Cisco Certification
61 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Cisco CBROPS CyberOps Associate (200-201) certification validates professional expertise in Cisco technologies. This study guide covers all 61 practice questions from our 200-201 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
Which of the following best describes the primary purpose of security baseline configuration?
Security baselines define the minimum security standards and controls that systems must meet. They provide a foundation for consistent security implementation across an organization.
A security analyst is reviewing network logs and observes repeated failed login attempts followed by successful authentication using a different username. Which attack is most likely occurring?
Credential stuffing involves using previously compromised username and password pairs to gain unauthorized access. The pattern of failed attempts followed by success with different credentials is characteristic of this attack.
When analyzing a suspicious executable file, which tool would be most appropriate to identify its behavior without executing it on a production system?
Static malware analysis examines file characteristics, code structure, and signatures without executing the file, making it safe for initial investigation of suspicious executables.
Which of the following represents a key difference between symmetric and asymmetric encryption?
Symmetric encryption uses a single shared secret key for both encryption and decryption, while asymmetric encryption uses a public key for encryption and a private key for decryption.
A security operations center (SOC) is implementing a new SIEM solution. What is the primary benefit of log aggregation in this context?
Log aggregation centralizes data from disparate sources, enabling analysts to correlate events across systems and detect sophisticated attacks that may not be visible in individual logs.
Which vulnerability assessment approach examines the target system from the perspective of an attacker without prior knowledge of the internal architecture?
Black-box testing simulates an external attacker with no knowledge of the target system's internal structure, configurations, or architecture, providing an attacker's perspective on vulnerabilities.
An analyst observes that a host is attempting to connect to multiple IP addresses on port 445 with no established connections. Which characteristic of network traffic best describes this behavior?
Port scanning involves systematically probing multiple hosts on a specific port to identify active services. The pattern of connection attempts to multiple IPs on port 445 without established connections is typical of scanning activity.
Which of the following best explains why data classification is important to an organization's security posture?
Data classification enables organizations to apply appropriate security controls based on data sensitivity levels and helps prioritize response efforts when incidents occur.
When investigating a potential insider threat, which type of evidence would be most valuable in determining data access patterns?
Access logs and authentication records provide direct evidence of which users accessed specific resources and when, making them essential for investigating insider threats and data access patterns.
A system experiences a sudden increase in CPU utilization without corresponding user activity increases. Which of the following is the MOST likely cause?
Unexplained CPU spikes without corresponding legitimate activity often indicate malware or unauthorized processes running. This is a common indicator of compromise that requires immediate investigation.
Which security control is most effective at preventing privilege escalation attacks?
Least privilege restricts user and application permissions to minimum necessary levels, directly preventing attackers from escalating privileges beyond what legitimate accounts require.
During incident response, what is the primary purpose of creating a forensic image of a compromised system?
Forensic imaging preserves evidence by capturing a bit-for-bit copy of the system state for detailed investigation while allowing the original system to be cleaned and restored to service.
Which of the following best describes the relationship between threat intelligence and threat hunting?
Threat intelligence provides indicators of compromise, TTPs, and attack patterns that guide threat hunting activities, helping analysts search for specific threats within their environment.
An organization detects a vulnerability in a critical system that cannot be immediately patched due to operational requirements. Which compensating control would be most appropriate?
Network segmentation and access restrictions serve as compensating controls by limiting an attacker's ability to reach and exploit the vulnerable system while a permanent fix is pending.
Which of the following log sources would be MOST useful in detecting a brute force attack against a domain controller?
Windows Security Event ID 4625 specifically logs failed authentication attempts. A sudden increase in these events from a single source indicates a brute force attack against the domain controller.
When implementing a security incident response plan, which phase should include preservation of evidence and containment of the threat?
The Containment, Eradication, and Recovery phase focuses on stopping the attack, preserving evidence for investigation, isolating affected systems, and removing the threat.
A security analyst discovers that a web application is vulnerable to reflected XSS attacks. Which remediation approach would provide the strongest protection?
Output encoding ensures user input is treated as data rather than executable code, and CSP headers restrict script execution, together providing defense-in-depth against XSS attacks.
Which of the following best describes the purpose of a threat model?
Threat modeling systematically identifies potential threats, attack vectors, and vulnerabilities for a specific asset or system to inform security controls and risk mitigation strategies.
An analyst is reviewing DNS query logs and notices a large volume of requests to random subdomains of a legitimate external domain. What technique is most likely being employed?
Encoding data in DNS queries to random subdomains is a common technique for covert data exfiltration (DNS tunneling), as DNS traffic is often allowed through firewalls and less scrutinized than other protocols.
