Cybersecurity operations is the practice of continuously monitoring an organisation’s digital environment to detect, analyse, and respond to security threats before they cause damage. For someone studying the Cisco CyberOps Associate 200-201 exam, understanding the roles and responsibilities of a cybersecurity analyst is the foundation upon which every other concept rests — without this, you cannot interpret alerts, prioritise incidents, or communicate effectively during a breach.
Jump to a section
A simple way to picture Introduction to Cybersecurity Operations
A security guard’s daily logbook is the central record of every event during a shift.
The guard starts each shift by noting the time and checking which doors are locked. Throughout the night, they record every person entering the building, every alarm that sounds, and every strange noise they investigate. A package arrives at 2AM — the guard logs the courier’s ID, the time, and where the package was left. When the morning shift starts, the next guard reads the entire logbook to understand what happened overnight. If a theft occurred at 1:30AM, the logbook becomes the primary evidence trail. The guard’s job is not just to write things down — it is to notice which entries are suspicious. A delivery at 3AM from a company that never delivers at night? That is a red flag. A door that was locked at 10PM but found open at midnight? That is an anomaly.
In cybersecurity operations, the security guard is the Security Operations Center (SOC) analyst. The logbook is the aggregate of logs from firewalls, servers, and endpoints. The analyst’s skill is not just reading logs — it is recognising which events are normal and which signal a cyber attack. The logbook never lies, but it can be enormous. The analyst must triage events the same way a guard prioritises a smashed window over a forgotten coffee cup.
Cybersecurity operations is the organised process of protecting an organisation’s computers, networks, and data from attack by constantly watching for suspicious activity. It is not a single tool or one person’s job — it is a team effort that happens in a dedicated facility called a Security Operations Center (SOC). The SOC functions like a hospital emergency room for cyber threats: analysts triage incoming alerts, determine which are real emergencies, and escalate the most dangerous ones to incident responders.
The central figure in the SOC is the cybersecurity analyst. This person is responsible for monitoring security alerts generated by various security tools, analysing network traffic, logs, and system events to identify potential threats, and taking initial steps to contain problems. The 200-201 exam expects you to know exactly what this role entails and how it fits into the larger security team.
Let us break down the key responsibilities:
Monitoring and alert triage: The analyst watches dashboards that display alerts from intrusion detection systems (IDS), firewalls, antivirus software, and endpoint detection and response (EDR) tools. An alert is simply a notification that something unusual happened — a user logged in at 3AM, a file downloaded from a suspicious website, or a connection attempt to a known malicious IP address. The analyst must quickly decide whether each alert is a true positive (a real attack), a false positive (a harmless event that looks dangerous), or a false negative (a real attack that the tool missed). This decision requires experience and context.
Log analysis: Logs are records of events generated by computers, servers, routers, and applications. They contain timestamps, IP addresses, usernames, and actions taken. The analyst reviews logs to piece together what happened before, during, and after a security incident. For example, if a server crashes, the analyst checks the system logs to see if the crash was preceded by unusual network traffic or unauthorised login attempts.
Escalation and incident response: When the analyst confirms a genuine security incident — such as malware infection, unauthorised access, or data exfiltration — they escalate the issue to the incident response (IR) team. The IR team then takes deeper investigative and containment actions, such as isolating affected systems, preserving forensic evidence, and notifying stakeholders.
Threat intelligence gathering: Analysts consume threat intelligence feeds — reports about current attack methods, known malicious IP addresses, and vulnerabilities being exploited in the wild. This information helps them tune detection rules and prioritise high-risk alerts.
Reporting and communication: Analysts document every investigation. They write shift reports summarising the alerts handled, actions taken, and unresolved issues. They may also brief security managers on the organisation’s current threat posture.
Why does this role exist? Before dedicated SOCs existed, organisations relied on individual IT staff to handle security as a side task — a network administrator might check logs once a week. This reactive approach failed because attacks happen at any hour and advanced threats require constant vigilance. The cybersecurity analyst role was created to provide 24/7 monitoring and rapid response, reducing the time attackers have to move laterally through a network.
The 200-201 exam distinguishes between tiers of analysts. A Tier 1 analyst performs the initial triage — they receive alerts, verify them, and escalate. A Tier 2 analyst investigates deeper, analyses patterns, and contains threats. A Tier 3 analyst is an expert who reverse-engineers malware and performs advanced forensics. The exam focuses mainly on Tier 1 responsibilities, because that is the entry-level role most candidates will start in.
In summary, the cybersecurity analyst is the watchful human element that makes security tools effective. No tool replaces the analyst’s judgment about which alerts matter, what context is important, and when to sound the alarm.
Alert Reception and Acknowledgement
When a security tool generates an alert, it appears on the analyst’s SIEM dashboard. The analyst acknowledges the alert to indicate they are aware of it. This prevents multiple analysts from working on the same event simultaneously.
Alert Triage and Classification
The analyst examines the alert details — timestamp, source IP, destination, user account, and type of event. They use knowledge of normal network behaviour and threat intelligence to decide if the alert is a true positive, false positive, or false negative. This step prevents wasting resources on harmless events.
