Practise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command.
Start Scenario PracticeDrag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.
Explanation: The correct order for basic Cisco ASA configuration is: global configuration mode, interface configuration (nameif, IP address, security-level), ACL creation, ACL application to interface, and verification. This sequence ensures interfaces are ready, ACLs exist before being applied, and verification confirms the policy is active. Common mistakes include creating or applying ACLs before interfaces are configured, or verifying before applying the ACL.
An analyst is investigating a Linux system and wants to view the current network connections. Which command is most appropriate to list listening TCP ports along with the associated processes?
Explanation: The 'ss' command with options -t (TCP), -l (listening), -n (numeric), -p (process) shows listening TCP ports and the corresponding processes.
During a security incident, a network engineer captures traffic with tcpdump and saves it to a pcap file. The analyst needs to extract all HTTP POST requests containing a specific string in the URI. Which command should be used?
Explanation: It uses tcpdump with the `-r` flag to read the pcap file, filters for TCP port 80 (HTTP), uses `-A` to print packet payloads in ASCII, and then pipes the output through two grep commands: first to isolate lines containing 'POST' (indicating HTTP POST requests) and second to filter for the specific string in the URI. This combination efficiently extracts only the relevant HTTP POST requests with the target string from the captured traffic.
A security analyst is investigating an incident where an employee received an email that appeared to be from the company's IT department, requesting the employee to verify their account by clicking a link and entering their credentials. The employee complied, and later the attacker used those credentials to access the corporate VPN. Which combination of attack types best describes this incident?
Explanation: The email is a social engineering technique known as phishing. Since it targeted a specific employee with a tailored message (IT department), it is spear phishing. The attacker then used the credentials to access the VPN, which is a direct use of the stolen information, not a separate attack like MitM.
Refer to the exhibit. An ASA security policy is configured as shown. A user from the internet tries to access 192.168.1.5 via HTTP. What will happen?
Explanation: The ASA security policy shown uses an access control list (ACL) that implicitly denies all traffic unless explicitly permitted. Since the exhibit does not show any ACL entry permitting HTTP traffic from the internet to 192.168.1.5, the traffic is denied by default. The correct answer is B because the ASA's default behavior for inbound traffic on an interface is to deny it unless a matching permit ACE exists.
+10 more scenario questions available
Practice all Which Command Should the Administrator Use Practice QuestionsPractise command-choice questions where the task is to identify the correct verification, configuration or troubleshooting command. These appear throughout the 200-201 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 200-201. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 200-201 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Which Command Should the Administrator Use Practice Questions session with instant scoring and detailed explanations.
Start Scenario Practice →