Cisco CyberOps Associate 200-201 practice test

A security analyst observes repeated failed login attempts to an internal web server from multiple external IP addresses. The analyst creates a correlation rule that triggers an alert if more than 10 failed logins occur from a single source IP within 5 minutes. After deploying the rule, the analyst finds that the rule generates false positives from legitimate users who mistype passwords. Which action should the analyst take to reduce false positives while maintaining detection effectiveness?

Trap 1: Whitelist all external IP addresses that belong to business…

Whitelisting external IPs could exclude malicious IPs and reduce visibility.

Trap 2: Reduce the time window to 2 minutes to catch attacks faster.

Reducing the window would increase false positives as legitimate mistypes might occur within 2 minutes.

Trap 3: Change the rule to block the source IP after 5 failed attempts.

Blocking after 5 failures would still trigger on legitimate mistypes and may block users.

A
Whitelist all external IP addresses that belong to business partners.
Why wrong: Whitelisting external IPs could exclude malicious IPs and reduce visibility.
B
Reduce the time window to 2 minutes to catch attacks faster.
Why wrong: Reducing the window would increase false positives as legitimate mistypes might occur within 2 minutes.
C
Change the rule to block the source IP after 5 failed attempts.
Why wrong: Blocking after 5 failures would still trigger on legitimate mistypes and may block users.
D
Increase the threshold to 15 failed logins within a 10-minute window.
Higher threshold and longer window reduce false positives from occasional mistypes while still detecting sustained attacks.

Question 2mediummultiple choice

A security analyst is investigating a host that is suspected of being used as a pivot point in a network intrusion. The analyst needs to identify which process initiated an outbound connection to a known malicious IP address. Which host-based analysis approach should the analyst use to correlate the network connection to the specific process?

Trap 1: Examine the Windows Firewall log to see the source and destination…

Firewall logs show network traffic but do not identify the process that initiated it.

Trap 2: Review Windows Security Event Log for Event ID 4688 (Process…

Event ID 4688 shows process creation events but does not directly link them to network connections.

Trap 3: Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP…

Get-NetTCPConnection provides connection details but lacks the owning process information without additional options.

A
Run 'netstat -b' on the Windows host to display active connections with the associated process executable.
The -b flag shows the binary involved in creating each connection, directly correlating the connection to the process.
B
Examine the Windows Firewall log to see the source and destination IP addresses and ports for outbound traffic.
Why wrong: Firewall logs show network traffic but do not identify the process that initiated it.
C
Review Windows Security Event Log for Event ID 4688 (Process Creation) for the timeline of process starts.
Why wrong: Event ID 4688 shows process creation events but does not directly link them to network connections.
D
Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP connections and their states.
Why wrong: Get-NetTCPConnection provides connection details but lacks the owning process information without additional options.

Question 3easymulti select

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Trap 1: A low level of network utilization on the target server

DoS attacks increase utilization, not decrease.

Trap 2: A gradual increase in traffic from multiple geographic locations

This may be normal traffic growth or a marketing campaign.

Trap 3: A high number of DNS queries from diverse source IPs

This could be a DDoS, but the question asks for DoS (single source).

A
A low level of network utilization on the target server
Why wrong: DoS attacks increase utilization, not decrease.
B
A gradual increase in traffic from multiple geographic locations
Why wrong: This may be normal traffic growth or a marketing campaign.
C
A high number of DNS queries from diverse source IPs
Why wrong: This could be a DDoS, but the question asks for DoS (single source).
D
A sudden increase in traffic from a single source IP address
This indicates a potential DoS attack from that IP.
E
A large number of incomplete TCP connections (SYN packets without ACK)
This is characteristic of a SYN flood DoS attack.

Study the full ACL explanation →

Question 4mediummultiple choice

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Exhibit

Refer to the exhibit.

! Output from show access-list 101
! Extended IP access list 101
!    10 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 443
!    20 deny ip any any log
!

Trap 1: The ACL is applied inbound on the outside interface, which could…

The exhibit does not indicate the direction; it just shows the ACL content.

Trap 2: The permit statement does not have logging enabled, so traffic is…

Logging on permit is optional; the issue is the deny log.

Trap 3: The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on…

It only permits port 443, not all ports.

A
The deny statement with logging may generate excessive logs, potentially masking attacks.
Excessive logging can bury important alerts in noise.
B
The ACL is applied inbound on the outside interface, which could allow external traffic.
Why wrong: The exhibit does not indicate the direction; it just shows the ACL content.
C
The permit statement does not have logging enabled, so traffic is not monitored.
Why wrong: Logging on permit is optional; the issue is the deny log.
D
The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.
Why wrong: It only permits port 443, not all ports.

Question 5mediummulti select

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Trap 1: High bandwidth usage during business hours

High bandwidth can be legitimate, e.g., video streaming or backups.

Trap 2: A single failed login attempt from an internal user

One failed login is normal; it does not indicate an intrusion.

Trap 3: Regular ICMP echo requests to external hosts

ICMP echo requests are common for network troubleshooting.

A
High bandwidth usage during business hours
Why wrong: High bandwidth can be legitimate, e.g., video streaming or backups.
B
A single failed login attempt from an internal user
Why wrong: One failed login is normal; it does not indicate an intrusion.
C
Regular ICMP echo requests to external hosts
Why wrong: ICMP echo requests are common for network troubleshooting.
D
A sudden increase in DNS queries to unknown domains from a single host
This could indicate malware beaconing or DNS tunneling.
E
Multiple outbound connections from a server to an external IP on port 445
Port 445 is SMB; outbound SMB from a server may indicate data exfiltration.

Question 6mediummultiple choice

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Exhibit

Refer to the exhibit.

Mar  1 10:15:22 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49152) -> 10.0.0.1(23), 1 packet
Mar  1 10:15:23 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49153) -> 10.0.0.1(23), 1 packet
Mar  1 10:15:24 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49154) -> 10.0.0.1(23), 1 packet

Trap 1: DNS amplification attack

DNS amplification uses UDP port 53, not TCP port 23.

Trap 2: ARP spoofing

ARP spoofing involves ARP packets, not TCP log entries.

Trap 3: ICMP flood attack

ICMP flood would generate ICMP packets, not TCP connections to port 23.

A
DNS amplification attack
Why wrong: DNS amplification uses UDP port 53, not TCP port 23.
B
ARP spoofing
Why wrong: ARP spoofing involves ARP packets, not TCP log entries.
C
Brute force attempt on Telnet service
Multiple connection attempts to port 23 (Telnet) from the same source indicate a brute force or scanning activity.
D
ICMP flood attack
Why wrong: ICMP flood would generate ICMP packets, not TCP connections to port 23.