Knowledge + Practice

Cisco CyberOps Associate 200-201 (200-201) — Questions 1–75

979 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 1 of 14

1

MCQhard

An organization wants to ensure that a received email genuinely came from the claimed sender and has not been altered. Which cryptographic mechanism provides both authentication and integrity?

A.Digital signature

B.Hash function

C.Public key infrastructure (PKI)

D.Symmetric encryption

AnswerA

Digital signatures use the sender's private key, providing authentication and integrity.

Why this answer

A digital signature uses the sender's private key to sign the message, and the recipient verifies it with the sender's public key. This process provides authentication (proving the sender's identity) and integrity (detecting any alteration) because any change to the message invalidates the signature. Hash functions alone provide integrity but not authentication, while PKI is the infrastructure that supports digital signatures but is not the mechanism itself.

Exam trap

Cisco often tests the distinction between a mechanism (digital signature) and the supporting infrastructure (PKI), leading candidates to mistakenly select PKI because they associate it with certificates and authentication.

How to eliminate wrong answers

Option B is wrong because a hash function provides integrity by producing a fixed-size digest, but it does not authenticate the sender; an attacker can replace both the message and its hash. Option C is wrong because PKI is a framework of policies, roles, and certificates that enables digital signatures and encryption, but it is not a cryptographic mechanism that directly provides both authentication and integrity. Option D is wrong because symmetric encryption provides confidentiality (secrecy) but does not inherently authenticate the sender or ensure integrity; an attacker with the shared key could modify the ciphertext.

Full explanation →

2

Multi-Selectmedium

A healthcare organization must comply with HIPAA. Which THREE security measures are typically required under HIPAA? (Choose three.)

Select 3 answers

A.Regular vulnerability scanning of all internet-facing systems

B.Encryption of electronic protected health information (ePHI)

C.Annual penetration testing by an external firm

D.Implementation of access controls to limit who can view ePHI

E.Audit controls to record and examine access to ePHI

AnswersB, D, E

Encryption is an addressable implementation specification to protect ePHI.

Why this answer

HIPAA requires encryption of ePHI, access controls, and audit controls to ensure confidentiality, integrity, and availability of protected health information.

Full explanation →

3

MCQhard

During a security audit, an analyst finds that a third-party vendor has access to sensitive customer data beyond what is necessary for their services. Which principle of least privilege should the policy enforce?

A.Implement an incident response plan for data leaks

B.Update the end-user license agreement

C.Enforce a data classification and access control policy

D.Invoke a service-level agreement

AnswerC

A data classification and access control policy directly implements least privilege by ensuring only necessary data is accessible.

Why this answer

The principle of least privilege means granting only the minimum access rights necessary. To enforce this, the policy should include data classification and access controls that restrict vendor access to only required data sets. Option C is correct.

Option A (implement an incident response plan) is reactive and does not prevent excessive access. Option B (update the end-user license agreement) is a legal document, not a technical control. Option D (invoke a service-level agreement) defines performance metrics, not access restrictions.

Full explanation →

4

MCQeasy

An analyst detects HTTPS traffic to a domain that was registered only 24 hours ago and has no web content. The traffic occurs at odd hours and with consistent packet sizes. What technique is likely being used for C2?

A.DNS tunneling

B.HTTPS beaconing to a malicious domain

C.HTTP POST exfiltration

D.Domain Generation Algorithm (DGA)

AnswerB

HTTPS to a suspicious domain is common C2.

Why this answer

Attackers often use newly registered domains (DGAs or manually registered) for C2 to avoid blacklists. HTTPS provides encryption to hide the beaconing.

Full explanation →

5

Multi-Selecthard

An analyst detects an internal host communicating with an external IP known for malware distribution. Which THREE of the following are valid Indicators of Compromise (IoCs) that should be recorded?

Select 3 answers

A.Domain name used in the communication

B.Email address of the user

C.IP address of the external server

D.MD5 hash of a downloaded file

E.Registry key from the endpoint

AnswersA, C, D

Domains are common IoCs.

Why this answer

The domain name used in the communication is a classic Indicator of Compromise (IoC). When an internal host contacts an external IP known for malware distribution, the domain name (e.g., via DNS query) provides a persistent, human-readable identifier that can be used to block or investigate the threat, even if the IP address changes. This aligns with the NIST definition of IoCs as forensic evidence of a potential intrusion.

Exam trap

Cisco often tests the distinction between direct network-based IoCs (domain, IP, file hash) and host-based artifacts (registry keys, user email) that may require additional correlation to be considered valid IoCs for a specific event.

Full explanation →

6

MCQmedium

An IDS/IPS alert shows a signature named 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' with severity high. What is the most likely next step for an analyst?

A.Immediately block the source IP on the firewall

B.Reset the IDS/IPS signature database

C.Investigate the source IP and user-agent for malicious activity

D.Ignore the alert as it is not a critical signature

AnswerC

Investigating helps determine if the alert is a true positive.

Why this answer

The 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' signature indicates a policy violation, not necessarily a confirmed attack. An analyst must first investigate the source IP and user-agent to determine if the traffic is malicious (e.g., command-and-control communication, data exfiltration) or benign (e.g., a legitimate application using a non-standard user-agent). Immediate blocking (Option A) could disrupt legitimate services, while ignoring the alert (Option D) risks missing a real threat.

Exam trap

Cisco often tests the distinction between 'policy' and 'exploit' signatures, where candidates mistakenly treat a policy violation as an immediate threat and jump to blocking, rather than following the proper incident response process of investigation first.

How to eliminate wrong answers

Option A is wrong because immediately blocking the source IP on the firewall is an overly aggressive response without confirming malicious activity; it could cause a denial of service for legitimate users and violates the principle of 'verify before blocking'. Option B is wrong because resetting the IDS/IPS signature database does not address the alert; it would remove all signatures, including legitimate ones, and is not a standard troubleshooting step for a single alert. Option D is wrong because ignoring the alert is negligent; even though it is a policy-based signature, it may indicate reconnaissance, scanning, or malware activity that requires investigation.

Full explanation →

7

MCQhard

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

A.Digital signature using RSA

B.Hash-based message authentication code (HMAC)

C.Symmetric encryption with AES

D.Hashing with SHA-256

AnswerC

Symmetric encryption like AES encrypts data for confidentiality.

Why this answer

Symmetric encryption, such as AES, provides confidentiality by encrypting data so that only those with the key can read it.

Full explanation →

8

MCQeasy

A security analyst is monitoring network traffic and notices a large number of TCP SYN packets being sent to a single host on various ports. Which type of attack is most likely occurring?

A.Man-in-the-middle

B.ARP spoofing

C.DNS amplification

D.Port scan

AnswerD

A TCP SYN scan sends SYN packets to multiple ports to identify open ports.

Why this answer

A port scan involves sending packets to multiple ports on a target to discover open ports. The description matches a TCP SYN scan.

Full explanation →

9

MCQmedium

A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?

A.tcp.dstport == 443

B.https

C.tcp.port == 443

D.port 443

AnswerC

This display filter correctly filters packets with source or destination TCP port 443.

Why this answer

The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.

Exam trap

Cisco often tests the distinction between capture filters and display filters, and the trap here is that candidates confuse the simpler capture filter syntax (`port 443`) with the required display filter syntax (`tcp.port == 443`), leading them to choose Option D.

How to eliminate wrong answers

Option A is wrong because `tcp.dstport == 443` only filters packets where the destination port is 443, missing packets where the source port is 443 (e.g., server responses). Option B is wrong because `https` is not a valid Wireshark display filter; Wireshark does not have a built-in protocol name filter for HTTPS since it is encrypted and not directly dissectable as a separate protocol. Option D is wrong because `port 443` is a capture filter syntax (used in tcpdump or Wireshark's capture filter field), not a display filter; display filters require a different syntax (e.g., `tcp.port == 443`).

