comments in the community discussion
3
C. not D. The login failure alone looks like denial-of-service, but those unexpected system setting changes are classic signs of a privilege escalation attempt. This kind of scenario pops up on practice tests a lot. Anyone else think D is a red herring here?
3
Option C classic privilege escalation scenario. Really clear question, similar to ones I’ve seen in other practice sets.
Q: 6
An engineer is investigating several cases of increased incoming spam emails and suspicious emails from the HR and service departments. While checking the event sources, the website monitoring tool showed several web scraping alerts overnight. Which type of compromise is indicated?
Options
13 comments in the community discussion
2
C here, social engineering makes sense since web scraping can help attackers harvest info for targeted attacks, not just mass phishing. This combo matches more with info gathering plus manipulation tactics. Pretty confident but let me know if you think otherwise.
2
A tbh had something like this in a mock, fits the email spam angle.
Q: 7
Refer to the exhibit. CISCO 350-201 question An engineer is analyzing this Vlan0386-int12-117.pcap file in Wireshark after detecting a suspicious network activity. The origin header for the direct IP connections in the packets was initiated by a google chrome extension on a WebSocket protocol. The engineer checked message payloads to determine what information was being sent off-site but the payloads are obfuscated and unreadable. What does this STIX indicate?
Options
19 comments in the community discussion
6
C. not D. Malware is tempting but the clue is about obfuscated payloads that aren’t UTF-8, which can mean data leak via odd encoding. Similar exam questions tend to push toward C here.
1
C tbh. I remember similar scenarios mentioned in the official guide and practice tests where if payloads are obfuscated instead of readable UTF-8, it's a classic sign of data leakage, not confirmed malware. WebSockets by themselves aren't enough to call out malware activity unless you have more context. Pretty sure C i
Q: 8
What do 2xx HTTP response codes indicate for REST APIs?
Options
14 comments in the community discussion
1
Hard to say, C. 2xx responses handle protocol-level info, like 201 for resource created or 204 for no content. Not totally sure though, maybe I'm missing something simple here.
1
D imo, had something like this in a mock and it was successful request for REST APIs.
Q: 9
An engineer returned to work and realized that payments that were received over the weekend were sent to the wrong recipient. The engineer discovered that the SaaS tool that processes these payments was down over the weekend. Which step should the engineer take first?
Options
17 comments in the community discussion
1
If payments were intentionally tampered with, B might be first since that's a confirmed incident. Otherwise A.
1
Definitely start with A here. Need to confirm what happened with the SaaS tool before moving forward, since not every issue is a security breach. Pretty sure that's the safest first move, at least from other exam threads I've read.
Q: 10
The SIEM tool informs a SOC team of a suspicious file. The team initializes the analysis with an automated sandbox tool, sets up a controlled laboratory to examine the malware specimen, and proceeds with behavioral analysis. What is the next step in the malware analysis process?
Options
22 comments in the community discussion
1
B tbh makes sense, since after behavioral analysis you'd typically want to unpack the specimen and dig into memory forensics to see any code or artifacts loaded in RAM. You get more insight before moving on to code-level static or dynamic analysis (A). That's the standard progression from what I've seen in Cisco-sty
1
I think B since unpacking and memory forensics usually come right after initial behavioral analysis. You want to get a clean look at the sample and see what's in memory before diving into static analysis or cleanup. Seen this order in some Cisco practice sets, but open to corrections.
Q: 11
Engineers are working to document, list, and discover all used applications within an organization. During the regular assessment of applications from the HR backup server, an engineer discovered an unknown application. The analysis showed that the application is communicating with external addresses on a non- secure, unencrypted channel. Information gathering revealed that the unknown application does not have an owner and is not being used by a business unit. What are the next two steps the engineers should take in this investigation? (Choose two.)
Options
4 comments in the community discussion
1
C/D? I'm not 100% on this, but A and D seem more about proper IR steps and documenting ownership, which lines up with best practices for unknown apps. Kind of split since B has some value too.
A or D. I think these fit what you'd want in a real assessment-find out what data is at risk and try to get asset ownership documented. Official study guides and lab scenarios both drive this point home, but happy to hear if someone thinks B fits better.
Q: 12
Refer to the exhibit. CISCO 350-201 question Where are the browser page rendering permissions displayed?
Options
9 comments in the community discussion
1
Option C is right. The Content-Type header tells browsers how to render the page. A (X-Frame-Options) is a common distractor but that's just about frames, not full page rendering. Let me know if you see it differently.
1
C is correct. X-Frame-Options (A) can trip people up here, but browser rendering permissions show in the Content-Type header.
Q: 13
An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)
Options
7 comments in the community discussion
Would option E actually count as a UEBA trigger or is it just part of the suspicious activity? Not totally sure.
Why does Cisco still make these questions so vague? B/D.
Q: 14

DRAG DROP Drag and drop the type of attacks from the left onto the cyber kill chain stages at which the attacks are seen on the right. CISCO 350-201 question

