Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) practice questions

1. Question 1 of 25

   An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?

   • Asequence numbers
   • BIP identifier
   • C5-tuple
   • Dtimestamps

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   In a security operations center (SOC) environment, one method that could be used to identify a session from a group of logs is the use of a 5-tuple. A 5-tuple consists of five pieces of information that can be used to identify a specific network session: the source IP address, source port, destination IP address, destination port, and protocol. By using this information, an analyst can identify a specific session from a group of logs and track its progress through the system. Other methods that could be used to identify a session from a group of logs include the use of sequence numbers, timestamps, or IP identifiers.

   Adapted from community discussion by Proctored_Expert · 2024-09-26 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. B

      beowolf

      2021-05-02

      7 upvotes

      Read the question, which method? sequence numbers is not a method. Given answer is correct

   2. P

      Proctored_Expert

      2024-09-26

      Selected C4 upvotes

      In a security operations center (SOC) environment, one method that could be used to identify a session from a group of logs is the use of a 5-tuple. A 5-tuple consists of five pieces of information that can be used to identify a specific network session: the source IP address, source port, destination IP address, destination port, and protocol. By using this information, an analyst can identify a specific session from a group of logs and track its progress through the system. Other methods that could be used to identify a session from a group of logs include the use of sequence numbers, timestamps, or IP identifiers.

   3. 0

      036e554

      2024-06-13

      3 upvotes

      The 5-tuple consists of five values: source IP address, source port, destination IP address, destination port and transport protocol. By examining the 5-tuple, analyst can determine the sequence events within a session and identify logs related to the session. Together these five values uniquely identify a network session, by examining these attributes within a log data, an analyst can pinpoint and correlate activities related to a specific session, aiding in incident investigation within a SOC environment.

   4. S

      SecurityGuy

      2022-02-09

      4 upvotes

      A 5-tuple refers to a set of five different values that comprise a Transmission Control Protocol/Internet Protocol (TCP/IP) connection. 1. Layer 4 Protocol 2. Source IP address 3. Destination IP address 4. Source Port Number 5. Destination Source Port Number

2. Question 2 of 25

   Which system monitors local system operation and local network access for violations of a security policy?

   • Ahost-based intrusion detection
   • Bsystems-based sandboxing
   • Chost-based firewall
   • Dantivirus

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   i think that "A.host-based intrusion detection". HIDS is capable of monitoring the internals of a computing system as well as the network packets on its network interfaces. Host-based firewall is a piece of software running on a single Host that can restrict incoming and outgoing Network activity for that host only.

   Adapted from community discussion by Torvalds · 2022-04-12 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. T

      Torvalds

      2022-04-12

      22 upvotes

      i think that "A.host-based intrusion detection". HIDS is capable of monitoring the internals of a computing system as well as the network packets on its network interfaces. Host-based firewall is a piece of software running on a single Host that can restrict incoming and outgoing Network activity for that host only.

   2. A

      anonymous1966

      2022-09-22

      9 upvotes

      "A" is correct. The question is copy and past of Wikipedia definition: An intrusion detection system (IDS)[1] is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms. https://en.wikipedia.org/wiki/Intrusion_detection_system

   3. H

      HarryPotter69

      2022-09-16

      6 upvotes

      Answer is A An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations.

   4. A

      Alannn

      2022-09-15

      4 upvotes

      A host based firewall does not monitor local system operations. A firewall is no more than an ACL matching traffic in and out of a system based on how it's configured. A significant advantage of HIPS is that it can monitor operating system processes. "A HIPS often monitors memory, kernel, and network state, log files, ... protects system integrity by detecting changes to critical operating system files."

3. Question 3 of 25

   An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

   • AThe computer has a HIPS installed on it.
   • BThe computer has a NIPS installed on it.
   • CThe computer has a HIDS installed on it.
   • DThe computer has a NIDS installed on it.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   C. is correct answer The computer has a HIDS installed on it. HIDS ==> Detects only attacks and don't take action or mitigation.

   Adapted from community discussion by Eng_ahmedyoussef · 2024-04-05 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. A

      anonymous1966

      2023-03-05

      17 upvotes

      "C" is correct. Remember: H = host N = network D = detect P = prevent

   2. S

      SecurityGuy

      2024-09-11

      Selected C1 upvote

      Detection - This means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to block anything. Prevention - This means that when the protection system detects a possible security event, it will automatically try to block it. The alert was received on the "desktop computer" which means that the IDS was installed on the host thus the answer is Host-based Intrusion Detection System.

   3. E

      Eng_ahmedyoussef

      2024-04-05

      2 upvotes

      C. is correct answer The computer has a HIDS installed on it. HIDS ==> Detects only attacks and don't take action or mitigation.

   4. W

      weganos

      2024-03-06

      2 upvotes

      Maybe I read the question wrong but shouldn´t it be HIPS? Since it has been prevented and not just detected?

4. Question 4 of 25

   

   Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

   • AA policy violation is active for host 10.10.101.24.
   • BA host on the network is sending a DDoS attack to another inside host.
   • CThere are three active data exfiltration alerts.
   • DA policy violation is active for host 10.201.3.149.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Obviously is "C" "EX" = exfiltration And there are three. Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration

   Adapted from community discussion by anonymous1966 · 2023-09-05 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. S

      s1m0n

      2023-03-17

      24 upvotes

      Believe should be C --> How can a (one) host send a DDoS that should be DoS

   2. A

      anonymous1966

      2023-09-05

      8 upvotes

      Obviously is "C" "EX" = exfiltration And there are three. Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration

   3. Q

      qz999

      2023-08-25

      4 upvotes

      The question requires a single answer, and clearly there are three active exfiltration alerts. So a second choice cannot be made, and as mentioned by s1m0n below, a single host by definition would not be the sole machine in a DDoS attack. Answer choice C is best.

   4. G

      gnuga

      2023-08-04

      2 upvotes

      DDOS attacker should have DS attibute, and it is not there DDoS Source Alarm Category Index: DS Indicates that a host has been identified as the source of a DDoS attack. The following security events are associated with the DDoS Source alarm. https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/management_console/smc_users_guide/SW_6_9_0_SMC_Users_Guide_DV_1_2.pdf page 177. I vote for C.