Full explanation →

10

MCQeasy

A small business uses a cloud-based email service. The IT administrator wants to protect against phishing attacks that target employees. Which security control should be implemented first?

A.Conduct weekly security awareness training

B.Install antivirus software on all endpoints

C.Deploy a web application firewall (WAF)

D.Enable multi-factor authentication (MFA) on email accounts

AnswerA

Security awareness training is the first and most effective control against phishing because it directly addresses the human vulnerability that phishing attacks exploit. It empowers users to identify and report suspicious emails, reducing the likelihood of successful attacks.

Why this answer

Security awareness training is the most important first control against phishing because it educates users to recognize and avoid phishing attempts, reducing the likelihood of successful attacks. While MFA and antivirus are valuable, training addresses the human element directly. A WAF protects web applications, not email, and is not a first-line defense for phishing targeting cloud email.

Exam trap

Candidates often think technical controls like WAF are the first step, but phishing relies on social engineering, so user training is the most effective initial control.

How to eliminate wrong answers

Option A is wrong because weekly security awareness training, while valuable, is a reactive, human-centric control that relies on employee vigilance and does not block the initial phishing attempt; it should complement technical controls, not be the first line of defense. Option B is wrong because antivirus software on endpoints primarily detects and removes malware after delivery, but phishing attacks often bypass traditional signature-based AV by using social engineering or zero-day exploits, and it does not inspect the email service's web traffic. Option D is wrong because multi-factor authentication (MFA) protects against credential theft after a user is tricked, but it does not prevent the phishing email from reaching the inbox or block malicious links; it is a critical secondary control but not the first layer of defense against the attack vector itself.

Full explanation →

11

MCQmedium

A company's security policy requires that all servers have host-based intrusion detection (HIDS) installed and configured to send alerts to the SIEM. During a routine check, you find that a critical database server has HIDS installed but is not sending alerts because the agent service is stopped. The server administrator says he stopped the service because it was using too much CPU. The policy requires that any deviation from baseline must be approved by the security team. What should you do?

A.Restart the service on the server and submit a change request for CPU optimization.

B.Accept the server administrator's justification and document it.

C.Recommend setting the HIDS process priority to low to reduce CPU impact.

D.Report the non-compliance to the security manager and disable the server until compliance is restored.

AnswerA

This restores compliance and initiates the proper process for a permanent fix.

Why this answer

Restarting the service and submitting a change request for CPU optimization addresses the immediate non-compliance while working on a solution. Option B is too lenient; Option C is too harsh; Option D may not solve the CPU issue and bypasses approval.

Full explanation →

12

Multi-Selecthard

A SOC analyst is tuning a SIEM correlation rule to detect port scanning. The rule should generate an alert when a single source IP connects to many different destination ports on multiple hosts within a short time. Which THREE conditions should be included in the rule?

Select 3 answers

A.Count of unique destination IPs > threshold

B.Destination port is well-known

C.Single source IP

D.Average packet count per connection is high (e.g., >100)

E.Count of unique destination ports > threshold

AnswersA, C, E

Scans often target multiple hosts.

Why this answer

Port scanning involves multiple ports on multiple hosts from one source. Unique destination ports and unique destination IPs are key. Low packet count per connection is typical of scans (e.g., SYN scans).

Full explanation →

13

MCQhard

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

A.files.log

B.dns.log

C.conn.log

D.http.log

AnswerD

http.log records HTTP headers, methods, URIs, and status codes.

Why this answer

Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Full explanation →

14

Multi-Selecthard

A security analyst is investigating a PCAP and sees the following HTTP POST request: POST /login HTTP/1.1 ... username=admin&password=letmein. Which TWO attack indicators are present?

Select 2 answers

A.Cross-site scripting (XSS) payload

B.Buffer overflow attempt

C.SQL injection attack

D.Use of weak or default credentials

E.Credential theft via plaintext transmission

AnswersD, E

The password 'letmein' is a common weak password.

Why this answer

The plaintext credentials in an HTTP POST indicate credential theft (sniffing) and the use of weak or default passwords (common attack vector).

Full explanation →

15

MCQmedium

Which of the following is a common indicator of DNS tunneling used for exfiltration?

A.DNS queries with long subdomain strings

B.Frequent DNS queries to known domains

C.DNS responses with large payloads

D.DNS queries using TCP instead of UDP

AnswerA

Correct. Long subdomain strings are a sign of DNS tunneling.

Why this answer

DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.

Exam trap

Cisco often tests the distinction between a general anomaly (like large DNS responses) and a specific tunneling indicator (long subdomain strings), where candidates mistakenly focus on response size or protocol choice rather than the query structure.

How to eliminate wrong answers

Option B is wrong because frequent DNS queries to known domains are typical of legitimate client behavior (e.g., CDN lookups) and not a specific sign of tunneling. Option C is wrong because while DNS responses can carry large payloads in tunneling, the primary indicator is the query side; moreover, standard DNS responses are limited to 512 bytes (or up to 4096 bytes with EDNS0), so large responses alone are not definitive. Option D is wrong because DNS queries normally use UDP, but tunneling can use TCP for reliability; however, TCP usage is not a common indicator because many legitimate operations (e.g., zone transfers) also use TCP.

Full explanation →

16

MCQhard

An analyst is investigating a potential data exfiltration via DNS. In Zeek DNS logs, the analyst sees many queries for subdomains like 'a1b2c3.malicious.com', 'd4e5f6.malicious.com' etc. from an internal host. Which technique is likely being used?

A.DNS cache poisoning

B.DNS amplification

C.DNS tunneling

D.DNS zone transfer

AnswerC

DNS tunneling uses subdomains to encode data.

Why this answer

The repeated pattern of unique, seemingly random subdomains (e.g., 'a1b2c3.malicious.com') from a single internal host is a classic indicator of DNS tunneling. This technique encodes exfiltrated data into DNS query subdomains, leveraging the fact that DNS traffic is often allowed through firewalls. The malicious server decodes the subdomain strings to reconstruct the stolen data.

Exam trap

Cisco often tests the distinction between DNS tunneling (data exfiltration) and DNS amplification (DDoS), where candidates mistakenly associate any unusual DNS pattern with a volumetric attack rather than a covert channel.

How to eliminate wrong answers

Option A is wrong because DNS cache poisoning (spoofing) corrupts a resolver's cache with forged records to redirect traffic, not to exfiltrate data via subdomain queries. Option B is wrong because DNS amplification is a reflection-based DDoS attack that uses open resolvers to flood a victim with large responses, not a data exfiltration method. Option D is wrong because a DNS zone transfer is a legitimate mechanism for replicating DNS records between authoritative servers, not a technique for encoding data in subdomain queries.

Full explanation →

17

Multi-Selecteasy

Which TWO pieces of information are essential for an analyst to correlate when investigating an intrusion alert from a network-based sensor?

Select 2 answers

A.The color of the network cables

B.Source and destination IP addresses

C.The brand of the sensor

D.Timestamp of the alert

E.The name of the security team lead

AnswersB, D

IP addresses identify the communicating hosts.

Why this answer

Source and destination IP addresses are essential because they allow the analyst to identify the communicating endpoints involved in the intrusion attempt. By correlating these addresses with other alert data, the analyst can determine the origin of the attack and the targeted asset, which is critical for scoping the incident and initiating containment actions.

Exam trap

Cisco often tests the distinction between operational data (IP addresses, timestamps) and irrelevant administrative or physical details, trapping candidates who confuse 'essential for correlation' with 'nice to have' or 'commonly known' information.

Full explanation →

18

Multi-Selecteasy

Which TWO of the following are best practices for configuring syslog in a secure monitoring environment? (Choose two.)

Select 2 answers

A.Use UDP as the transport protocol to ensure reliable delivery

B.Set log files to overwrite daily

C.Configure a maximum log file size to prevent disk exhaustion

D.Change the default syslog port to avoid detection by attackers

E.Send syslog messages to a centralized log server over a dedicated management network

AnswersC, E

Limiting log size prevents denial of service due to full disk.

