Cisco · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
15% of exam · 6 sample questions below
During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?
Preparation
Preparation is the first phase where the IR plan, team, and tools are established and exercised.
Post-Incident Activity
Detection and Analysis
Containment, Eradication, and Recovery
A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?
Initiate the legal hold process to preserve evidence
Contain the threat by blocking the IP address on the firewall
Escalate the alert to Tier 2 for deeper investigation
Perform initial triage to determine the severity and validity
Initial triage is the first step in Detection and Analysis to verify the alert and prioritize.
An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?
Contacting legal counsel before proceeding
Documenting the chain of custody for all evidence
Chain of custody documentation is essential for legal proceedings to prove evidence integrity.
Creating a forensic image of the affected hard drive
Isolating the server from the network
Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?
HR
Legal counsel
Incident handler
CISO
The CISO is accountable for security strategy and decisions affecting business impact.
An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?
Acceptable Use Policy (AUP)
AUP defines what constitutes acceptable use of company assets, including internet browsing.
Remote access policy
Information security policy
Password policy
During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?
Accept the risk because the mitigation cost is higher than the ALE
Avoid the risk by discontinuing the activity
Transfer the risk by purchasing cyber insurance
Mitigate the risk by implementing the control
Since the mitigation cost is less than the ALE, it is cost-effective to mitigate.
Want more Security Policies and Procedures practice?
Practice this domain25% of exam · 6 sample questions below
An analyst is monitoring network traffic and observes a large number of TCP SYN packets sent to a single host on various ports with no corresponding SYN-ACK replies. This behavior is most indicative of which type of attack?
ARP spoofing
DNS amplification attack
ICMP flood attack
SYN flood attack
The scenario matches a SYN flood: many SYN packets, no SYN-ACK replies, indicating resource exhaustion.
A security engineer is setting up a Snort rule to detect FTP traffic where the source IP is not from the internal network. Which Snort rule header correctly specifies the action, protocol, source, and destination?
alert tcp !$HOME_NET any -> any 21
The ! negation operator excludes the internal network, focusing on external sources.
alert tcp $HOME_NET any -> any 21
alert tcp any any -> any 21
alert udp any any -> any 21
During a security incident, a SOC analyst reviews NetFlow records and notices a single internal host communicating with a remote server on TCP port 443, sending 50 MB of data in 5 minutes, while the usual baseline for that host is 1 MB per hour. Which type of activity is most likely indicated?
Denial of service attack
Port scan activity
Data exfiltration
Unusually high outbound data volume, especially to a single external IP, is a strong indicator of data theft.
Normal web browsing traffic
An analyst is examining a firewall log entry: '2023-10-25 14:30:00 ACTION=DENY SRC=10.0.0.5 DST=203.0.113.50 PROTO=TCP SPT=445 DPT=445'. Which statement best describes this event?
An internal host attempted to establish an SMB connection to an external IP and was blocked.
The source is internal (10.0.0.5), destination external (203.0.113.50), and traffic was denied. This could be an outbound SMB connection attempt.
A DNS query was made from an internal host to an external server.
An external host attempted to access an internal SMB server on port 445 and was blocked.
An internal host successfully connected to an external server on port 445.
While analyzing a PCAP file in Wireshark, an analyst sees multiple GET requests to /login.php with different usernames in the URL parameters, all from the same source IP: 192.168.1.100 to 10.0.0.1. The HTTP response codes are mostly 200 OK. This pattern suggests which attack?
SQL injection
Cross-site scripting (XSS)
Brute force attack
Multiple login attempts from one IP with varying usernames is typical of credential brute forcing.
Directory traversal
A SOC analyst needs to create a SIEM correlation rule to detect a brute force attack against SSH on a server. Which of the following would be the most effective rule logic?
Alert when a single failed SSH login occurs.
Alert when more than 10 failed SSH logins from the same source IP occur within 1 minute.
This threshold is a common indicator of automated brute force attempts.
Alert when successful SSH logins occur outside business hours.
Alert when multiple failed SSH logins from various IPs occur in one hour.
Want more Security Monitoring practice?
Practice this domain20% of exam · 6 sample questions below
During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?
Reconnaissance
SYN scan is a reconnaissance activity to identify open ports and services.
Delivery
Weaponization
Exploitation
An analyst reviewing network alerts notices a rule triggered for 'ET SCAN NMAP -sU scan' based on traffic to a Linux server. The packet capture shows multiple UDP packets to various ports, and for closed ports, the server responds with ICMP Destination Unreachable (Port Unreachable). Which type of scan is being performed, and how should the analyst classify this alert?