5. Question 5 of 25

   What is a difference between tampered and untampered disk images?

   • ATampered images have the same stored and computed hash.
   • BUntampered images are deliberately altered to preserve as evidence.
   • CTampered images are used as evidence.
   • DUntampered images are used for forensic investigations.

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   "D" is correct. The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic investigation to determine who and what caused the attack. Additionally, you want to ensure the data that was captured is not tampered with or modified during the creation of a disk image process. Ref: Cisco Certified CyberOps Associate 200-201 Certification Guide By Glen D. Singh

   Adapted from community discussion by anonymous1966 · 2022-09-05 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. A

      anonymous1966

      2022-09-05

      12 upvotes

      "D" is correct. The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic investigation to determine who and what caused the attack. Additionally, you want to ensure the data that was captured is not tampered with or modified during the creation of a disk image process. Ref: Cisco Certified CyberOps Associate 200-201 Certification Guide By Glen D. Singh

   2. I

      ivlis_27

      2022-11-22

      4 upvotes

      your answer is constracting to the question (two differences between untampered and tampered). I think the right answer should be D, why would you use tampered images as evidence? it has been tampered.

   3. T

      Topsecret

      2024-07-09

      2 upvotes

      The correct answer is D. Untampered images are used for forensic investigations. When referring to disk images in the context of digital forensics, a tampered image refers to an image that has been modified or altered in some way, potentially compromising its integrity and reliability as evidence. On the other hand, an untampered image is one that has not been altered and is considered a faithful representation of the original source.

   4. J

      J8Ryan

      2023-06-07

      2 upvotes

      Respuesta B. Yo tengo una imagen de disco, y un atacante me manipula la imagen. La evidencia de que he sufrido un ataque es la imagen manipulada por el atacante, o sea mi imagen manipulada.

6. Question 6 of 25

   During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

   • Aexamination
   • Binvestigation
   • Ccollection
   • Dreporting

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   During the forensic process, data that is related to a specific event is typically labeled and recorded to preserve its integrity during the "collection" phase. This phase involves the gathering and preservation of potential evidence, ensuring that it is properly documented, secured, and maintained to maintain its evidentiary value for later analysis and reporting.

   Adapted from community discussion by AhmedAbdalla · 2024-10-06 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • nist.gov documentation

   View community discussion3

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. A

      AhmedAbdalla

      2024-10-06

      2 upvotes

      During the forensic process, data that is related to a specific event is typically labeled and recorded to preserve its integrity during the "collection" phase. This phase involves the gathering and preservation of potential evidence, ensuring that it is properly documented, secured, and maintained to maintain its evidentiary value for later analysis and reporting.

   2. E

      Eng_ahmedyoussef

      2023-10-05

      Selected C2 upvotes

      C is correct in Collection phase in forensic process ==> specific event labeled and recorded to preserve its integrity.

   3. P

      Pwned

      2022-10-30

      1 upvote

      C is Correct https://csrc.nist.gov/publications/detail/sp/800-86/final

7. Question 7 of 25

   Which step in the incident response process researches an attacking host through logs in a SIEM?

   • Adetection and analysis
   • Bpreparation
   • Ceradication
   • Dcontainment

   Show answer

   Correct answer: A

   How others answered

   • A88%

   Explanation

   The incident response process typically includes the following phases: preparation, detection and analysis, containment, eradication, and recovery. The detection and analysis phase is focused on identifying and assessing the scope and severity of the incident, and this includes analyzing logs and other data to identify the source and nature of the attack.

   Adapted from community discussion by drdecker100 · 2024-08-19 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • nist.gov documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. D

      drdecker100

      2024-08-19

      Selected A8 upvotes

      The incident response process typically includes the following phases: preparation, detection and analysis, containment, eradication, and recovery. The detection and analysis phase is focused on identifying and assessing the scope and severity of the incident, and this includes analyzing logs and other data to identify the source and nature of the attack.

   2. A

      anonymous1966

      2023-03-05

      3 upvotes

      Preparation --> Detection and Analysis --> Containment, Erradicaion and Recovery --> Post-Incident Activity Detection and Analysis --> Profile networks and systems, Understand normal behaviors, Create a log retention policy, Perform event correlation. Maintain and use a knowledge base of information.Use Internet search engines for research. Run packet sniffers to collect additional data. Filter the data. Seek assistance from others. Keep all host clocks synchronized. Know the different types of attacks and attack vectors. Develop processes and procedures to recognize the signs of an incident. Understand the sources of precursors and indicators. Create appropriate incident documentation capabilities and processes. Create processes to effectively prioritize security incidents. Create processes to effectively communicate incident information (internal and external communications). Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

   3. A

      alocin

      2023-04-03

      3 upvotes

      From Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide chapter 8 page 303 The containment, eradication, and recovery phase includes the following activities: ■ Gathering and handling evidence ■ Identifying the attacking hosts ■ Choosing a containment strategy to effectively contain and eradicate the attack, as well as to successfully recover from it

   4. T

      trigger4848

      2024-05-04

      Selected A3 upvotes

      these questions are tricky but the key here " researches an attacking host through logs in a SIEM?" -- This should be done in Detection and Analysis -- A

8. Question 8 of 25

   What is a difference between SOAR and SIEM?

   • ASOAR platforms are used for threat and vulnerability management, but SIEM applications are not
   • BSIEM applications are used for threat and vulnerability management, but SOAR platforms are not
   • CSOAR receives information from a single platform and delivers it to a SIEM
   • DSIEM receives information from a single platform and delivers it to a SOAR

   Show answer

   Correct answer: A

   How others answered

   • A62%
   • D23%
   • B15%

   Only 62% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Platforms based on SIEM (security information and event management) technology offer visibility and meaningful insights by collecting, aggregating, and analyzing information from different sources. An upcoming platform in the security industry is based on SOAR (security orchestration, automation, and response) technology. SOAR platforms are similar to SIEMs in that they aggregate, correlate, and analyze alerts. However, SOAR technology goes a step further by integrating threat intelligence and automating incident investigation and response workflows based on playbooks developed by the security team. Source: https://www.cisco.com/c/en/us/products/security/what-is-a-security-platform.html#~types-of-security-platforms So answer A is correct