Why this answer

Configuring a maximum log file size prevents syslog messages from filling up the disk, which could cause the system to crash or become unresponsive. This is a critical best practice in secure monitoring to ensure logging continues without exhausting storage resources.

Exam trap

Cisco often tests the misconception that changing default ports or using UDP provides security, when in fact these practices do not address real threats like interception or data loss.

Full explanation →

19

MCQmedium

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the ASCII string 'MZ' at the beginning. What does this indicate?

A.The file is a plain text file

B.The file is a Windows Portable Executable

C.The file is a Linux ELF binary

D.The file is a PDF document

AnswerB

Correct. 'MZ' is the PE signature.

Why this answer

The 'MZ' magic bytes (0x4D 0x5A) are the signature of a Portable Executable (PE) file, indicating it is a Windows executable. This is the first step in file identification.

Full explanation →

20

MCQhard

You are a senior analyst in a SOC that monitors a large financial institution. The SIEM correlates events from firewalls, IDS, endpoints, and database servers. Over the past week, you have noticed multiple low-priority alerts from the IDS indicating 'ET SCAN NMAP -sS' scans from internal IP 10.0.0.50, which is a print server. The alerts occur at random times during business hours. The number of alerts has increased from 5 per day to 20 per day. The print server runs a standard OS and printer management software. No other alerts are triggered from that host. The firewall logs show outbound connections from the print server to IPs on the internet on port 443, which is abnormal for a print server. You check the printer management software and see no recent updates. The user of the print server, the IT administrator, reports no issues. What is your best course of action?

A.Increase the alert threshold to reduce noise and continue monitoring

B.Disable the printer service on the server and monitor for recurrence

C.Dismiss the alerts as false positives because print servers often perform network discovery

D.Isolate the print server from the network and conduct a forensic investigation

AnswerD

Isolation prevents further malicious activity, and forensic analysis can confirm compromise and identify the attack vector.

Why this answer

The print server at 10.0.0.50 is exhibiting multiple indicators of compromise: it is performing NMAP SYN scans (ET SCAN NMAP -sS) from an internal IP, and firewall logs show abnormal outbound HTTPS connections to internet IPs on port 443. These behaviors are inconsistent with a standard print server's role and suggest the host may be compromised, possibly acting as a pivot point for reconnaissance or command-and-control communication. Isolating the host and conducting a forensic investigation is the appropriate incident response step to contain the threat and determine the root cause before it can cause further damage.

Exam trap

Cisco often tests the candidate's ability to recognize that a combination of seemingly low-severity alerts (NMAP scans) and abnormal outbound traffic on a non-web server indicates a compromise, rather than dismissing them as false positives or tuning them out.

How to eliminate wrong answers

Option A is wrong because increasing the alert threshold would ignore potentially malicious activity, allowing a compromised host to continue scanning and exfiltrating data. Option B is wrong because disabling the printer service does not address the underlying compromise; the attacker could still use other services or persistence mechanisms on the server. Option C is wrong because print servers do not normally perform NMAP SYN scans or make outbound HTTPS connections to arbitrary internet IPs; dismissing these as false positives ignores clear signs of anomalous behavior.

Full explanation →

21

MCQeasy

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

A.HTTP traffic

B.SNMP traffic

C.NTP traffic

D.DNS traffic

AnswerC

NTP uses UDP port 123.

Why this answer

The syslog message %ASA-4-106023 shows a UDP deny from source 192.0.2.1 port 123 to destination 10.0.0.5 port 123. Port 123 is the well-known port for Network Time Protocol (NTP), which is used for clock synchronization. Therefore, the denied traffic is NTP traffic.

Exam trap

The trap here is that candidates may confuse port 123 with other common UDP services like DNS (port 53) or SNMP (ports 161/162), or assume the '123' is a random number rather than a standard port assignment.

How to eliminate wrong answers

Option A is wrong because HTTP traffic uses TCP port 80 or 8080, not UDP port 123. Option B is wrong because SNMP traffic uses UDP ports 161 (queries) and 162 (traps), not port 123. Option D is wrong because DNS traffic uses UDP port 53 (or TCP for zone transfers), not port 123.

Full explanation →

22

MCQhard

A SOC Tier 2 analyst is investigating an alert that was escalated by Tier 1. The analyst needs to perform deeper correlation and malware analysis. Which of the following actions is most appropriate for Tier 2?

A.Analyze the malware sample in a sandbox and correlate with other indicators.

B.Conduct threat hunting to proactively search for threats.

C.Develop new detection rules for the SIEM.

D.Perform initial triage and basic investigation.

AnswerA

Tier 2 handles deeper analysis and correlation.

Why this answer

Tier 2 analysts perform deeper investigation, correlation, and malware analysis.

Full explanation →

23

MCQmedium

During an incident, a SOC Tier 1 analyst identifies a series of failed login attempts from an internal IP address. The analyst escalates the alert. What is the primary role of a Tier 2 analyst in this scenario?

A.Monitor alerts and perform initial triage

B.Make decisions on business impact and notification

C.Conduct threat hunting and advanced forensics

D.Perform deeper investigation and correlate events

AnswerD

Tier 2 analysts investigate escalated alerts and correlate data.

Why this answer

Tier 2 analysts perform deeper investigation, correlation, and analysis beyond initial triage.

Full explanation →

24

MCQeasy

Which Windows registry hive contains user-specific configuration settings that can be modified by applications?

A.HKEY_CLASSES_ROOT

B.HKEY_LOCAL_MACHINE

C.HKEY_CURRENT_USER

D.HKEY_USERS

AnswerC

HKCU stores per-user configuration.

Why this answer

HKEY_CURRENT_USER (HKCU) is the correct answer because it stores user-specific configuration settings, such as desktop preferences, environment variables, and application settings, that are loaded from the NTUSER.DAT file when a user logs in. Applications modify this hive to persist per-user customizations, making it the primary location for user-level registry changes.

Exam trap

The trap here is that candidates confuse HKEY_CURRENT_USER with HKEY_LOCAL_MACHINE, assuming all configuration settings are system-wide, but Cisco tests the distinction that per-user application settings are stored in HKCU, not HKLM.

How to eliminate wrong answers

Option A is wrong because HKEY_CLASSES_ROOT (HKCR) stores file association and COM class registration data, not user-specific application settings. Option B is wrong because HKEY_LOCAL_MACHINE (HKLM) contains system-wide configuration settings that apply to all users and require administrative privileges to modify, not per-user settings. Option D is wrong because HKEY_USERS (HKU) contains all loaded user hives on the system, but applications typically write to the current user's hive via HKCU, which is a symbolic link to the specific user's subkey under HKU; direct modification of HKU is uncommon for application settings.

Full explanation →

25

MCQhard

A security auditor reviews the SNMP configuration. Which security concern should be reported?

A.The location and contact information is exposed

B.SNMP is disabled on the router

C.The community strings are set to default values

D.The private community string is read-only

AnswerC

Default community strings are easily guessed.

Why this answer

Default SNMP community strings (e.g., 'public' for read-only, 'private' for read-write) are well-known and widely documented. An attacker who discovers these defaults can query or modify the device's MIB, leading to information disclosure or unauthorized configuration changes. This is a critical security concern that must be reported.

Exam trap

Cisco often tests the distinction between the existence of a default community string (a critical vulnerability) versus the access level (read-only vs. read-write) or the exposure of non-sensitive MIB objects like sysLocation.

How to eliminate wrong answers

Option A is wrong because exposing location and contact information is a low-severity information disclosure issue, not the primary security concern when default community strings are in use. Option B is wrong because disabling SNMP is actually a security best practice, not a security concern. Option D is wrong because a read-only private community string is actually more secure than a read-write one; the problem is that the string itself is set to a default value, not its access level.

Full explanation →

26

Multi-Selecthard

Which TWO network behaviors suggest an ARP spoofing attack is occurring? (Choose two.)