Which of the following represents the greatest security risk when implementing cloud services?
A primary cloud security concern is that organizations lose direct physical control of infrastructure while retaining responsibility for securing their data and maintaining compliance with regulations.
During a security assessment, an analyst identifies that a critical application logs authentication events but does not log authorization failures or privilege violations. What is the security implication?
Without logging authorization failures and privilege violations, attackers can attempt to access resources beyond their permissions without leaving detectable traces, hindering incident detection and investigation.
Which MITRE ATT&CK framework component is most useful for understanding the tactical approach and tools used by a specific threat actor?
ATT&CK Techniques document the specific tactics and technical methods used by adversaries across the attack lifecycle, helping defenders understand attacker capabilities and tradecraft.
A security team is implementing endpoint detection and response (EDR) tools. Which capability is essential for detecting fileless malware attacks?
Fileless malware executes entirely in memory without writing to disk, so behavioral analysis and memory monitoring are essential for detecting these attacks since traditional file-based signatures are ineffective.
Which encryption protocol should be prioritized for all external network communications to ensure confidentiality and integrity?
TLS 1.2 and higher provide robust encryption for confidentiality and integrity verification of data in transit. Earlier protocols like WEP and SSHv1 have known vulnerabilities and should be avoided.
During incident response, an analyst discovers that a compromised account was used to access a database containing personally identifiable information (PII). What should be the analyst's immediate priority?
Determining the scope of compromise and initiating notification procedures is essential for compliance with regulations like GDPR and CCPA, and for protecting potentially affected individuals.
Which of the following best describes the primary purpose of security information and event management (SIEM)?
SIEM systems aggregate and analyze security data from various sources to detect patterns, anomalies, and potential threats in real-time.
What is the primary difference between a false positive and a false negative in the context of intrusion detection systems?
False positives create noise and alert fatigue, while false negatives allow actual threats to bypass detection—both are critical concerns for security operations.
Which of the following log sources would be MOST valuable for detecting lateral movement within a network?
Windows Event Logs contain logon events (Event ID 4624), failed logons (4625), and process creation logs that reveal suspicious authentication patterns and movement across systems.
What is the primary function of a network tap in a SOC environment?
Network taps provide out-of-band visibility by duplicating traffic streams to analysis tools without introducing latency or affecting the actual network path.
Which MITRE ATT&CK framework tactic describes an adversary's attempt to move from one compromised system to another within a network?
The Lateral Movement tactic encompasses techniques used by attackers to move through an environment after initial compromise, such as pass-the-hash or exploitation of trust relationships.
When analyzing a suspicious process, which of the following indicators would MOST strongly suggest malicious activity?
Legitimate processes behave predictably with expected parent-child relationships and file paths; obfuscation, unusual hierarchy, and suspicious locations are indicators of compromise.
What is the primary advantage of using threat intelligence feeds in a SOC?
Threat intelligence feeds enable SOC analysts to identify indicators of compromise by matching internal traffic and logs against known-bad indicators from external sources.
In the context of cybersecurity, what does the term 'pivot' refer to?
Pivoting is a lateral movement technique where an attacker leverages an initially compromised host to gain access to additional systems and expand their foothold.
Which of the following is the BEST example of a behavioral-based detection approach rather than signature-based detection?
Behavioral detection looks for anomalous patterns in user and system activity regardless of whether signatures match, making it effective against new and unknown threats.
What is the primary purpose of protocol analysis in network security monitoring?
Protocol analysis examines how applications use network protocols, enabling detection of command-and-control communications, data exfiltration, and protocol-based exploits.
Which of the following best describes the purpose of network segmentation in reducing cybersecurity risk?
Segmentation creates network boundaries that contain breach impact and force attackers to overcome additional controls to move laterally, increasing detection opportunities.
In incident response, what is the primary objective of the 'containment' phase?
Containment aims to stop the attack's progression and isolate affected systems to prevent additional compromise while maintaining evidence for investigation.
Which log aggregation challenge would MOST directly impact a SOC analyst's ability to detect threats in real-time?
High log volumes without adequate processing capacity create processing backlogs, preventing timely detection and allowing attackers to operate undetected during the delay.
What is the primary function of an endpoint detection and response (EDR) solution?
EDR tools provide visibility into endpoint behavior, enable threat hunting, and support rapid response through process termination and isolation capabilities.
When analyzing DNS query logs, which of the following patterns would MOST likely indicate data exfiltration via DNS tunneling?
DNS tunneling encodes data in DNS queries and responses using random subdomains and abnormal query patterns; the high frequency and large response sizes are telltale indicators.