   Adapted from community discussion by Leo_Visser · 2021-06-03 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Cisco documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. L

      Leo_Visser

      2021-06-03

      14 upvotes

      Platforms based on SIEM (security information and event management) technology offer visibility and meaningful insights by collecting, aggregating, and analyzing information from different sources. An upcoming platform in the security industry is based on SOAR (security orchestration, automation, and response) technology. SOAR platforms are similar to SIEMs in that they aggregate, correlate, and analyze alerts. However, SOAR technology goes a step further by integrating threat intelligence and automating incident investigation and response workflows based on playbooks developed by the security team. Source: https://www.cisco.com/c/en/us/products/security/what-is-a-security-platform.html#~types-of-security-platforms So answer A is correct

   2. A

      anonymous1966

      2021-09-07

      8 upvotes

      "A" is correct Unlike traditional SIEM platforms, SOAR solutions can also be used for threat and vulnerability management, security incident response, and security operations automation. Example of products: Log collection (SolarWinds Security Event Manager) -----> SIEM (IBM QRadar) -----> SOAR (IBM Resilient)

   3. U

      Uzumaki_Aliyy

      2022-08-05

      Selected A4 upvotes

      Correct Answer is A: SIEM vs SOAR - In short, SIEM aggregates and correlates data from multiple security systems to generate alerts while SOAR acts as the remediation and response. "Note SIEM from multiple security systems"

   4. H

      Hazem1234u

      2023-11-09

      Selected A2 upvotes

      "Unlike traditional SIEM platforms, SOAR solutions can also be used for threat and vulnerability management, security incident response, and security operations automation." This senetence is from the Official CertGuide book. pg 461 in the Tip box

9. Question 9 of 25

   

   Refer to the exhibit. What is depicted in the exhibit?

   • AWindows Event logs
   • BApache logs
   • CIIS logs
   • DUNIX-based syslog

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   https://www.w3schools.com/tags/ref_httpmethods.asp "GET" is an HTTP Method which more inclined to web technologies such as Apache or IIS. HTTP Methods: - GET - POST - PUT - HEAD - DELETE - PATCH - OPTIONS - CONNECT - TRACE IIS Logs Format: https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525807(v=vs.90)

   Adapted from community discussion by SecurityGuy · 2024-02-08 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn

   View community discussion2

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

   1. S

      SecurityGuy

      2024-02-08

      Selected B3 upvotes

      https://www.w3schools.com/tags/ref_httpmethods.asp "GET" is an HTTP Method which more inclined to web technologies such as Apache or IIS. HTTP Methods: - GET - POST - PUT - HEAD - DELETE - PATCH - OPTIONS - CONNECT - TRACE IIS Logs Format: https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525807(v=vs.90)

   2. R

      RoBery

      2024-07-13

      2 upvotes

      (root) means unix based logs as Apache, however it is not syslog.

10. Question 10 of 25

    

    Refer to the exhibit. Which component is identifiable in this exhibit?

    • AWindows Registry hive
    • BTrusted Root Certificate store on the local machine
    • CWindows PowerShell verb
    • Dlocal service in the Windows Services Manager

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Reference: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-hives

    Supporting references

    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. S

       SecurityGuy

       2024-08-14

       Selected A1 upvote

       A hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-hives

    2. A

       AhmedAbdalla

       2024-10-06

       1 upvote

       Windows Registry hive The text "HKEY_LOCAL_MACHINE" refers to a specific Windows Registry hive. The Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. "HKEY_LOCAL_MACHINE" is one of the root keys in the Windows Registry and contains configuration data related to the local machine or computer.

    3. E

       Eng_ahmedyoussef

       2023-10-07

       Selected A1 upvote

       HKEY_LOCAL_MACHINE == > Windows Registry hive So A. is the correct answer

    4. U

       Uzumaki_Aliyy

       2022-12-30

       1 upvote

       A is correct: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-hives https://ldapwiki.com/wiki/HKEY_LOCAL_MACHINE#:~:text=HKEY_LOCAL_MACHINE%20Windows%20registry%20hive%20contains,detected%20hardware%20and%20device%20drivers.

11. Question 11 of 25

    An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?

    • Aonline assault
    • Bprecursor
    • Ctrigger
    • Dinstigator

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    "B" is correct. Precursors is the way the document name the method/event. The documento do not have the other words in the alternatives. 3.2.3 Sources of Precursors and Indicators Precursors and indicators are identified using many different sources, with the most common being computer security software alerts, logs, publicly available information, and people

    Adapted from community discussion by anonymous1966 · 2023-09-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. A

       anonymous1966

       2023-09-05

       4 upvotes

       "B" is correct. Precursors is the way the document name the method/event. The documento do not have the other words in the alternatives. 3.2.3 Sources of Precursors and Indicators Precursors and indicators are identified using many different sources, with the most common being computer security software alerts, logs, publicly available information, and people

    2. E

       eggheadsv

       2023-11-13

       2 upvotes

       A precursor is a sign that a cyber-attack is about to occur on a system or network. An indicator is the actual alerts that are generated as an attack is happening. Therefore, as a security professional, it's important to know where you can find both precursor and indicator sources of information. The following are common sources of precursor and indicator information: Security Information and Event Management (SIEM) Anti-virus and anti-spam software File integrity checking applications/software Logs from various sources (operating systems, devices, and applications) People who report a security incident

    3. E

       Eng_ahmedyoussef

       2024-10-07

       Selected B2 upvotes

       B is Correct A precursor ==> is a sign that a cyber-attack is about to occur on a system or network.

    4. A

       anonymous1966

       2023-09-05

       1 upvote

       https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

12. Question 12 of 25

    Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

    • ACSIRT
    • BPSIRT
    • Cpublic affairs
    • Dmanagement

    Show answer

    Correct answer: D

    Explanation

    https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Management. Management establishes incident response policy, budget, and staffing. Ultimately, management is held responsible for coordinating incident response among various stakeholders, minimizing damage, and reporting to Congress, OMB, the General Accounting Office (GAO), and other parties.