Select 2 answers

A.A high number of TCP RST packets

B.A single host sending numerous ARP requests

C.Packets originating from a MAC address that does not match the IP's legitimate MAC

D.An increase in broadcast ARP traffic

E.Multiple IP addresses mapping to the same MAC address

AnswersC, E

Indicates the attacker is sending packets with a spoofed MAC.

Why this answer

In an ARP spoofing attack, the attacker sends forged ARP replies that associate their own MAC address with the IP address of a legitimate host (e.g., the default gateway). This causes packets destined for that IP to be sent to the attacker's MAC, creating a mismatch between the source MAC in the packet and the legitimate MAC address for that IP. Detecting such mismatches is a key indicator of ARP cache poisoning.

Exam trap

Cisco often tests the distinction between normal ARP traffic (e.g., broadcasts for resolution) and malicious ARP behavior (e.g., multiple IPs on one MAC or MAC-IP mismatches), so candidates mistakenly choose high ARP volume or TCP RSTs as spoofing indicators.

Full explanation →

27

MCQmedium

A security analyst observes repeated failed login attempts from a single external IP address, causing the authentication server to become unresponsive. Which type of attack is occurring?

A.Denial of Service

B.Reconnaissance

C.Brute force attack

D.Man-in-the-middle

AnswerA

The repeated login attempts are overwhelming the server, causing a DoS.

Why this answer

A Denial of Service (DoS) attack aims to make a system or service unavailable by overwhelming it with requests.

Full explanation →

28

MCQeasy

Which SOC tier is responsible for threat hunting and advanced forensic analysis?

A.Tier 1

B.Tier 3

C.All tiers equally

D.Tier 2

AnswerB

Tier 3 involves threat hunting, advanced forensics, and tool development.

Why this answer

Tier 3 analysts perform proactive threat hunting and complex forensics.

Full explanation →

29

MCQhard

You are a SOC analyst at a mid-sized company. The company uses a SIEM that ingests logs from firewalls, IDS, and endpoints. Over the past week, you've noticed a gradual increase in outbound traffic from several internal hosts to IP addresses in a foreign country during non-business hours. The traffic is primarily on port 443. The IDS has not generated any alerts. The firewall logs show the connections are established. You check the endpoints and find no unusual processes running. However, the outbound connections persist. What is the most likely explanation and the best next step?

A.Enable SSL decryption on the firewall to inspect the traffic content.

B.Assume the hosts are compromised and reimage them.

C.Ignore the traffic since the IDS and endpoints show no signs of compromise.

D.Immediately isolate all affected hosts from the network.

AnswerA

Provides visibility into encrypted traffic to confirm data exfiltration.

Why this answer

The gradual increase in outbound traffic on port 443 (HTTPS) to foreign IPs during non-business hours, without IDS alerts or suspicious processes, strongly suggests data exfiltration over encrypted channels. Since the traffic is encrypted, the IDS cannot inspect the payload, and endpoint checks may miss stealthy malware that uses legitimate processes (e.g., svchost.exe) for beaconing. Enabling SSL decryption on the firewall allows the SOC to decrypt and inspect the HTTPS traffic, revealing the actual content and confirming or ruling out exfiltration.

Exam trap

Cisco often tests the misconception that a lack of IDS alerts and endpoint anomalies means the network is clean, but the trap here is that encrypted traffic (port 443) can hide malicious activity from signature-based detection, requiring proactive decryption to uncover the threat.

How to eliminate wrong answers

Option B is wrong because reimaging hosts without first confirming compromise is premature and disruptive; the traffic could be legitimate (e.g., cloud backups) and reimaging would destroy forensic evidence. Option C is wrong because ignoring traffic solely because IDS and endpoints show no signs of compromise is a dangerous assumption—encrypted traffic can bypass IDS signatures, and malware can hide from endpoint scans (e.g., fileless or living-off-the-land techniques). Option D is wrong because immediately isolating all affected hosts is an overreaction without evidence of compromise; it would disrupt business operations and may not be necessary if the traffic is benign, and it prevents further investigation.

Full explanation →

30

MCQeasy

You are a security analyst at a medium-sized company. The company uses a SIEM that collects logs from firewalls, IDS/IPS, and endpoint detection and response (EDR) agents. You receive an alert that a user's workstation (IP 10.0.1.25) has been making outbound connections to an IP address (198.51.100.10) on port 4444 (commonly used by malware). The alert includes a SIEM correlation rule that triggered when three or more connections to that IP occurred within 5 minutes. You check the EDR logs and see that the workstation is running a process named 'svchost.exe' that is connecting to that IP. The process path is C:\Windows\system32\svchost.exe, which is legitimate. However, you notice that the process has a digital signature from 'Microsoft Corporation', but the signature date is from 2021. The workstation's operating system is Windows 10 22H2, fully patched as of last month. The user reports that they have been experiencing slow performance and occasional pop-ups. Which action should you take FIRST to investigate this potential compromise?

A.Perform a full system reimage of the workstation to ensure the malware is removed.

B.Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.

C.Immediately block the outbound connection to 198.51.100.10 at the firewall and isolate the workstation from the network.

D.Verify the digital signature of svchost.exe with Microsoft to ensure it has not been revoked.

AnswerB

This can detect DLL sideloading or injection, which is a common technique.

Why this answer

The presence of a legitimate svchost.exe with a valid Microsoft signature does not rule out DLL sideloading or injection. By listing all DLLs loaded by the process, you can identify suspicious non-Microsoft DLLs that may be executing malicious code within the trusted svchost.exe context, which is a common technique used by malware to evade detection.

Exam trap

Cisco often tests the misconception that a valid digital signature on a process executable guarantees the process is clean, when in reality attackers frequently use signed Microsoft binaries as hosts for malicious code via injection or sideloading.

How to eliminate wrong answers

Option A is wrong because performing a full system reimage is a drastic, irreversible step that destroys forensic evidence and should only be taken after confirming compromise and preserving data. Option C is wrong because immediately blocking the connection and isolating the workstation may disrupt the investigation and alert the attacker; the first step should be to gather more evidence via EDR before taking containment actions. Option D is wrong because verifying the digital signature of svchost.exe is unnecessary—the signature is already valid and from Microsoft, but malware can still abuse a legitimate signed binary through DLL hijacking or process hollowing.

Full explanation →

31

Drag & Dropmedium

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for VLAN configuration on a Cisco switch is to first enter global configuration mode with 'configure terminal', then create the VLAN using 'vlan vlan-id', which places you in VLAN configuration mode. Next, assign a name with 'name vlan-name', and finally exit VLAN config mode and configure interfaces to belong to the VLAN using 'switchport access vlan vlan-id'. This order ensures the VLAN exists and has a meaningful identifier before ports are assigned.

Full explanation →

32

MCQhard

Based on the exhibit, what does the sequence of events indicate?

A.The wmiprvse.exe process is known to spawn svchost.exe for system health checks.

B.A process masquerading as svchost.exe was spawned by wmiprvse.exe (likely via WMI), and then that malicious process launched calc.exe, a suspicious behavior.

C.The user is executing a macro that opens Calculator.

D.A legitimate system process (wmiprvse.exe) launched a service host, which then launched calc.exe for maintenance.

AnswerB

The path and subsequent execution of calc.exe indicate malicious activity.

Why this answer

The exhibit shows wmiprvse.exe (the WMI Provider Host) spawning svchost.exe, which then launches calc.exe. In normal operations, wmiprvse.exe does not spawn svchost.exe; svchost.exe is a generic host process for Windows services and is typically launched by services.exe. The sequence indicates process masquerading: an attacker used WMI to execute a malicious binary named svchost.exe, which then launched calc.exe as a suspicious payload.

This is a classic indicator of lateral movement or privilege escalation via WMI.

