200-201 Matching — 10 Questions

Question 1

Match each Cisco CyberOps concept to its description.

Accepted Answer

IoC: Evidence that suggests a potential security incident or intrusion.. The correct matches are: IoC = evidence of intrusion, SIEM = log aggregation and analysis system, IPS = traffic monitoring and blocking device. Common confusions include swapping definitions between similar-sounding terms or confusing tools with indicators.

Answer

IoC: A system that aggregates logs for analysis.

Answer

SIEM: Evidence of compromise.

Answer

IPS: A device that translates private IP addresses to public.

Question 2

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. Standard well-known port assignments: HTTP=80, HTTPS=443, SSH=22, DNS=53. Common confusions include swapping HTTP/HTTPS ports or confusing SSH with Telnet.

Answer

HTTP: 443

Answer

SSH: 23

Question 3

Match each security tool to its primary purpose.

Accepted Answer

SIEM: Provides centralized log management and correlation for threat detection.. These are common security tools used in operations. SIEM centralizes logs, IDS/IPS monitors traffic, firewall filters, and antivirus protects endpoints.

Answer

SIEM: Monitors network traffic for malicious activity and can block/prevent intrusions.

Answer

Firewall: Provides centralized log management and correlation for threat detection.

Question 4

Match each Linux command to its function.

Accepted Answer

ls: List directory contents. These commands are essential for Linux system administration and security analysis.

Answer

chmod: Display current running processes

Answer

ps: Change file permissions

Question 5

Match each Windows event log type to its description.

Accepted Answer

Application: Records events generated by software programs.. In Windows Event Viewer, the main logs are Application (software events), Security (audit events), Setup (installation events), System (system component events), and Forwarded Events (remote logs). Common confusions include mixing Application and System logs, or Security with Setup.

Answer

Application: Logs events related to system hardware failures.

Answer

Security: Logs application installation events.

Question 6

Match each network device to its primary function.

Accepted Answer

Firewall: Filters network traffic based on security rules. The correct matches are: Firewall filters traffic, IDS alerts on suspicious traffic, IPS blocks malicious traffic, and Router forwards packets between networks. Common confusions involve swapping firewall and IDS/IPS functions.

Answer

Firewall: Monitors traffic and provides alerts

Answer

IDS: Filters traffic based on security rules

Question 7

Match each network attack type to its description.

Accepted Answer

Phishing: A social engineering attack where attackers trick users into revealing sensitive information by impersonating a legitimate entity.. Common attack types: Phishing is a social engineering attack, DDoS is a volumetric attack, Man-in-the-Middle intercepts communications, and SQL Injection targets databases. Distractors confuse Phishing with DDoS and SQL Injection with Man-in-the-Middle.

Answer

Phishing: An attack that overwhelms a target server with traffic from multiple sources to disrupt services.

Answer

SQL Injection: An attack where the attacker intercepts communication between two parties to eavesdrop or alter data.

Question 8

Match each log severity level to its description (syslog).

Accepted Answer

Emergency: System is unusable. Syslog severity levels are from 0 (Emergency) to 7 (Debug). Emergency, Alert, Critical, Error, Warning, Notice, Informational, and Debug are standard levels. Common confusions involve swapping levels with similar descriptions.

Answer

Critical: Warning conditions

Answer

Warning: Critical conditions

Question 9

Match each analysis type to its description.

Accepted Answer

Behavioral Analysis: Compares activities against baselines to identify threats.. In cybersecurity, analysis types differ: behavioral compares against baselines, signature-based uses known patterns, anomaly-based detects deviations, and heuristic uses rules. Common confusions arise from swapping definitions between these types.

Answer

Behavioral Analysis: Uses static signatures to identify malware.

Answer

Signature-Based Analysis: Identifies unknown threats by machine learning.

Question 10

Match each cybersecurity framework/standard to its focus.

Accepted Answer

NIST Cybersecurity Framework: Focuses on improving cybersecurity for critical infrastructure.. Correct matches: NIST CSF for critical infrastructure, ISO 27001 for ISMS, PCI DSS for cardholder data, CIS Controls for prioritized security actions. Common confusions include swapping these terms.

Answer

NIST Cybersecurity Framework: Focuses on a prioritized set of security actions.

Answer

ISO/IEC 27001: Focuses on protection of cardholder data.