    Adapted from community discussion by Vetterous · 2023-07-15 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion3

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. V

       Vetterous

       2023-07-15

       8 upvotes

       https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Management. Management establishes incident response policy, budget, and staffing. Ultimately, management is held responsible for coordinating incident response among various stakeholders, minimizing damage, and reporting to Congress, OMB, the General Accounting Office (GAO), and other parties.

    2. C

       COLCRISS

       2024-06-10

       1 upvote

       Management. Management establishes incident response policy, budget, and staffing. Ultimately, management is held responsible for coordinating incident response among various stakeholders, minimizing damage, and reporting to Congress, OMB, the General Accounting Office (GAO), and other parties https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

    3. F

       fjcsanchez

       2024-09-19

       1 upvote

       Point 2.4.4., page 17 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

13. Question 13 of 25

    Which incidence response step includes identifying all hosts affected by an attack?

    • Adetection and analysis
    • Bpost-incident activity
    • Cpreparation
    • Dcontainment, eradication, and recovery

    Show answer

    Correct answer: A

    How others answered

    • A71%
    • D29%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Not really... the question is asking about attacked host, not attacking host. Below explanation from examcol is correct: The correct answer is A. detection and analysis. Based on https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 3.2 Detection and Analysis > 3.2.4 Incident Analysis "When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected..."

    Adapted from community discussion by RSA001 · 2022-10-19 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. R

       RSA001

       2022-10-19

       12 upvotes

       Not really... the question is asking about attacked host, not attacking host. Below explanation from examcol is correct: The correct answer is A. detection and analysis. Based on https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 3.2 Detection and Analysis > 3.2.4 Incident Analysis "When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected..."

    2. S

       seriously5000

       2022-05-14

       12 upvotes

       D. Eradication From NIST SP 800-61r2, Section 3.3.4 "During eradication, it is important to identify all affected hosts within the organization so that they can be remediated."

    3. A

       anonymous1966

       2022-03-06

       8 upvotes

       "D" is correct 3.3.3 Identifying the Attacking Hosts During incident handling, system owners and others sometimes want to or need to identify the attacking host or hosts. Although this information can be important, incident handlers should generally stay focused on containment, eradication, and recovery. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

    4. [

       [Removed]

       2022-03-24

       5 upvotes

       The correct answer is A. detection and analysis. Based on https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 3.2 Detection and Analysis > 3.2.4 Incident Analysis "When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected..."

14. Question 14 of 25

    An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide?

    • ARecover from the threat.
    • BAnalyze the threat.
    • CIdentify lessons learned from the threat.
    • DReduce the probability of similar threats.

    Show answer

    Correct answer: A

    How others answered

    • A56%
    • D31%

    Only 56% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. Recover from the threat. B. Analyze the threat. C. Identify lessons learned from the threat. D. Reduce the probability of similar threats. I have just read 800-61r2 and in my opinion the detection and analysis phase is over because the breach has been detected and the threat actor and vector identified. Also, the containment is complete because th engineer removed access, however in the same phase we have "recovery" which has not yet been completed. C & D are both done in the "Post Incident Activity" phase, but as we have not yet recovered from the breach, these cannot be the correct answer. Just my opinion.

    Adapted from community discussion by Entivo · 2023-08-05 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. V

       Vetterous

       2022-07-15

       17 upvotes

       Per: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 3.3.3 Identifying the Attacking Hosts 3.3.4 Eradication and Recovery If it were me, I would select A

    2. T

       tsabee

       2022-10-19

       3 upvotes

       A is correct. According to Official Understanding Cisco Cybersecurity Operations Fundamentals Course It has to get answer below question in those state: Analysis -every question was answered.: Which networks, systems, or applications are affected? -OK Who or what originated the incident? -OK Which tools or attack methods are being used? -OK Which vulnerabilities are being exploited? -OK Containment -some questions were answered, and actually it was made a containment action by removed access: ("Decision points for containment may include:") What is the scope of the incident? -partially OK What is the type of device? -OK What is the network reachability of the device that has been affected by the incident? How quickly can the incident response team get containment in place? - Irrelevant in this situation How quickly is containment needed? - Irrelevant in this situation

    3. E

       Entivo

       2023-08-05

       Selected A3 upvotes

       A. Recover from the threat. B. Analyze the threat. C. Identify lessons learned from the threat. D. Reduce the probability of similar threats. I have just read 800-61r2 and in my opinion the detection and analysis phase is over because the breach has been detected and the threat actor and vector identified. Also, the containment is complete because th engineer removed access, however in the same phase we have "recovery" which has not yet been completed. C & D are both done in the "Post Incident Activity" phase, but as we have not yet recovered from the breach, these cannot be the correct answer. Just my opinion.

    4. F

       Franky4

       2022-12-14

       2 upvotes

       D - Reduce the probability of similar threats, could possibly be categorised under 'Eradication' 800.61r2 states the following for Eradication: "During eradication, it is important to identify all affected hosts within the organization so that they can be remediated." And in the checklist under the Eradication section - Identify and mitigate all vulnerabilities that were exploited - If more affected hosts are discovered (e.g., new malware infections), repeat the Detection and Analysis steps (1.1, 1.2) to identify all other affected hosts, then contain (5) and eradicate (6) the incident for them Assuming the Detection and Analysis phase has been conducted, and none of the answers fall into the Containment category... Answer (D) might be warranted. The 'similar' wording in the question makes it difficult to confirm if the aforementioned threats pertain to the impacted network or 'just in general'

15. Question 15 of 25

    An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?

    • AAnalysis
    • BEradication
    • CDetection
    • DRecovery

    Show answer

    Correct answer: A

    How others answered

    • A79%
    • C21%

    Explanation

    Incident detection and analysis would be easy if every precursor or indicator were guaranteed to be accurate; unfortunately, this is not the case. For example, user-provided indicators such as a complaint of a server being unavailable are often incorrect. Intrusion detection systems may produce false positives—incorrect indicators. These examples demonstrate what makes incident detection and analysis so difficult: each indicator ideally should be evaluated to determine if it is legitimate. Making matters worse, the total number of indicators may be thousands or millions a day. Finding the real security incidents that occurred out of all the indicators can be a daunting task. from guide it says this and then, there's the sentence: ==On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. == for me it's A because it's already detected.