Exam trap

Cisco often tests the misconception that svchost.exe is always legitimate and that wmiprvse.exe only spawns itself or system processes, when in fact attackers can use WMI to launch arbitrary executables with a misleading name.

How to eliminate wrong answers

Option A is wrong because wmiprvse.exe does not spawn svchost.exe for system health checks; svchost.exe is started by services.exe, and WMI does not initiate such a process for health monitoring. Option C is wrong because the exhibit shows a process chain (wmiprvse.exe → svchost.exe → calc.exe), not a user directly executing a macro; macros typically run within an Office application, not via WMI and svchost.exe. Option D is wrong because a legitimate system process (wmiprvse.exe) does not launch svchost.exe for maintenance; svchost.exe is a service host, not a maintenance tool, and calc.exe is not a standard maintenance binary.

Full explanation →

33

MCQeasy

Which organization facilitates threat intelligence sharing among members in a specific sector, such as finance or healthcare?

A.MISP

B.ISAC

C.STIX

D.TAXII

AnswerB

ISACs are sector-based sharing organizations.

Why this answer

ISACs (Information Sharing and Analysis Centers) are sector-specific threat intelligence sharing groups.

Full explanation →

34

MCQhard

A Cisco Firepower appliance generates an intrusion specific event with the message 'MALWARE-CNC generic command and control traffic detected'. The analyst needs to determine if the alert is a true positive. Which additional data source would provide the most corroborating evidence?

A.Application control logs

B.URL filtering logs

C.NetFlow records

D.DNS query logs

AnswerD

DNS logs can confirm if the destination is a known CnC domain.

Why this answer

DNS query logs are the most corroborating evidence because malware command-and-control (C2) traffic often relies on DNS to resolve the IP address of the C2 server. A sudden spike in NXDOMAIN responses, queries to algorithmically generated domains (DGA), or requests to known malicious domains in the DNS logs would directly confirm the C2 activity. This aligns with the 'MALWARE-CNC' signature, which specifically targets C2 communication patterns.

Exam trap

Cisco often tests the misconception that NetFlow or URL filtering logs are sufficient for C2 detection, but the key is that DNS logs reveal the domain resolution step that is almost always part of C2 communication, making them the most direct corroborating source.

How to eliminate wrong answers

Option A is wrong because application control logs identify which applications (e.g., HTTP, FTP) are in use but do not reveal the destination domain or IP of C2 traffic, making them insufficient for corroborating C2-specific alerts. Option B is wrong because URL filtering logs show only HTTP/HTTPS requests with full URLs, but C2 traffic often uses non-standard ports or protocols (e.g., DNS tunneling, IRC) that bypass URL filtering entirely. Option C is wrong because NetFlow records provide IP addresses, ports, and byte counts but lack the domain name resolution data needed to confirm C2 domain lookups; they cannot distinguish between a legitimate DNS query and a DGA-based query without additional context.

Full explanation →

35

MCQmedium

An attacker uses a tool to capture keystrokes on a compromised system. What type of malware is most likely in use?

A.Spyware

B.Rootkit

C.Ransomware

D.Keylogger

AnswerD

Keylogger specifically records keystrokes.

Why this answer

A keylogger is a type of malware specifically designed to capture and record keystrokes on a compromised system. The question directly describes the behavior of capturing keystrokes, which is the primary function of a keylogger, making it the most likely malware in use.

Exam trap

Cisco often tests the distinction between a general category (spyware) and a specific type (keylogger), so the trap here is that candidates may choose spyware because it is a broader term, but the question asks for the most likely malware based on the specific behavior described.

How to eliminate wrong answers

Option A is wrong because spyware is a broader category of malware that focuses on collecting information about a user's activities, such as browsing habits or login credentials, but it does not specifically specialize in capturing keystrokes; a keylogger is a subset of spyware, but the question asks for the most likely type, and keylogger is more precise. Option B is wrong because a rootkit is designed to hide the presence of other malware or provide persistent, stealthy access to a system by modifying operating system kernel or system calls, not to capture keystrokes directly. Option C is wrong because ransomware is malware that encrypts files or locks the system to demand a ransom, and it does not typically include keystroke capture as its primary function.

Full explanation →

36

MCQmedium

A help desk receives a phone call from someone claiming to be from IT and requesting a password reset. What type of attack is this?

A.Social engineering

B.Phishing

C.Malware

D.Vishing

AnswerD

Vishing is voice phishing conducted over phone calls.

Why this answer

Vishing (voice phishing) is a social engineering attack conducted over voice communication, such as a phone call, where the attacker impersonates a legitimate entity (e.g., IT support) to trick the victim into revealing sensitive information or performing an action like a password reset. This matches the scenario exactly: a phone call from someone claiming to be from IT requesting a password reset.

Exam trap

Cisco often tests the distinction between the general category (social engineering) and the specific attack vector (vishing, phishing, smishing), so the trap here is that candidates see 'social engineering' and select it without recognizing that the question asks for the specific type of attack based on the communication method (phone call).

How to eliminate wrong answers

Option A is wrong because social engineering is the broader category of psychological manipulation, not the specific attack vector (phone call) described; the question asks for the type of attack, not the general technique. Option B is wrong because phishing typically involves electronic communication like email or fraudulent websites, not a direct voice call. Option C is wrong because malware refers to malicious software (e.g., viruses, worms, trojans) and does not involve direct human interaction via a phone call.

Full explanation →

37

MCQmedium

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices on the same network. Which attack technique is being used?

A.Reconnaissance

B.ARP spoofing

C.Man-in-the-Middle

D.DNS poisoning

AnswerC

MitM attacks intercept and modify communications.

Why this answer

Man-in-the-Middle attacks intercept and alter communications between two parties.

Full explanation →

38

MCQhard

A SOC analyst is tuning an IPS rule that detects SQL injection attempts. The rule currently generates a high number of alerts, most of which are false positives caused by legitimate web application traffic containing SQL-like keywords. The analyst wants to reduce false positives without missing actual attacks. Which approach is most effective?

A.Implement a whitelist of known good SQL queries from the application.

B.Reduce the rule's sensitivity to only match exact attack patterns.

C.Disable the rule and rely on web application firewall logs.

D.Exclude all HTTP GET requests from inspection.

AnswerA

Whitelisting legitimate queries reduces false positives while keeping detection for other traffic.

Why this answer

Implementing a whitelist of known good SQL queries from the application allows the IPS to ignore benign traffic that matches SQL-like patterns, reducing false positives while still alerting on any SQL injection attempt that deviates from the whitelist. This approach leverages application-specific knowledge to distinguish legitimate queries from malicious ones, maintaining detection coverage for actual attacks.

Exam trap

The trap here is that candidates may think reducing sensitivity (Option B) is the best way to reduce false positives, but Cisco tests the understanding that whitelisting is a more precise method that preserves detection of varied attack patterns while eliminating noise from known benign traffic.

How to eliminate wrong answers

Option B is wrong because reducing the rule's sensitivity to only match exact attack patterns would likely cause the IPS to miss polymorphic or obfuscated SQL injection attempts that do not exactly match the predefined patterns, increasing false negatives. Option C is wrong because disabling the IPS rule and relying solely on web application firewall (WAF) logs removes the network-layer detection capability of the IPS, creating a security gap where SQL injection traffic that bypasses the WAF (e.g., due to misconfiguration or encoding differences) would go undetected. Option D is wrong because excluding all HTTP GET requests from inspection would allow SQL injection attacks delivered via GET parameters (a common vector) to pass through without any alerting, completely undermining the rule's purpose.

Full explanation →

39

Multi-Selectmedium

An analyst is examining a Linux system for signs of an attacker establishing persistence. Which TWO of the following locations should the analyst check? (Choose two.)

Select 2 answers

A./etc/passwd

B./proc/self/status

C./etc/systemd/system/

D./etc/crontab

E./home/user/.bash_history

AnswersC, D

Correct. Systemd services can be used for persistence.