Verification Through Log Analysis
The analyst reviews relevant logs from source systems. For example, if the alert is about a failed login, they check the authentication server’s logs to see how many attempts occurred and from where. This confirms whether the alert accurately reflects a real event.
Escalation or Closure
If the alert is a confirmed true positive, the analyst escalates it to Tier 2 or the incident response team with a detailed summary of findings. If it is a false positive, the analyst marks it as such in the SIEM and may add a note to help tune the detection rule. If it is a false negative (a real attack not caught by tools), the analyst reports it to improve detection.
Documentation and Shift Handover
The analyst records every action taken, decisions made, and unresolved issues in the shift report. At the end of their shift, they brief the next analyst on current threats and ongoing investigations. This ensures continuity and prevents critical information from being lost.
Imagine you are the sole cybersecurity analyst at a mid-sized logistics company with 500 employees. You arrive at 8AM and take over from the night shift analyst. Before you even sit down, the previous analyst briefs you on three unresolved alerts: an employee in finance logged into the payroll system from a hotel in Brazil at 3AM local time; a server in the warehouse sent 2GB of data to an IP address in Eastern Europe; and ten employees reported that their email accounts sent spam while they were asleep.
You start your shift by reviewing these cases in the SIEM (Security Information and Event Management) system — the central dashboard that collects logs from all security tools. Your first task is triage: you decide which case is most urgent. The finance employee logging in from Brazil is suspicious but could be someone travelling. You check the employee’s travel schedule — no authorised trip to Brazil. You escalate this to Tier 2. The server sending data to Eastern Europe matches a known indicator of compromise (IOC) from yesterday’s threat intelligence feed — this is likely data exfiltration. You immediately isolate the server by working with the network team to block its outbound traffic. The spam emails from ten accounts suggest a password compromise — you force password resets and check the accounts’ sent folder for malicious emails.
During the rest of your shift, you perform these actions:
Monitor the SIEM dashboard for new alerts and acknowledge each one. You mark false positives — such as an alert for a failed login attempt that was just a user forgetting their password — with a note so the system can learn.
Review the day’s vulnerability scan results from the vulnerability management tool. You see critical vulnerabilities on three web servers — the IT team is notified to apply patches.
Investigate a phishing email that an employee forwarded to the security team. You check the email headers, confirm the sender’s domain is misspelled (for example, “paypa1.com” instead of “paypal.com”), and block the domain at the email gateway.
Prepare an end-of-shift report summarising every significant event, including the Brazil login, the data exfiltration, and the phishing attempt. You note which incidents remain open for the next shift.
Attend a 15-minute stand-up meeting with the SOC team to discuss current threats: this week’s top alert type is ransomware phishing attachments disguised as invoices.
This scenario shows that the analyst’s daily work is a constant cycle of prioritising, investigating, containing, and documenting. No two days are identical, but the core responsibilities remain the same: filter out noise, identify real threats, and move fast to minimise damage.
The 200-201 exam devotes a significant portion of its content to the cybersecurity analyst’s role. Objective 1.1 specifically asks you to “Describe the roles and responsibilities of a cybersecurity analyst.” The exam expects you to know exactly what an analyst does, where they fit in the organisational structure, and how they collaborate with other teams.
Here is what the exam tests directly:
SOC tiers: You must know the difference between Tier 1, Tier 2, and Tier 3 analysts. Tier 1 is the initial triage and front-line response. Tier 2 investigates and contains. Tier 3 performs advanced analysis and forensics. The exam loves to present a scenario and ask which tier would handle it. Trap: they might describe a task like “analysing malware code” and ask you to identify the tier — the answer is Tier 3, not Tier 1.
Alert types: You must distinguish between true positive, false positive, true negative, and false negative. A true positive is when an alert correctly identifies malicious activity. A false positive is when an alert fires for benign activity. A true negative is when no alert fires for benign activity. A false negative is when no alert fires for malicious activity — this is the most dangerous category. Exam questions will present a situation and ask you to classify it.
Incident response phases: The exam integrates the analyst’s role into the incident response process. You must know that the analyst performs detection and analysis, then escalates for containment, eradication, and recovery. Do not confuse the analyst’s responsibilities with those of the IR team — the analyst typically does not perform the final containment steps.
Log sources: You will be tested on which logs an analyst typically reviews. Examples include authentication logs from Active Directory, firewall logs, web proxy logs, and operating system event logs. A common trap question asks where to look for evidence of a specific attack — the answer varies by attack type (for example, brute force attempts are in authentication logs).
Communication and reporting: The exam expects you to know that analysts write shift reports, communicate with the next shift during handover, and document actions taken. Questions may ask about the difference between an incident report and a shift summary.
Tools: The exam does not require deep configuration knowledge but expects you to know which tools an analyst uses. SIEM is the primary tool for monitoring and alerting. Other tools include EDR for endpoint monitoring, and threat intelligence platforms for enrichment.
Common exam traps:
A question describes a Tier 2 task (like containing a threat) and asks “What should the analyst do next?” The trap is offering “perform full forensic analysis” as an answer — a Tier 1 analyst should escalate, not conduct forensics.