    Adapted from community discussion by ivlis_27 · 2021-11-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. C

       CiscoTerminator

       2021-12-01

       Selected A8 upvotes

       This has already been detected - next step is to analyse the incident.

    2. I

       ivlis_27

       2021-11-22

       2 upvotes

       Incident detection and analysis would be easy if every precursor or indicator were guaranteed to be accurate; unfortunately, this is not the case. For example, user-provided indicators such as a complaint of a server being unavailable are often incorrect. Intrusion detection systems may produce false positives—incorrect indicators. These examples demonstrate what makes incident detection and analysis so difficult: each indicator ideally should be evaluated to determine if it is legitimate. Making matters worse, the total number of indicators may be thousands or millions a day. Finding the real security incidents that occurred out of all the indicators can be a daunting task. from guide it says this and then, there's the sentence: ==On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. == for me it's A because it's already detected.

    3. I

       ivlis_27

       2021-11-22

       2 upvotes

       An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation? supported by the question, i think it's already happened and it's already detected. So the next step is analysis. because detection is done, if the first sentence isn't part of the question, i would say DETECTION because the engineer only noticed a disabled antivirus, but there's already a proof from the first sentence of "a degraded processing capability" so the next step to be done is not detection again but began documenting the incident which is analysis

    4. D

       d503c75

       2024-09-15

       1 upvote

       C is the correct answer. After that, we can move to analysis... When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring (e.g., what tools or attack methods are being used, what vulnerabilities are being exploited). The initial analysis should provide enough information for the team to prioritize subsequent activities, such as containment of the incident and deeper analysis of the effects of the incident. Source: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

16. Question 16 of 25

    An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, `File: Clean.` Which regex must the analyst import?

    • AFile: Clean (.*)
    • B^Parent File: Clean$
    • CFile: Clean
    • D^File: Clean$

    Show answer

    Correct answer: C

    How others answered

    • C63%
    • D25%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C is the only possible answer because it can extract/parse both the words even if they are between other characters (as we can commonly find in a log file) D is wrong because it only matches if the log fields are separated by a "line feed" or "carriage return" (\n or \r in regex), which is quite rare to find in common logs

    Adapted from community discussion by Max_DeJaV · 2024-03-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. M

       Max_DeJaV

       2024-03-05

       Selected C4 upvotes

       C is the only possible answer because it can extract/parse both the words even if they are between other characters (as we can commonly find in a log file) D is wrong because it only matches if the log fields are separated by a "line feed" or "carriage return" (\n or \r in regex), which is quite rare to find in common logs

    2. R

       RoBery

       2024-07-17

       2 upvotes

       from chatgpt: The correct regex for capturing the phrase "File: Clean." is: C. File: Clean This regex simply matches the literal string "File: Clean" without any additional characters or assertions. If you want to capture the entire line containing "File: Clean.", including any characters that might come after it, you should use option D: D. ^File: Clean$

    3. A

       AhmedAbdalla

       2024-04-06

       2 upvotes

       To capture the phrase "File: Clean" from a Cisco device using regex in a SIEM platform, the analyst should use: ^File: Clean$ This regex pattern matches the exact string "File: Clean" with ^ indicating the start of the line and $ indicating the end of the line, ensuring an exact match. So, the correct answer is ^File: Clean$.

    4. E

       ethhacker

       2024-02-29

       3 upvotes

       Would be more like: ^File: Clean\.$ As the \ marks the dot (.) as mandatory

17. Question 17 of 25

    Which attack method intercepts traffic on a switched network?

    • Adenial of service
    • BARP cache poisoning
    • CDHCP snooping
    • Dcommand and control

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Correct answer: B. ARP cache poisoning DHCP snooping is a counter measure against attack. wiki: In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

    Adapted from community discussion by skysoft · 2021-12-10 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. S

       skysoft

       2021-12-10

       30 upvotes

       Correct answer: B. ARP cache poisoning DHCP snooping is a counter measure against attack. wiki: In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

    2. H

       HarryPotter69

       2022-09-12

       3 upvotes

       Answer is B, They talk about intercepting of the traffic. An ARP spoofing, also known as ARP poisoning, is a Man in the Middle (MitM) attack that allows attackers to intercept communication between network devices. ... The two devices update their ARP cache entries and from that point onwards, communicate with the attacker instead of directly with each other. DHCP Snooping prevents unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients. The DHCP Snooping feature performs the following activities: Validates DHCP messages from untrusted sources and filters out invalid messages

    3. D

       drdecker100

       2024-02-17

       Selected B1 upvote

       The attack method that intercepts traffic on a switched network is ARP cache poisoning, which is also known as ARP spoofing or ARP poisoning. In a switched network, each device maintains an ARP cache that maps IP addresses to MAC addresses. When a device needs to communicate with another device on the same network, it looks up the MAC address in its ARP cache and uses that address to send the packet. In an ARP cache poisoning attack, the attacker sends fake ARP messages to other devices on the network, claiming to be the owner of a particular IP address. This causes the other devices to update their ARP caches with the attacker's MAC address instead of the actual owner's MAC address. As a result, all traffic intended for the owner of that IP address is instead sent to the attacker, who can intercept and manipulate the traffic.

    4. F

       fejec

       2022-09-07

       4 upvotes

       from cert guide - Chapter 4: ARP Cache Poisoning Threat actors can attack hosts, switches, and routers connected to your Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting traffic intended for other hosts on the subnet.

18. Question 18 of 25

    What is a description of "phishing" as a social engineering attack?

    • AFake Social Security Administration personnel contact random individuals, inform them that there has been a computer problem on their end, and ask that those individuals confirm their Social Security Number, all for the purpose of committing identity theft.
    • BA hacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link.
    • CThe attacker focuses on creating a good pretext, or a fabricated scenario, that is used to try and steal victims' personal information.
    • DSomeone without the proper authentication follows an authenticated employee into a restricted area. The attacker might impersonate a delivery driver and wait outside a building to get things started.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    This answer accurately describes the basic principle of a phishing attack as a social engineering attack. Phishing attacks typically involve the attacker posing as a trustworthy entity, such as a bank, government agency, or well-known company, to trick the victim into revealing sensitive information, such as login credentials, financial information, or personal details. The attacker achieves this by sending an email or message with a link that appears to be legitimate, but in fact leads to a fake website designed to steal the victim's information. In this way, phishing attacks can be used to steal sensitive information and commit fraud or identity theft.