Which of the following is the BEST justification for implementing rate limiting on network resources?
Rate limiting constrains the number of requests from sources, preventing resource exhaustion and providing early warning of volumetric attacks.
In the MITRE ATT&CK framework, what does the 'Exfiltration' tactic encompass?
The Exfiltration tactic includes methods such as using legitimate tools, compression, encryption, and alternative protocols to move data from a network to external locations.
Which of the following indicators in firewall logs would BEST suggest a potential command-and-control (C2) communication attempt?
C2 beaconing shows regular patterns of outbound traffic to uncommon ports and geographic locations; the combination of periodic timing, unusual ports, and rare destinations is highly suspicious.
What is the primary purpose of threat modeling in the context of security operations?
Threat modeling helps organizations understand their adversaries' likely tactics, techniques, and procedures, enabling prioritization of defenses and security monitoring.
When reviewing authentication logs, which of the following patterns would MOST strongly indicate a password spray attack?
Password spray distributes attempts across many accounts to avoid lockout thresholds, making the pattern of few failures per account but many accounts compromised the key indicator.
Which of the following best describes the relationship between indicators of compromise (IOCs) and indicators of attack (IOAs)?
IOCs identify confirmed artifacts of compromise (like hashes or IPs), while IOAs detect suspicious behaviors and techniques that may indicate an active attack before data is stolen.
What is the primary advantage of using a centralized logging infrastructure in a security operations center?
Centralized logging allows analysts to correlate timestamps and events across systems, revealing attack chains and sophisticated threats that span multiple infrastructure components.
In the context of malware analysis, what is the primary difference between static and dynamic analysis?
Static analysis identifies capabilities and structure through code review; dynamic analysis reveals actual runtime behavior including evasion techniques and network communications.
Which of the following best explains why monitoring outbound traffic is often as critical as monitoring inbound traffic in a SOC?
Attackers typically establish persistence and exfiltrate data through outbound connections; monitoring only inbound traffic would miss these critical phases of the attack lifecycle.
What does the term 'dwell time' refer to in the context of incident response and threat detection?
Dwell time is a critical metric representing the gap between compromise and detection; shorter dwell time indicates more effective detection capabilities and reduces exposure to attacks.
When investigating a potential breach, which of the following would be the MOST appropriate first step to preserve evidence integrity?
Proper evidence preservation requires documenting system state, calculating file hashes, and creating forensic images before any modifications to maintain chain of custody and evidentiary value.
Which of the following best describes the purpose of network segmentation in a security operations environment?
Network segmentation isolates critical assets and limits the spread of threats by compartmentalizing the network, reducing lateral movement opportunities for attackers.
In the context of security incident response, what is the primary objective of the containment phase?
Containment aims to halt the attack's spread and prevent further compromise of systems while preserving evidence for investigation.
Which log source would be most valuable for detecting a lateral movement attack within an internal network?
Windows Event Logs capture authentication events and process execution, while NetFlow provides visibility into internal traffic patterns, both essential for detecting lateral movement.
What is the main advantage of using a Security Information and Event Management (SIEM) system in a SOC?
A SIEM centralizes log collection from diverse sources, correlates events to identify suspicious patterns, and scales threat detection capabilities across the organization.
Which indicator of compromise (IoC) would be most difficult to spoof or change by an attacker?
File hashes are cryptographic signatures of specific file content; attackers cannot change them without creating a different file, making them highly reliable IoCs.
In a zero-trust security model, what is the core principle that differs from traditional network security?
Zero-trust assumes no implicit trust based on network location and requires continuous verification of identity and device posture for all access requests.
Which of the following is the best practice for managing alert fatigue in a Security Operations Center?
Effective alert fatigue management involves tuning detection logic, establishing normal behavior baselines, and correlating events to surface meaningful, actionable alerts.
What is the primary purpose of conducting a threat hunt in a security operations environment?
Threat hunting involves actively searching for signs of compromise and attacker behavior that may have bypassed existing detection systems, improving overall security posture.
Which of the following best describes the relationship between MITRE ATT&CK and threat intelligence in a SOC?
MITRE ATT&CK serves as a comprehensive framework for understanding adversary behaviors, allowing SOC teams to align detection rules and threat intelligence with real-world attack patterns.
In the context of data exfiltration detection, which of the following methods would be most effective for identifying unusual outbound data transfers?
Network flow analysis (NetFlow/sFlow) provides visibility into volume, timing, and destinations of outbound traffic, enabling detection of unusual data transfers that may indicate exfiltration.
You've reviewed all 61 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free