200-201 Security Monitoring Practice Test 3 — 15 Questions

Question 1

Match each Cisco CyberOps concept to its description.

Question 2

Match each network device to its primary function.

Question 3

A security analyst notices repeated failed login attempts from a single IP address against multiple user accounts. What is the best immediate action to take?

Accepted Answer

Block the source IP address on the firewall.. Blocking the source IP address on the firewall is the best immediate action because it stops the ongoing brute-force attack at the network perimeter, preventing further authentication attempts from that IP without disrupting legitimate users. This aligns with the principle of containment before investigation, as the firewall ACL can be updated quickly to deny traffic from the offending source.

Answer

Increase logging verbosity for the authentication server.

Answer

Change all user passwords immediately.

Answer

Disable the affected user accounts.

Question 4

A company uses Cisco Stealthwatch to monitor network traffic. Which type of data does Stealthwatch primarily rely on for visibility?

Accepted Answer

NetFlow data. Cisco Stealthwatch is designed for network traffic analysis and relies on NetFlow data (including IPFIX and other flow protocols) to provide visibility into network behavior, traffic patterns, and anomalies. Unlike full packet captures, NetFlow metadata (source/destination IP, ports, protocols, byte counts) is lightweight and scalable for monitoring large networks, making it the primary data source for Stealthwatch's behavioral analytics and threat detection.

Answer

SNMP traps

Answer

Full packet captures

Answer

Syslog messages

Question 5

During a security incident, an analyst needs to preserve network evidence for forensic analysis. Which action should be taken first?

Accepted Answer

Capture the contents of volatile memory from affected systems.. During a security incident, the first priority is to capture volatile memory (RAM) because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. Option D is correct because volatile data is ephemeral and must be collected before any action that could alter the system state, such as shutdown or isolation.

Answer

Isolate the affected systems from the network.

Answer

Create a forensic image of all hard drives.

Answer

Shut down the affected systems to prevent further damage.

Question 6

A security monitoring tool generates an alert for a user accessing a sensitive file at an unusual hour. What is the most appropriate next step?

Accepted Answer

Contact the user to confirm if the access was legitimate.. Option B is correct because the alert indicates an anomaly (unusual hour), but not necessarily malicious activity. The most appropriate first step is to verify the user's intent through direct communication, as this aligns with the principle of validation before escalation. In security monitoring, contacting the user helps confirm whether the access was authorized, reducing false positives and unnecessary incident response activation.

Answer

Ignore the alert since it is likely a false positive.

Answer

Escalate the alert to the incident response team.

Answer

Block the user's account immediately.

Question 7

A SOC analyst is tuning a correlation rule that detects DNS tunneling. The rule currently generates 500 alerts per day, but only 5% are true positives. Which tuning approach would best reduce false positives while maintaining detection efficacy?

Accepted Answer

Add a condition that the number of unique domains queried per source IP exceeds 10 per minute.. Option B is correct because adding a threshold for domain query rate per IP reduces noise from normal high-volume DNS activity. Option A is wrong because increasing the time window may increase false positives. Option C is wrong because decreasing entropy threshold may cause more false positives. Option D is wrong because disabling the rule loses detection.

Answer

Lower the entropy threshold for domain names from 3.5 to 2.0.

Answer

Disable the rule and rely on manual review of DNS logs.

Answer

Increase the observation time window from 1 hour to 24 hours.

Question 8

An analyst needs to configure syslog to forward logs from multiple network devices to a central SIEM. Which syslog severity level should be used to ensure security-relevant events are sent while minimizing bandwidth usage?

Accepted Answer

Level 4 (Warning). Option D (Level 4, Warning) is correct because it captures security-relevant events such as authentication failures, configuration changes, and interface errors while filtering out lower-severity informational and debug messages. This balances visibility of potential threats with minimal bandwidth consumption, as Warning-level logs are typically concise and less frequent than lower severity levels.

Answer

Level 0 (Emergency)

Answer

Level 7 (Debug)

Answer

Level 6 (Informational)

Question 9

A company uses Cisco Firepower NGFW with intrusion prevention. An analyst notices that many legitimate HTTPS connections are being blocked by an IPS rule. What is the best approach to reduce false positives?