    Adapted from community discussion by drdecker100 · 2024-02-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion3

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. D

       drdecker100

       2024-02-08

       Selected B4 upvotes

       This answer accurately describes the basic principle of a phishing attack as a social engineering attack. Phishing attacks typically involve the attacker posing as a trustworthy entity, such as a bank, government agency, or well-known company, to trick the victim into revealing sensitive information, such as login credentials, financial information, or personal details. The attacker achieves this by sending an email or message with a link that appears to be legitimate, but in fact leads to a fake website designed to steal the victim's information. In this way, phishing attacks can be used to steal sensitive information and commit fraud or identity theft.

    2. S

       sheyshey

       2024-12-06

       Selected B1 upvote

       answer is B, why? because A is "vishing" like they mentioned down on the comment section

    3. M

       macxwhale

       2024-07-07

       1 upvote

       NIST 800-86 Page 5-3 describes free space at https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf

19. Question 19 of 25

    Select 2

    According to the NIST SP 800-86, which two types of data are considered volatile? (Choose two.)

    • Atemporary files
    • Blogin sessions
    • Cswap files
    • Ddump files
    • Efree space

    Show answer

    Correct answer: B, E

    How others answered

    • BE65%
    • AC18%
    • BC18%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    That might be true but the question asks what the "NIST SP 800-86" is reffering to. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf Search for '5.1.2 Volatile Data' the right answers would be: Slack Space Free Space Network Configuration Network Connections Running Processes Open Files Login Sessions Operating System Time

    Adapted from community discussion by weganos · 2023-06-30 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation
    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. W

       weganos

       2023-06-30

       9 upvotes

       That might be true but the question asks what the "NIST SP 800-86" is reffering to. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf Search for '5.1.2 Volatile Data' the right answers would be: Slack Space Free Space Network Configuration Network Connections Running Processes Open Files Login Sessions Operating System Time

    2. B

       blackmetal

       2023-11-17

       3 upvotes

       "volatile data" does refer to information stored in memory that is lost when the system is powered off or rebooted. The correct answers are: B. Login sessions - Login sessions are created and stored in memory while a user is actively logged in. They are considered volatile because they are lost when the system is shut down or restarted. C. Swap files - Swap files are used by the operating system to temporarily store data from RAM when the physical memory is full. They are also considered volatile because they exist in memory and are lost when the system is powered off or rebooted.

    3. A

       alhamry

       2023-10-30

       1 upvote

       In the context of digital forensics, "volatile data" refers to information that is stored in memory and is lost when the system is powered off or rebooted. Temporary files (option A) are typically stored on disk, and although they may be deleted after use, they are not considered volatile because they can be recovered during the forensic investigation. Free space (option E) refers to the unused space on a disk. While it may contain remnants of deleted files, it is not considered volatile because it is not stored in memory and is not lost when the system is rebooted. Dump files (option D) are not considered volatile data because they are created when the system crashes or an application fails, and they are typically stored on disk. On the other hand, login sessions and swap files are considered volatile data because they are created and stored in memory, and they are lost when the system is shut down or restarted. Therefore, B (login sessions) and C (swap files) are the correct answers.

    4. S

       SecurityGuy

       2024-02-21

       Selected B, E2 upvotes

       Comment from weganos nailed this question. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf

20. Question 20 of 25

    A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this situation?

    • Athe intellectual property that was stolen
    • Bthe defense contractor who stored the intellectual property
    • Cthe method used to conduct the attack
    • Dthe foreign government that conducted the attack

    Show answer

    Correct answer: D

    How others answered

    • D53%
    • C47%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think is C. the method used to conduct the attack The entity that takes advantage of the vulnerability is known as the malicious actor, and the path used by this actor to perform the attack is known as the threat agent or threat vector. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter1: Cybersecurity Fundamentals Author: Omar Santos

    Adapted from community discussion by jlmadvig · 2021-04-26 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. J

       jlmadvig

       2021-04-26

       21 upvotes

       I think is C. the method used to conduct the attack The entity that takes advantage of the vulnerability is known as the malicious actor, and the path used by this actor to perform the attack is known as the threat agent or threat vector. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter1: Cybersecurity Fundamentals Author: Omar Santos

    2. L

       Leo_Visser

       2021-06-04

       12 upvotes

       Threat agent and Threat actor are the same (see https://itlaw.wikia.org/wiki/Threat_agent) And the threat actor is the organization/person performing the attack. (https://orangematter.solarwinds.com/2018/07/18/cybersecurity-fundamentals-threat-and-attack-terminology/) So D is the correct answer

    3. D

       Dunky

       2021-05-19

       7 upvotes

       Examples of threat agents are malicious hackers, organized crime, insiders (including system administrators and developers), terrorists, and nation states. [a]n individual, group, organization, or government that conducts or has the intent to conduct detrimental activities.

    4. C

       CyberGrog

       2025-03-16

       Selected D1 upvote

       The correct answer is: D. the foreign government that conducted the attack Explanation: A threat agent is an entity responsible for carrying out an attack or exploiting vulnerabilities. In this scenario, the foreign government is the actor responsible for orchestrating the attack and stealing the intellectual property. Here’s why the other options are incorrect: • A. the intellectual property that was stolen: This is the target or asset, not the threat agent. • B. the defense contractor who stored the intellectual property: This is the victim or entity impacted by the attack, not the agent causing it. • C. the method used to conduct the attack: This refers to the attack vector or technique, not the entity executing the attack. The threat agent is always the actor or group initiating the malicious activity—in this case, the foreign government.

21. Question 21 of 25

    Which metric is used to capture the level of access needed to launch a successful attack?

    • Aprivileges required
    • Buser interaction
    • Cattack complexity
    • Dattack vector

    Show answer

    Correct answer: A

    How others answered

    • A54%
    • D46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    i Think is "D. attack vector". Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter7: Introduction to Security Operations Management. Author: Omar Santos

    Adapted from community discussion by Torvalds · 2021-04-09 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • cisco.com documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. T

       Torvalds

       2021-04-09

       23 upvotes

       i Think is "D. attack vector". Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter7: Introduction to Security Operations Management. Author: Omar Santos

    2. L

       Leo_Visser

       2021-06-04

       12 upvotes

       According to cisco: https://tools.cisco.com/security/center/resources/understanding-terminology.html#exploitability The attack vector metric describes the shortest distance from the attacker to the target. So the privileges required are something else. So A is correct.