Drag & Drop
4 comments in the community discussion
9
system phones connecting to countries where no staff are located → reconnaissancemalware placed on the targeted system → weaponizationnot visible to the victim → deliverylarge amount of data leaving the network through unusual ports → exploitationUSB with infected files inserted into company laptop → in
3
Nah, I don't think exploitation goes with 'large amount of data leaving the network.' That's more like actions on objectives. The trap here is confusing data exfiltration for just exploit activity.
Q: 15

DRAG DROP Drag and drop the function on the left onto the mechanism on the right. CISCO 350-201 question

Drag & Drop
4 comments in the community discussion
7
Orchestration -> organizes components to seamlessly run applications, creates the set of executable tasks. Automation -> minimizes redundancies and streamlines repetitive tasks, systematically executes large workflows. Had something like this in a mock, this mapping matches what I remember.
5
Orchestration: organizes components to seamlessly run applications, creates the set of executable tasks. Automation: minimizes redundancies and streamlines repetitive tasks, systematically executes large workflows. Only catch is if "large workflows" meant full-blown orchestration in some rare docs, but in Cisco's conte
Q: 16

DRAG DROP Drag and drop the NIST incident response process steps from the left onto the actions that occur in the steps on the right. CISCO 350-201 question

Drag & Drop
6 comments in the community discussion
6
Pretty sure this one follows the NIST order: Prepare goes with employee training, Analyze to identifying how/where the breach was hit, Contain is about stopping it from spreading, Eradicate is root cause removal, Recover is restoring ops, and Post-Incident Handling is for improving after. I matched based on that pro
6
Nice and clear question layout. Mapping is:Analyze and document the breach, and strengthen systems against future attacks → Post-Incident HandlingConduct incident response role training for employees → PrepareDetermine where the breach started and prevent the attack from spreading → ContainDetermine
Q: 17

DRAG DROP Refer to the exhibit. CISCO 350-201 question The Cisco Secure Network Analytics (Stealthwatch) console alerted with “New Malware Server Discovered” and the IOC indicates communication from an end-user desktop to a Zeus C&C Server. Drag and drop the actions that the analyst should take from the left into the order on the right to investigate and remediate this IOC. CISCO 350-201 question

Drag & Drop
10 comments in the community discussion
4
Had something like this in a mock. The best order is: Search for infected hosts, Investigate infected hosts, Investigate and classify the exposure, Examine returned results, then Execute rapid threat containment. Pretty sure that matches standard incident response steps for malware C&C alerts. If anyone disagrees,
3
Yeah, for incidents like this Stealthwatch alert, you really want to do the search and investigation steps before jumping into containment. So it's: Search for infected hosts → Investigate infected hosts → Investigate and classify the exposure → Examine returned results → Execute rapid threat containment. Makes sens
Q: 18

DRAG DROP Drag and drop the mitigation steps from the left onto the vulnerabilities they mitigate on the right. CISCO 350-201 question

Drag & Drop
9 comments in the community discussion
7
Utilize application control -> End-user desktops allow the execution of non-approved applications, Patch applications -> Application security vulnerabilities, Restrict admin access -> Privileged accounts have full rights, MFA -> User verification is weak, Backup settings retention -> Data or access loss
6
Looks like standard mapping from official guide labs. App control for desktops, patching for vulnerabilities, restrict admin for privilege, MFA for weak auth, backups for data loss.
Q: 19

DRAG DROP Drag and drop the cloud computing service descriptions from the left onto the cloud service categories on the right. CISCO 350-201 question

Drag & Drop
6 comments in the community discussion
6
triggers a block of code with event → FaaS, renting VMs → IaaS, app dev/testing → SaaS, virtual env management → PaaS. That's how they're usually mapped even if the SaaS description feels off. Pretty sure this follows exam convention, correct me if I'm missing something.
5
SaaS → focuses on developing, testing, and delivering applications; PaaS → allows hosting and managing a virtual environment; IaaS → allows renting full servers or virtual machines; FaaS → triggers a block of code when triggered by a specific event.I remember seeing a very similar match on practice tests. The d
Q: 20

DRAG DROP Drag and drop the components from the left onto the phases of the CI/CD pipeline on the right. CISCO 350-201 question

Drag & Drop
2 comments in the community discussion
3
Is the question asking for the traditional order of CI/CD pipeline phases, or do we need to match the phases based on a specific Cisco DevSecOps model shown in that linked image? The mapping could change depending on which convention they're testing.
Hmm, I've usually seen it as plan > develop > build > test > deploy > release > operate > monitor. Might be test before build? Not 100% sure if Cisco has a slightly different order but this mapping feels close.
Question 1 of 20

Premium Access Includes

  • ✓Quiz Simulator
  • ✓Exam Mode
  • ✓Progress Tracking
  • ✓Question Saving
  • ✓Flash Cards
  • ✓Drag & Drops
  • ✓3 Months Access
  • ✓PDF Downloads
Get Premium Access

← Back to all Cisco exams & practice tests

Scroll to Top