Accepted Answer

Create a custom rule exception for the specific destination IPs.. Creating a custom rule exception for the specific destination IPs is the best approach because it allows the IPS to continue blocking malicious traffic while exempting legitimate HTTPS connections that are incorrectly flagged. This maintains security posture by not weakening the rule globally, and it directly addresses the false positive without affecting detection of other threats.

Answer

Increase the severity threshold of the rule.

Answer

Disable the IPS rule entirely.

Answer

Change the rule action from 'Drop' to 'Alert'.

Question 10

Which data source provides the most detailed information about the application layer payload in network traffic?

Accepted Answer

Full packet capture (PCAP). Full packet capture (PCAP) provides the most detailed information because it records the entire raw network packet, including headers and the complete application-layer payload. This allows deep inspection of protocols like HTTP, DNS, or SMTP at the byte level, which is essential for detecting malware, data exfiltration, or application-specific anomalies.

Answer

NetFlow

Answer

Syslog

Answer

SNMP

Question 11

A SOC team is evaluating a SIEM rule that triggers on 'more than 10 failed login attempts from a single source within 5 minutes.' The rule is generating too many alerts from a legitimate external monitoring service. How should the rule be modified?

Accepted Answer

Add an exception for the source IP of the monitoring service.. Option C is correct because the rule is generating false positives from a known, legitimate source. Adding an exception for the monitoring service's source IP allows the SIEM to continue detecting actual brute-force attacks while ignoring expected traffic from that specific host. This is a standard whitelisting technique in SIEM rule tuning to reduce noise without compromising security coverage.

Answer

Increase the threshold to 20 failed attempts.

Answer

Disable the rule and rely on other detection methods.

Answer

Extend the time window to 10 minutes.

Question 12

Which TWO of the following are indicators of a potential data exfiltration attempt?

Accepted Answer

An internal host transferring large amounts of data to an unknown external IP at 3 AM.. Option A is correct because data exfiltration often involves transferring large volumes of data to an unknown external IP during off-hours (e.g., 3 AM) to evade detection. This behavior deviates from normal business patterns and is a classic indicator of a data breach or insider threat.

Answer

A user accessing an internal file server during business hours.

Answer

A failed login attempt from an internal workstation.

Answer

A spike in ICMP echo requests from an external IP.

Question 13

Which TWO of the following are best practices for configuring syslog to ensure reliable security event logging?

Accepted Answer

Use TCP (port 514) instead of UDP for log transmission.. Option D is correct because syslog over TCP (port 514) provides reliable, connection-oriented delivery, ensuring that log messages are not lost during transmission. Unlike UDP, TCP includes acknowledgment and retransmission mechanisms, which are critical for security event logging where message integrity and completeness are paramount.

Answer

Use UDP for faster transmission and lower overhead.

Answer

Enable debug-level logging for all devices to capture maximum detail.

Answer

Disable log filtering to ensure all messages are sent.

Question 14

Which THREE of the following are valid techniques to detect a compromised host using network monitoring?

Accepted Answer

Identifying periodic outbound connections to an unknown IP at regular intervals (beaconing).. Option A is correct because beaconing is a classic indicator of a compromised host establishing a command-and-control (C2) channel. The host periodically sends outbound connections to an unknown IP at regular intervals, which is a behavior that network monitoring tools can detect as anomalous traffic patterns, often used by malware to maintain persistence and receive instructions.

Answer

Watching for ICMP echo requests from internal hosts to external hosts.

Answer

Monitoring for high volumes of HTTP traffic to a known CDN.

Question 15

Refer to the exhibit. An analyst sees these syslog messages from the Cisco ASA. What is the most likely cause?

Accepted Answer

An internal host (10.0.0.10) is attempting to access the Internet on port 80 and is being blocked.. The syslog messages show the Cisco ASA denying traffic from internal IP 10.0.0.10 to external destination 203.0.113.5 on TCP port 80. The ASA's access control list (ACL) is configured to block outbound HTTP traffic from this host, which is the most likely cause of the denial. The messages indicate a standard deny action, not a signature-based attack detection.

Answer

An external host attempting to connect to an internal server.

Answer

A denial-of-service attack from the external IP.

Answer

An internal host is performing a port scan of the external server.