    3. A

       alocin

       2021-10-05

       11 upvotes

       According with OFFICIAL Cert Guide Cisco O.Santos, correct is D. According with tool.cisco.com terminology, correct is A. Good question ... for me, my opinon, the question means not vector but privileges. Free interpretation .

    4. A

       anonymous1966

       2021-09-07

       4 upvotes

       "D" is Correct Exploitability metrics: Attack Vector (AV) represents the level of access an attacker needs to have to exploit a vulnerability. Network (N), Adjacent (A), Local (L), Physical (P) Attack Complexity (AC) represents the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Low (L), High (H) Privileges Required (PR) represents the level of privileges an attacker must have to exploit the vulnerability. None (N), Low (L), High (H) User Interaction (UI) captures whether a user interaction is needed to perform an attack. None (N), Required (R) Scope (S) captures the impact on systems other than the system being scored. Unchanged (U), Changed (C) Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide By Omar Santos

22. Question 22 of 25

    When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

    • Afragmentation
    • Bpivoting
    • Cencryption
    • Dstenography

    Show answer

    Correct answer: C

    How others answered

    • C59%
    • A23%
    • D18%

    Only 59% agreed on this answer — treat it as contested rather than settled.

    Explanation

    By the Book, I believe Fragmentation would be correct. Traditional IDS and IPS devices also suffer from many evasion attacks. The following are some of the most common evasion techniques against traditional IDS and IPS devices: Fragmentation: Attackers can evade the IPS box by sending fragmented packets. Using low-bandwidth attacks: Attackers can use techniques that use low-bandwidth or a very small number of packets to evade the system. Address spoofing/proxying: Attackers can use spoofed IP addresses or sources, as well as intermediary systems such as proxies to evade inspection. Pattern change evasion: Attackers may use polymorphic techniques to create unique attack patterns. Encryption: Attackers can use encryption to hide their communication and information.

    Adapted from community discussion by anonymous1966 · 2021-09-03 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. E

       evra

       2021-04-17

       22 upvotes

       It is A https://en.wikipedia.org/wiki/Intrusion_detection_system_evasion_techniques

    2. A

       anonymous1966

       2021-09-03

       11 upvotes

       By the Book, I believe Fragmentation would be correct. Traditional IDS and IPS devices also suffer from many evasion attacks. The following are some of the most common evasion techniques against traditional IDS and IPS devices: Fragmentation: Attackers can evade the IPS box by sending fragmented packets. Using low-bandwidth attacks: Attackers can use techniques that use low-bandwidth or a very small number of packets to evade the system. Address spoofing/proxying: Attackers can use spoofed IP addresses or sources, as well as intermediary systems such as proxies to evade inspection. Pattern change evasion: Attackers may use polymorphic techniques to create unique attack patterns. Encryption: Attackers can use encryption to hide their communication and information.

    3. J

       JoJanathan

       2021-03-31

       6 upvotes

       I believe its C https://techdifferences.com/difference-between-steganography-and-cryptography.html#:~:text=The%20steganography%20and%20cryptography%20are,the%20structure%20of%20the%20message.

    4. D

       Dunky

       2021-05-04

       6 upvotes

       The answer says Stenography which is basically shorthand and totally different from steganography or do we think it's just a typo?

23. Question 23 of 25

    What is the difference between the rule-based detection when compared to behavioral detection?

    • ARule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature.
    • BRule-Based systems have established patterns that do not change with new data, while behavioral changes.
    • CBehavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags potentially abnormal patterns using signatures.
    • DBehavioral systems find sequences that match a particular attack signature, while Rule-Based identifies potential attacks.

    Show answer

    Correct answer: B

    How others answered

    • B45%
    • C27%
    • D27%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Isn't the correct answer B, it says it has a predefined collection of paterns which it uses to detect the attack but as far as I know the Behavioral Detection keeps analysing the network and changes the baseline accordingly. Here (https://www.cisco.com/c/en/us/products/security/what-is-network-detection-response.html) it says "NDR solutions continuously monitor and analyze raw enterprise network traffic to generate a baseline of normal network behavior." So that would suggest that answer B is more correct because C would suggest that after the baseline is generated it doesn't change at all anymore. It also says this in the stealthwatch documentation "After the initial 7 days, Stealthwatch tracks 14 key attributes to create a rolling 28-day baseline. This baseline is the average of the daily attribute values for the past 28 days, heavily weighted for the last 7 days. Since the baseline incorporates the last seven days, these are used to represent weekly values. Therefore, the baseline includes values for the previous month, but is heavily weighted to the most recent week. " So I would really say B is the right answer.

    Adapted from community discussion by Leo_Visser · 2022-01-01 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Cisco documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. L

       Leo_Visser

       2022-01-01

       26 upvotes

       Isn't the correct answer B, it says it has a predefined collection of paterns which it uses to detect the attack but as far as I know the Behavioral Detection keeps analysing the network and changes the baseline accordingly. Here (https://www.cisco.com/c/en/us/products/security/what-is-network-detection-response.html) it says "NDR solutions continuously monitor and analyze raw enterprise network traffic to generate a baseline of normal network behavior." So that would suggest that answer B is more correct because C would suggest that after the baseline is generated it doesn't change at all anymore. It also says this in the stealthwatch documentation "After the initial 7 days, Stealthwatch tracks 14 key attributes to create a rolling 28-day baseline. This baseline is the average of the daily attribute values for the past 28 days, heavily weighted for the last 7 days. Since the baseline incorporates the last seven days, these are used to represent weekly values. Therefore, the baseline includes values for the previous month, but is heavily weighted to the most recent week. " So I would really say B is the right answer.

