A company is using a cloud provider's virtual machines. The security team wants to ensure that only authorized personnel can access the VMs. Which control is most effective?

Use network security groups (NSGs) to restrict inbound traffic to specific IPs and ports

Assign a public IP to every VM for easy access

Use the same password for all VMs

Disable the VM's operating system firewall

A security administrator is hardening a Linux server that runs a database. The server is accessible only from the internal network. Which configuration change is most aligned with the principle of least privilege?

Set the database to listen on all interfaces for easier access

Create a dedicated service account with only the permissions required for the database to run

Disable the local firewall because the server is on the internal network

Allow the database service to run as root to avoid permission issues

A security team is hardening a Linux server that runs a legacy application. The application vendor states that it only supports the server if the default SSH configuration is unchanged. However, the security policy requires SSH to be hardened. The team must balance compliance with operational support. Which approach best satisfies both requirements?

Disable SSH entirely and use console access only

Ignore the security policy to maintain vendor support

Apply SSH hardening recommendations but document the deviation and obtain a risk acceptance from management

Apply SSH hardening and do not inform the vendor

A company is using a cloud provider's object storage to store sensitive customer data. Which control is most important to prevent unauthorized access?

Enable encryption at rest and enforce bucket policies that restrict access

Disable versioning to reduce storage costs

Make the bucket public for easy sharing

Use a shared access key for all employees

A healthcare organization must harden its Windows servers that store patient data. The organization is subject to HIPAA and also wants to align with the NIST Cybersecurity Framework. The security team is considering using CIS Benchmarks, DISA STIGs, or Microsoft Security Baselines. The team has limited staff and needs a baseline that is widely recognized and can be automated with common tools. Which approach is most appropriate?

Use DISA STIGs exclusively because they are the most comprehensive

Use Microsoft Security Baselines only, as they are easiest to apply

Use CIS Benchmarks as the primary baseline and automate with tools like Ansible or PowerShell DSC

Create a custom hardening standard from scratch

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 5

2.5 Determine Resources for Industry Standards and Recommendations for Hardening of Systems 350-201 Practice Questions (Page 5)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

30%of the exam

Questions 21–25

21application · medium
A company is using a cloud provider's virtual machines. The security team wants to ensure that only authorized personnel can access the VMs. Which control is most effective?
Select an answer first
22application · medium
A security administrator is hardening a Linux server that runs a database. The server is accessible only from the internal network. Which configuration change is most aligned with the principle of least privilege?
Select an answer first
23expert · hard
A security team is hardening a Linux server that runs a legacy application. The application vendor states that it only supports the server if the default SSH configuration is unchanged. However, the security policy requires SSH to be hardened. The team must balance compliance with operational support. Which approach best satisfies both requirements?
Select an answer first
24application · medium
A company is using a cloud provider's object storage to store sensitive customer data. Which control is most important to prevent unauthorized access?
Select an answer first
25expert · hard
A healthcare organization must harden its Windows servers that store patient data. The organization is subject to HIPAA and also wants to align with the NIST Cybersecurity Framework. The security team is considering using CIS Benchmarks, DISA STIGs, or Microsoft Security Baselines. The team has limited staff and needs a baseline that is widely recognized and can be automated with common tools. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.

2.5 Determine Resources for Industry Standards and Recommendations for Hardening of Systems 350-201 Practice Questions (Page 5)

Questions 21–25

A company is using a cloud provider's virtual machines. The security team wants to ensure that only authorized personnel can access the VMs. Which control is most effective?

A security administrator is hardening a Linux server that runs a database. The server is accessible only from the internal network. Which configuration change is most aligned with the principle of least privilege?

A company is using a cloud provider's object storage to store sensitive customer data. Which control is most important to prevent unauthorized access?

Keep studying — Techniques