Why this answer

Common persistence mechanisms on Linux include cron jobs and systemd services. Bash history only records commands, not persistence. /proc is a virtual filesystem. /etc/passwd lists users but doesn't directly show persistence.

Full explanation →

40

MCQhard

An analyst is configuring a Snort rule to detect a known exploit targeting Apache web servers. The exploit sends a malicious HTTP POST request with a long User-Agent string. Which Snort rule header and options are most appropriate?

A.alert icmp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

B.alert tcp any any -> any 443 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

C.alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

D.alert udp any any -> any 80 (content:"GET"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

AnswerC

This rule alerts on TCP to port 80, looks for POST and a long User-Agent.

Why this answer

The rule 'alert tcp any any -> any 80' matches HTTP traffic, and 'content:"POST"' detects the method. The 'pcre' option can match the long User-Agent. The other options are incorrect because they don't specify port 80 or use wrong protocols.

Full explanation →

41

Multi-Selectmedium

A security analyst is investigating a potential brute-force attack on an SSH server. Which TWO of the following log sources would provide the most relevant evidence for detecting and confirming this attack? (Choose two.)

Select 2 answers

A.IDS/IPS alerts (signature name, severity)

B.System logs (authentication events)

C.Firewall logs (allow/deny by source IP/port)

D.Web server logs (HTTP method, URL, response code)

E.DNS logs (query type, domain queried)

AnswersB, C

System logs record each login attempt (success/failure) and are critical for identifying brute-force patterns.

Why this answer

System logs contain authentication events (success/failure) which are essential to detect repeated failed SSH logins. Firewall logs show source IPs and ports being accessed (SSH port 22), which can identify the attacking IP. IDS/IPS alerts might detect brute-force patterns but are not the primary source; DNS logs and web server logs are irrelevant to SSH brute-force.

Full explanation →

42

MCQeasy

A security analyst observes a high volume of ICMP echo replies from multiple internal hosts to a single external IP address. Which type of network activity is most likely indicated?

A.Ping sweep

B.ARP spoofing

C.Port scan

D.Smurf attack

AnswerA

Ping sweep sends ICMP echo requests to multiple hosts to discover live hosts.

Why this answer

A ping sweep uses ICMP echo requests to discover live hosts; the observed high volume of ICMP echo replies from multiple internal hosts to a single external IP indicates that the external IP sent a flood of echo requests, and the internal hosts are responding. This is the classic signature of a ping sweep (or ICMP sweep) where an attacker probes a range of internal addresses to map the network.

Exam trap

Cisco often tests the distinction between a Smurf attack and a ping sweep by emphasizing that in a Smurf attack the replies are directed to a spoofed victim IP (often internal), whereas here the replies go to a single external IP, making it a sweep.

How to eliminate wrong answers

Option B is wrong because ARP spoofing involves sending forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host, which does not generate ICMP echo replies from multiple hosts to a single external IP. Option C is wrong because a port scan typically uses TCP SYN, UDP, or other transport-layer probes to discover open ports, not ICMP echo replies. Option D is wrong because a Smurf attack uses ICMP echo requests with a spoofed source IP (the victim) sent to a broadcast address, causing all hosts on the network to reply to the victim; here, replies are going to a single external IP, not a victim inside the network, and the traffic is replies, not requests.

Full explanation →

43

MCQeasy

Refer to the exhibit. What does this syslog message indicate?

A.Failed telnet attempt

B.Denied SSH connection attempt

C.Successful SSH connection

D.Allowed TCP traffic

AnswerB

The destination port 22 (SSH) was denied.

Why this answer

The syslog message '%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22]' indicates a failed login attempt on port 22, which is the default port for SSH. Since the message explicitly shows 'localport: 22' and the login failed, it corresponds to a denied SSH connection attempt, not a successful one or a Telnet attempt (which uses port 23).

Exam trap

The trap here is that candidates may confuse the 'Login failed' message with a generic 'denied' message, but Cisco specifically tests the ability to identify the protocol by the port number (22 for SSH vs. 23 for Telnet) in the syslog output.

How to eliminate wrong answers

Option A is wrong because the syslog message shows 'localport: 22', which is the default port for SSH, not Telnet (port 23); a failed Telnet attempt would reference port 23. Option C is wrong because the message explicitly states 'Login failed', indicating the connection was denied, not successful. Option D is wrong because the message indicates a failed login, not allowed TCP traffic; allowed traffic would generate a different syslog message (e.g., 'LOGIN_SUCCESS' or an ACL permit log).

Full explanation →

44

MCQeasy

Refer to the exhibit. What type of activity does this log represent?

A.Man-in-the-middle attack.

B.Denial-of-service (DoS) attack.

C.Brute force SSH attack.

D.Port scan.

AnswerC

Repeated connections to port 22 from one source suggest SSH brute-force.

Why this answer

The log shows repeated SSH connection attempts with 'Failed password' messages from the same source IP (10.10.0.5) to the same destination IP (10.10.0.3) for user 'admin'. This pattern of multiple failed authentication attempts in a short time window is characteristic of a brute force SSH attack, where an attacker systematically tries different passwords to gain unauthorized access.

Exam trap

Cisco often tests the distinction between a brute force attack (repeated authentication attempts) and a port scan (probing multiple ports), so the trap here is that candidates see multiple connection attempts and mistakenly think it is a port scan rather than recognizing the SSH-specific 'Failed password' messages.

How to eliminate wrong answers

Option A is wrong because a man-in-the-middle attack would involve intercepting or altering communications between two parties, not repeated failed login attempts. Option B is wrong because a denial-of-service attack aims to overwhelm a service with traffic to make it unavailable, whereas this log shows targeted authentication failures without evidence of resource exhaustion. Option D is wrong because a port scan typically involves sending packets to multiple ports to discover open services, not repeated login attempts to a single service (SSH on port 22).

Full explanation →

45

MCQeasy

Which command-line tool is used to capture and analyze network packets in real time?

A.Wireshark

B.tcpdump

C.Nmap

D.Nessus

AnswerB

Correct. tcpdump is a command-line packet capture utility.

Why this answer

tcpdump is a command-line packet analyzer that captures and displays network packets in real time directly from the terminal. It uses libpcap to intercept raw packets at the network interface, making it ideal for scripting and remote session analysis where a GUI is unavailable.

Exam trap

Cisco often tests the distinction between command-line and GUI tools, trapping candidates who know Wireshark is a packet analyzer but forget the question explicitly asks for a command-line tool.

How to eliminate wrong answers

Option A is wrong because Wireshark is a GUI-based packet analyzer, not a command-line tool; it uses the same underlying capture engine as tcpdump but requires a graphical environment. Option C is wrong because Nmap is a network discovery and security scanning tool that sends probes to map hosts and services, not a real-time packet capture and analysis tool. Option D is wrong because Nessus is a vulnerability scanner that assesses systems for known weaknesses, not a tool for capturing or analyzing live network packets.

Full explanation →

46

MCQeasy

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

A.GET /login?user=admin&pass=password123

B.GET /search?q=<script>alert('XSS')</script>

C.GET /products?id=1 UNION SELECT * FROM users

D.GET /index.html HTTP/1.1

AnswerC

The UNION SELECT statement is a SQL injection technique to extract data from other tables.

Why this answer

SQL injection often involves injecting SQL keywords like UNION or SELECT into parameters. 'id=1 UNION SELECT' is a classic example.

Full explanation →

47

Multi-Selectmedium

During the Containment, Eradication, and Recovery phase, which TWO actions are typically performed? (Select two.)

Select 2 answers

A.Lessons learned analysis

B.Evidence collection

C.Initial triage

D.Identifying the incident

E.Short-term containment

AnswersB, E

Collecting forensic evidence before eradication.

Why this answer

Short-term containment (e.g., isolating systems) and evidence collection are key activities in this phase.