TCP SYN scan; true positive
UDP scan; true positive
The UDP scan is correctly detected by the alert, so it is a true positive.
UDP scan; false positive
TCP connect scan; true negative
A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?
GET /login?user=admin&pass=password123
GET /search?q=<script>alert('XSS')</script>
GET /products?id=1 UNION SELECT * FROM users
The UNION SELECT statement is a SQL injection technique to extract data from other tables.
GET /index.html HTTP/1.1
An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?
DNS tunnelling for C2 communication
Encoded data in subdomains with regular intervals is typical of DNS tunnelling for command and control.
DNS amplification attack
Normal DNS resolution for a dynamic DNS service
DNS cache poisoning attempt
During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?
Installation
Actions on Objectives
Delivery
The file was delivered over the network, so it is in the delivery phase.
Weaponization
An analyst is investigating lateral movement and observes SMB authentication attempts from host A to multiple other hosts using NTLM authentication with a hash value instead of a password. Which attack technique is most likely being used?
Pass-the-hash attack
Using NTLM hashes for authentication across multiple hosts is pass-the-hash.
Brute force attack
Kerberos golden ticket attack
SMB relay attack
Want more Network Intrusion Analysis practice?
Practice this domain20% of exam · 6 sample questions below
An analyst is investigating a Windows host suspected of malware persistence. Which registry key is commonly used by malware to run a program every time a user logs in, located under both HKLM and HKCU?
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
This is a correct Run key for the current user.
HKLM\SYSTEM\CurrentControlSet\Services
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
During an incident response on a Linux server, an analyst runs 'ps aux' and notices a process named 'cryptominer' with high CPU usage. The process PPID is 1. Which tool would best help the analyst examine the parent-child relationship and find how the process was started?
pstree
pstree displays the process tree including PPID relationships.
netstat
lsof
crontab -l
A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the MZ header (4D 5A). The file's entropy is calculated as 7.8. What does the high entropy most likely indicate?
The file is a legitimate signed binary
The file is likely packed or obfuscated
High entropy is indicative of packing/encryption.
The file is corrupted
The file contains mostly plain text strings
An analyst uses Volatility to analyze a memory dump from a compromised Windows machine. Which Volatility command would show the list of running processes along with their parent process IDs?
volatility -f mem.dmp pslist
volatility -f mem.dmp malfind
volatility -f mem.dmp pstree
pstree shows the process tree with PPID.
volatility -f mem.dmp netscan
A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?
/var/log/kern.log
/var/log/auth.log
auth.log is the standard authentication log.
/var/log/messages
/var/log/syslog
A Windows Event Log shows Event ID 4625 multiple times from the same source IP address. What type of activity does this indicate?
Failed logon attempts indicating a possible brute-force attack
4625 is failed logon; multiple from same source is suspicious.
Successful logon after multiple attempts
Credential validation by a domain controller
A user account was created
Want more Host-Based Analysis practice?
Practice this domainWhich element of the CIA triad is primarily concerned with preventing unauthorized access to data?
Non-repudiation
Integrity
Confidentiality
Confidentiality prevents unauthorized disclosure of information.
Availability
A security analyst discovers that a malicious actor is using a technique to gather information about employees by searching social media sites. Which type of attack is being performed?
Active reconnaissance
Passive reconnaissance
Passive reconnaissance collects information without directly engaging the target.
Denial of Service
Social engineering
Which of the following best describes a vulnerability?
A weakness in a system that could be exploited
Exactly.
The act of taking advantage of a weakness
The likelihood that a threat will exploit a weakness
A potential event that could cause harm
An organization experiences a ransomware attack where files are encrypted and a ransom is demanded. Which element of the CIA triad is most directly impacted?
Availability
Ransomware prevents access to data, impacting availability.
Integrity
Non-repudiation
Confidentiality
A security analyst is examining a log file and notices that the hash value of a configuration file does not match the expected value. Which security goal has been violated?
Integrity
Hash verification is used to check integrity.
Confidentiality
Non-repudiation
Availability
Which of the following is an example of a symmetric encryption algorithm?
SHA-256
RSA
AES
AES is a widely used symmetric cipher.
ECC
Want more Security Concepts practice?
Practice this domainThe 200-201 exam has 95 questions and must be completed in 120 minutes. Cisco passing scores vary by exam version and are not always publicly listed. Check the official Cisco exam page before booking.
CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.
The exam covers 5 domains: Security Policies and Procedures, Security Monitoring, Network Intrusion Analysis, Host-Based Analysis, Security Concepts. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco 200-201 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.