A question shows an alert with a high severity score and asks if it is a real attack. The correct answer is “investigate further” rather than “immediately contain” — the analyst must verify before action.
A question lists multiple types of logs and asks which one to check for a successful login from an unusual location. The answer is the authentication log, not the firewall log (which shows traffic but not authentication success or failure).
Memorise these specific facts:
The analyst’s primary goal is to detect and report security incidents.
The analyst does not have authority to shut down systems — that requires escalation.
True positives are real attacks; false negatives are missed attacks.
SOC tiers: Tier 1 = monitor, triage, escalate; Tier 2 = investigate, contain; Tier 3 = advanced analysis, forensics.
SIEM aggregates logs from multiple sources.
Shift handover reports are critical for continuity.
The cybersecurity analyst’s primary role is to monitor security alerts, triage them, and escalate confirmed incidents to the incident response team.
SOCs are organised into tiers: Tier 1 performs initial triage and escalation, Tier 2 investigates and contains, and Tier 3 conducts advanced analysis and forensics.
Analysts must distinguish between true positives (real attacks), false positives (benign events that trigger alerts), and false negatives (real attacks that go undetected).
The SIEM (Security Information and Event Management) system is the central tool that collects and correlates logs from firewalls, servers, endpoints, and other sources for analyst review.
Shift handover reports are critical — analysts must document unresolved incidents, ongoing investigations, and important context for the next shift.
Tier 1 analysts do not have the authority to shut down systems or perform forensics; their job is to detect, verify, and escalate.
These come up on the exam all the time. Here's how to tell them apart.
Tier 1 Analyst
Monitors alerts and performs initial triage
Escalates confirmed incidents to Tier 2
Does not perform deep forensic investigation
Tier 2 Analyst
Investigates escalated incidents in depth
Contains threats and coordinates response
Analyses attack patterns and conducts basic forensics
True Positive
Alert correctly identifies malicious activity
Requires immediate escalation
Example: alert for actual malware download
False Positive
Alert fires for benign activity
Requires no further action beyond tuning
Example: alert for legitimate software update
SIEM
Aggregates logs from multiple sources
Provides central dashboard for alerts
Focuses on correlation and detection
EDR
Installed directly on endpoints
Provides real-time visibility into endpoint behaviour
Enables remote investigation and response
Shift Report
Summarises events during a single shift
Includes unresolved issues for next shift
Does not detail full forensic findings
Incident Report
Documents a specific security incident end-to-end
Includes timeline, evidence, and actions taken
Used for post-incident review and legal purposes
Mistake
A cybersecurity analyst is responsible for stopping attacks by themselves, like a hacker in a movie.
Correct
The analyst’s job is to detect, triage, and escalate incidents — not to single-handedly stop attacks. The incident response team and other teams perform containment and eradication.
Beginners are influenced by fictional portrayals of lone experts. In reality, security is a team effort with defined roles.
Mistake
If an alert is marked as high severity, the analyst should immediately contain the threat without checking the context.
Correct
The analyst must always verify the alert by checking logs and context before acting. High severity might still be a false positive or require escalation to Tier 2.
New analysts fear ignoring high-severity alerts, so they react impulsively. The exam teaches that verification is a core responsibility.
Mistake
A Tier 1 analyst is less important than a Tier 3 analyst because they only perform simple tasks.
Correct
Tier 1 analysts are the first line of defence. Their accuracy in triage determines whether the organisation wastes time on false positives or misses a real attack. Their role is critical.
Beginners underestimate the importance of triage because it seems basic. In reality, poor triage leads to alert fatigue and missed breaches.
Mistake
Cybersecurity analysts write code and perform penetration testing as part of their daily job.
Correct
Analysts primarily monitor alerts, review logs, and escalate. Penetration testing is typically done by dedicated red teams or external consultants, not by SOC analysts.
Media often conflates all security roles. The exam clearly distinguishes between analyst duties and offensive security roles.
Mistake
A cybersecurity analyst must know every detail of every security tool to be effective.
Correct
Analysts need to understand the output and purpose of common tools (SIEM, EDR, firewalls) but not the underlying configuration details. Focus on interpreting alerts, not building the tools.
Beginners feel overwhelmed by the breadth of security tools. The exam tests understanding of how tools support the analyst, not how to administer them.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No, you only need to understand what a SIEM does and how analysts use it. The exam focuses on interpreting alerts, not configuring tools.
An analyst monitors and responds to security events. An engineer designs, builds, and maintains security systems. The 200-201 exam focuses on the analyst role.
No. A Tier 1 analyst can detect the ransomware and escalate the alert, but containment and eradication are handled by the incident response team.
The primary tool is the SIEM dashboard. Analysts also use threat intelligence platforms, endpoint detection and response tools, and ticketing systems for documentation.
Yes, Tier 1 analyst is generally considered an entry-level role in cybersecurity. However, it requires strong analytical skills and understanding of basic networking and security concepts.
The attack goes undetected, potentially leading to data theft, system compromise, or financial loss. This is why verification and thoroughness are critical.
You've finished Introduction to Cybersecurity Operations. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?