Full explanation →

48

MCQhard

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

A.Distributed denial-of-service (DDoS) attack from the server

B.Brute-force attack on the server's SSH service

C.SQL injection attack against the server

D.Command-and-control (C2) communication from malware on the server

AnswerD

Malware often uses HTTPS outbound to establish C2 while evading detection.

Why this answer

A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.

Exam trap

Cisco often tests the distinction between inbound attack types (like SQL injection or brute-force) and outbound indicators of compromise (like C2 traffic), leading candidates to confuse the direction of the traffic with the attack vector.

How to eliminate wrong answers

Option A is wrong because a DDoS attack from the server would involve sending a high volume of traffic to a target, but the question describes a spike to a single external IP, not a distributed flood, and the server is not typically used as an attack source. Option B is wrong because a brute-force attack on SSH would target TCP port 22, not 443, and would generate inbound traffic, not outbound spikes. Option C is wrong because an SQL injection attack is an inbound web application attack that manipulates database queries, not a cause of outbound traffic spikes to an external IP on port 443.

Full explanation →

49

MCQeasy

An analyst is monitoring network traffic and notices a host sending ICMP echo requests to multiple hosts in the same subnet with a pattern of incrementing TTL values. What is the most likely purpose of this activity?

A.DNS resolution attempt.

B.Ping sweep to identify active hosts.

C.Denial of service attack against a specific host.

D.Traceroute to map the network topology.

AnswerD

Incrementing TTL is typical of traceroute.

Why this answer

The pattern of incrementing TTL values in ICMP echo requests is the hallmark of a traceroute operation. Traceroute works by sending packets with TTL=1, then TTL=2, etc., so each successive router along the path decrements the TTL to 0 and sends back an ICMP Time Exceeded message, revealing the hop-by-hop path. The target host responds with an ICMP Echo Reply when the TTL is high enough to reach it, confirming the final hop.

Exam trap

Cisco often tests the distinction between a ping sweep (fixed TTL, multiple destinations) and a traceroute (incrementing TTL, single destination), so the trap here is confusing the pattern of incrementing TTLs with a simple liveness scan.

How to eliminate wrong answers

Option A is wrong because DNS resolution uses queries to a DNS server (typically UDP port 53), not ICMP echo requests with incrementing TTLs. Option B is wrong because a ping sweep sends ICMP echo requests with a fixed TTL (usually 128 or 64) to multiple hosts to check liveness, not incrementing TTL values. Option C is wrong because a denial of service attack against a specific host would flood that single target with traffic, not send incrementing TTL probes to multiple hosts in the subnet.

Full explanation →

50

MCQeasy

Which protocol and port pair is commonly used for secure web traffic?

A.HTTPS 443

B.FTP 21

C.HTTP 80

D.SSH 22

AnswerA

HTTPS provides encryption and uses port 443.

Why this answer

HTTPS (HTTP Secure) uses port 443 for encrypted web traffic.

Full explanation →

51

MCQhard

A security analyst is reviewing host-based logs from a compromised system. The Windows Security Event Log shows multiple Event ID 4625 (failed logon) from a single source IP, but no successful logon. The network team confirms that IP is a known scanning host. What is the most likely explanation for the lack of successful logon events?

A.The brute-force attack did not succeed in gaining access

B.The logon type was interactive, which is not recorded by Event ID 4625

C.The attacker successfully logged in but the logs were deleted by the attacker

D.The attacker used a pass-the-hash technique that bypasses logon events

AnswerA

Failed logons without success indicate the attacker did not compromise the account.

Why this answer

Event ID 4625 specifically records failed logon attempts. The absence of a corresponding Event ID 4624 (successful logon) from the same source IP indicates that none of the authentication attempts succeeded. Since the network team confirms the IP belongs to a known scanning host, the most likely explanation is that the brute-force attack failed to guess valid credentials.

Exam trap

Cisco often tests the misconception that a lack of successful logon events means the logs were tampered with or that certain attack types bypass logging, when in fact the absence of Event ID 4624 alongside multiple 4625 events is the definitive indicator of a failed brute-force attack.

How to eliminate wrong answers

Option B is wrong because Event ID 4625 records all failed logon attempts regardless of logon type, including interactive, network, and remote logon types; the logon type is a field within the event, not a filter for whether the event is generated. Option C is wrong because while an attacker could delete logs after a successful login, the question explicitly states the logs show multiple Event ID 4625 events but no successful logon events; if logs were deleted, the 4625 events would likely also be missing or the deletion would be evident via Event ID 1102 (log clear). Option D is wrong because pass-the-hash attacks still generate Windows Security Event Log entries; a successful pass-the-hash logon would produce Event ID 4624 (successful logon) with Logon Type 3 (network) or 9 (new credentials), not bypass logon event generation.

Full explanation →

52

MCQhard

When analyzing a suspicious PE file, the analyst calculates the file's entropy and finds it to be 7.8. What does a high entropy value typically indicate, and why is it relevant to malware analysis?

A.The file is likely packed or encrypted to evade signature-based detection.

B.The file contains no executable code.

C.The file is likely a legitimate application with high compression.

D.The file's imports are all standard Windows DLLs.

AnswerA

Malware often uses packing to obfuscate code, resulting in high entropy.

Why this answer

A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Exam trap

Cisco often tests the misconception that high entropy always means the file is malicious, when in fact it only indicates obfuscation or packing—legitimate files can also be packed (e.g., some installers), so entropy must be combined with other indicators like suspicious imports or network signatures.

How to eliminate wrong answers

Option B is wrong because a file with high entropy can still contain executable code that is simply obfuscated; the entropy value does not indicate the absence of code. Option C is wrong because legitimate applications rarely achieve entropy values near 7.8 through compression alone—standard compression algorithms like ZIP or LZMA produce entropy values around 6.5–7.0, not 7.8, and such high entropy is more characteristic of encryption or strong packing. Option D is wrong because the entropy calculation is based on the byte distribution of the entire file, not on the import table; a file with standard Windows DLL imports could still have high entropy if its code section is packed.

Full explanation →

53

MCQhard

You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?

A.Isolate the host from the network to prevent further C2 communication

B.Analyze packet captures to determine the full extent of the compromise

C.Block all outbound HTTPS traffic from the network

D.Reimage the host immediately to remove the malware

AnswerA

Isolation stops active communication and allows for forensic analysis.

Why this answer

The immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.

Exam trap

Cisco often tests the incident response priority order, and the trap here is that candidates choose analysis (Option B) or remediation (Option D) first, forgetting that containment (Option A) is the immediate required step per NIST SP 800-61 and Cisco's own incident handling framework.

How to eliminate wrong answers

Option B is wrong because analyzing packet captures to determine the full extent of compromise is a secondary step; the first action must be containment to prevent ongoing C2 traffic and lateral movement. Option C is wrong because blocking all outbound HTTPS traffic from the network is an overly broad and disruptive measure that would break legitimate business operations, and it is not a targeted containment action. Option D is wrong because reimaging the host immediately destroys volatile evidence (e.g., memory-resident malware, active network connections) and should only be performed after forensic data collection and containment.

Full explanation →

54

MCQhard

A security analyst is selecting a symmetric encryption algorithm for encrypting data at rest. Which of the following is a suitable symmetric algorithm?

A.AES

B.ECC

C.RSA

D.SHA-256

AnswerA

AES is a symmetric block cipher.

Why this answer

AES is a widely used symmetric encryption algorithm.

Full explanation →

55

MCQhard

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

A.It allows MySQL traffic from internal network to DMZ

B.It allows MySQL traffic from DMZ to internal network and blocks all other traffic

C.It blocks all traffic from DMZ to internal network

D.It allows any traffic from DMZ to internal network

AnswerB

The first line permits MySQL (port 3306), the second denies everything else.

Why this answer

The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network.

Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.

Exam trap

Cisco often tests the direction of ACL application—candidates frequently mistake inbound vs. outbound filtering, leading them to think the ACL controls traffic from the internal network when it actually controls traffic from the DMZ.