    2. A

       anonymous1966

       2022-03-08

       15 upvotes

       For me "B" is correct. In a behavioral model, the focus is on user or application behavior and not on a specific attack pattern. The goal is to distinguish between malicious and nonmalicious behaviors. The promise of such systems is great: Theoretically, this type of solution can deal with all attacks, both known and unknown. Moreover, it promises to free the user from having to keep the system updated, since there is no use of attack signatures. A signature is actually a fingerprint of a given attack. The signature captures the actions, which are unique to a given attack. This pragmatic approach is focused on specific attacks and is very accurate at lowering the rate of false positives. ref: https://www.computerworld.com/article/2581345/behavioral-rules-vs--signatures--which-should-you-use-.html

    3. B

       beowolf

       2021-11-03

       17 upvotes

       Behavioral is not signature based detection. Correct answer is C An IDS when placed inline it will become an IPS, initially the IDS will analyze user data for sometime to understand the pattern so it can determine what is normal / abnormal in the network, based on this it will create a baseline.

    4. A

       alhamry

       2023-11-06

       4 upvotes

       The best answer is "B. Rule-Based systems have established patterns that do not change with new data, while behavioral changes." Rule-based detection and behavioral detection are two different approaches used in intrusion detection and prevention systems. Rule-based detection involves searching for specific patterns that are linked to known types of attacks. These patterns are represented as signatures, and the system checks incoming data against these signatures to detect potential attacks. Rule-based systems have established patterns that do not change with new data. Therefore, they may be less effective at detecting new or unknown attacks that do not match the established patterns. Behavioral detection, on the other hand, involves monitoring system behavior and identifying anomalies that may indicate an attack. It uses machine learning algorithms to analyze normal patterns of system behavior and detect deviations from those patterns. Behavioral systems are designed to adapt and learn from new data and can detect new or unknown attacks that do not match established patterns.

24. Question 24 of 25

    Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

    • Adecision making
    • Brapid response
    • Cdata mining
    • Ddue diligence

    Show answer

    Correct answer: D

    How others answered

    • D83%
    • A17%

    Explanation

    Due diligence is the process of gathering and analyzing all relevant information before making a decision or taking action. In the context of security incidents, due diligence involves gathering and analyzing all available information about the incident, such as the nature of the threat, the extent of the damage or potential damage, and the possible impact on the organization's operations and assets. This information is then used to determine the appropriate course of action, such as containing and mitigating the threat, restoring systems and data, and identifying and addressing any underlying vulnerabilities

    Adapted from community discussion by EVL87 · 2024-09-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. E

       EVL87

       2024-09-26

       Selected D3 upvotes

       Due diligence is the process of gathering and analyzing all relevant information before making a decision or taking action. In the context of security incidents, due diligence involves gathering and analyzing all available information about the incident, such as the nature of the threat, the extent of the damage or potential damage, and the possible impact on the organization's operations and assets. This information is then used to determine the appropriate course of action, such as containing and mitigating the threat, restoring systems and data, and identifying and addressing any underlying vulnerabilities

    2. V

       vvadas

       2024-09-26

       2 upvotes

       A. decision making When an analyst gathers information relevant to a security incident, their primary goal is to make informed decisions on how to proceed with the incident response. They need to assess the available data, understand the nature and severity of the incident, evaluate potential risks, and then decide on the appropriate course of action to contain, mitigate, and remediate the situation effectively. "D. due diligence" is a broader concept that generally refers to the effort taken by a responsible party to avoid harm or potential risks to others. While due diligence is a critical part of the overall incident response process, the specific act of gathering information to determine the appropriate course of action more closely aligns with decision making (Option A) in this context.

    3. D

       drdecker100

       2024-09-26

       Selected D2 upvotes

       The correct answer is D. Due diligence. Due diligence refers to the level of care and caution that is expected of individuals and organizations in order to protect themselves and others. In the context of security incidents, due diligence requires that analysts gather all relevant information about an incident in order to make informed decisions about the appropriate course of action. This involves carefully reviewing logs, network traffic, and other data sources to determine the scope and nature of the incident, and to identify any indicators of compromise.

    4. P

       Proctored_Expert

       2024-09-26

       Selected D2 upvotes

       The principle being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action is due diligence. Due diligence refers to the careful and thorough investigation and analysis of a particular situation or problem in order to make informed decisions or take appropriate action. In the context of security incidents, this may involve gathering and analyzing relevant data, studying the potential impact of the incident, and determining the most appropriate response based on the circumstances.

25. Question 25 of 25

    What causes events on a Windows system to show Event Code 4625 in the log messages?

    • AThe system detected an XSS attack
    • BSomeone is trying a brute force attack on the network
    • CAnother device is gaining root access to the system
    • DA privileged user successfully logged into the system

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    "B" is correct 4625(F): An account failed to log on. Event Description: This event generates if an account logon attempt failed when the account was already locked out. It also generates for a logon attempt after which the account was locked out. It generates on the computer where logon attempt was made, for example, if logon attempt was made on user’s workstation, then event will be logged on this workstation. This event generates on domain controllers, member servers, and workstations. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

    Adapted from community discussion by anonymous1966 · 2023-09-05 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion3

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 200-201 or CertExamHQ.

    1. E

       Eng_ahmedyoussef

       2024-10-05

       Selected B5 upvotes

       B is correct answer Event ID 4625 (viewed in Windows Event Viewer) documents every failed attempt at logging on to a local computer. This event is generated on the computer from where the logon attempt was made. so attacker my use brute force attack tools to gain access.

    2. A

       anonymous1966

       2023-09-05

       4 upvotes

       "B" is correct 4625(F): An account failed to log on. Event Description: This event generates if an account logon attempt failed when the account was already locked out. It also generates for a logon attempt after which the account was locked out. It generates on the computer where logon attempt was made, for example, if logon attempt was made on user’s workstation, then event will be logged on this workstation. This event generates on domain controllers, member servers, and workstations. https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

    3. R

       RolandoFiee

       2024-01-22

       2 upvotes

       This event is generated when a logon request fails. It is generated on the computer where access was attempted. The Subject fields indicate the account on the local system which requested the logon. https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625#:~:text=Examples%20of%204625&text=Failure%20Reason%3A%20Unknown%20user%20name%20or%20bad%20password.&text=This%20event%20is%20generated%20when,system%20which%20requested%20the%20logon.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 1 of 25