How to eliminate wrong answers

Option A is wrong because the ACL is applied inbound on the DMZ interface, so it controls traffic from the DMZ to the internal network, not from the internal network to the DMZ; MySQL traffic from internal to DMZ would require a different ACL on the internal interface. Option C is wrong because the ACL does not block all traffic; it explicitly permits MySQL (port 3306) traffic from the DMZ to the internal network. Option D is wrong because the ACL does not allow any traffic; it only permits MySQL and then denies all other traffic with the implicit deny any at the end.

Full explanation →

56

MCQhard

An investigator seizes a laptop as evidence from a crime scene. At the scene, the laptop is turned on and a log file is open. What should the investigator do to preserve evidence according to chain of custody procedures?

A.Close the log file and copy it to a USB drive

B.Shut down the laptop and remove the hard drive

C.Execute the log file to ensure it is legitimate

D.Photograph the screen and create a forensic image

AnswerD

This captures the current state and preserves the evidence.

Why this answer

The investigator must first document the volatile state of the evidence by photographing the screen (capturing the open log file) and then create a forensic image (bit-for-bit copy) of the entire hard drive. This preserves the original data integrity and adheres to chain of custody procedures, ensuring that the evidence is not altered and can be verified later via hash verification (e.g., MD5 or SHA-256).

Exam trap

Cisco often tests the misconception that shutting down a live system is safe, but the trap here is that volatile data (like the open log file's contents in memory) is lost and the shutdown process itself can alter the disk, making forensic imaging the only correct preservation method.

How to eliminate wrong answers

Option A is wrong because closing the log file and copying it to a USB drive modifies the file's metadata (e.g., last accessed time) and risks altering the original evidence, violating forensic best practices. Option B is wrong because shutting down the laptop can cause loss of volatile data (e.g., RAM contents, open network connections) and may trigger write operations during the shutdown process, corrupting evidence. Option C is wrong because executing the log file could modify system state, trigger malware, or alter timestamps, which compromises the integrity of the evidence and is not a standard forensic procedure.

Full explanation →

57

Multi-Selecteasy

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Select 2 answers

A.A low level of network utilization on the target server

B.A gradual increase in traffic from multiple geographic locations

C.A high number of DNS queries from diverse source IPs

D.A sudden increase in traffic from a single source IP address

E.A large number of incomplete TCP connections (SYN packets without ACK)

AnswersD, E

This indicates a potential DoS attack from that IP.

Why this answer

A sudden increase in traffic from a single source IP address is a classic indicator of a direct DoS attack, where the attacker uses a single compromised host to flood the target with packets, overwhelming its resources. This contrasts with a distributed denial-of-service (DDoS) attack, which uses multiple sources. The abrupt spike in volume from one IP is a clear anomaly that network monitoring tools flag as a potential DoS event.

Exam trap

Cisco often tests the distinction between a single-source DoS attack (option D) and a distributed DDoS attack (options B and C), where candidates may confuse the gradual increase from multiple locations as a DoS indicator instead of recognizing it as a DDoS characteristic.

Full explanation →

58

MCQhard

A SOC analyst is tuning a correlation rule that detects DNS tunneling. The rule currently generates 500 alerts per day, but only 5% are true positives. Which tuning approach would best reduce false positives while maintaining detection efficacy?

A.Lower the entropy threshold for domain names from 3.5 to 2.0.

B.Disable the rule and rely on manual review of DNS logs.

C.Increase the observation time window from 1 hour to 24 hours.

D.Add a condition that the number of unique domains queried per source IP exceeds 10 per minute.

AnswerD

This threshold helps differentiate tunneling from normal DNS behavior.

Why this answer

DNS tunneling typically involves a single infected host querying many unique domains (often algorithmically generated) at a high rate to exfiltrate data. By requiring more than 10 unique domains per minute per source IP, the rule filters out low-volume, legitimate DNS traffic that may have slightly random-looking domains, while still catching the high-frequency queries characteristic of active tunneling. This reduces the false positive rate from 95% to a more manageable level without requiring a lower entropy threshold that would miss subtle tunneling.

Exam trap

Cisco often tests the misconception that lowering a threshold (like entropy) always reduces false positives, when in fact it can have the opposite effect by making the rule more sensitive to benign traffic.

How to eliminate wrong answers

Option A is wrong because lowering the entropy threshold from 3.5 to 2.0 would make the rule less selective, causing it to flag more domains as suspicious (including many legitimate domains with slightly random names), which would increase false positives rather than reduce them. Option B is wrong because disabling the rule and relying on manual review of DNS logs is not a tuning approach—it eliminates automated detection entirely, sacrificing detection efficacy and overwhelming the analyst with raw log data. Option C is wrong because increasing the observation time window from 1 hour to 24 hours would aggregate more DNS queries per source IP, likely causing the rule to trigger on normal cumulative traffic patterns (e.g., a user visiting many websites over a day), which would increase false positives without improving detection of tunneling.

Full explanation →

59

Multi-Selecthard

An organization wants to ensure data integrity and non-repudiation for sensitive documents. Which THREE cryptographic mechanisms should be implemented? (Select three.)

Select 3 answers

A.Steganography

B.Digital signatures

C.Hashing

D.Asymmetric encryption

E.Symmetric encryption

AnswersB, C, D

Digital signatures authenticate the sender and provide non-repudiation.

Why this answer

Digital signatures provide both data integrity and non-repudiation by using the sender's private key to sign a hash of the document. The recipient verifies the signature with the sender's public key, ensuring the document has not been altered and that the sender cannot deny having signed it.

Exam trap

Cisco often tests the distinction between integrity-only mechanisms (hashing) and those that also provide non-repudiation (digital signatures), leading candidates to incorrectly select symmetric encryption or steganography when the question explicitly requires both integrity and non-repudiation.

Full explanation →

60

MCQmedium

A security analyst is investigating an alert that indicates a host is sending a large number of DNS queries to an external domain. The analyst wants to determine if the traffic is malicious and if it is using a DNS tunnel. Which type of analysis should the analyst perform to confirm the presence of a DNS tunnel?

A.Analyze the payload size and query frequency of the DNS packets to detect anomalous patterns.

B.Check the volume of DNS traffic from the host to identify any increase over baseline.

C.Examine the source IP addresses of the DNS queries to see if they originate from multiple hosts.

D.Review the firewall logs to identify any blocked DNS queries to the external domain.

AnswerA

DNS tunneling typically uses large payloads and unusual query patterns.

Why this answer

DNS tunneling typically involves encoding data within DNS queries or responses, resulting in abnormally large payload sizes and unusual query frequencies. By analyzing these specific packet attributes, an analyst can detect the anomalous patterns characteristic of a DNS tunnel, such as high query rates to a single domain or payloads exceeding standard DNS message sizes (e.g., >512 bytes for UDP). This direct inspection of DNS packet content is the most reliable method to confirm tunneling activity.

Exam trap

Cisco often tests the distinction between detecting a general anomaly (e.g., high traffic volume) and confirming a specific technique (e.g., DNS tunneling), where candidates mistakenly choose a broad indicator like traffic volume (Option B) instead of the packet-level analysis that directly reveals the tunneling mechanism.

How to eliminate wrong answers

Option B is wrong because simply checking the volume of DNS traffic against a baseline may indicate an anomaly but does not specifically confirm a DNS tunnel; legitimate applications (e.g., frequent updates) can also cause increased volume. Option C is wrong because examining source IP addresses to see if queries originate from multiple hosts is more relevant to identifying a distributed attack (e.g., DDoS) or a compromised network segment, not a single-host DNS tunnel. Option D is wrong because reviewing firewall logs for blocked queries only shows which queries were denied, not whether a tunnel exists; a DNS tunnel often uses allowed queries (e.g., to an external domain) and may not be blocked at all.

Full explanation →

61

MCQmedium

What is the primary difference between symmetric and asymmetric encryption?

A.Asymmetric encryption is used only for hashing

B.Symmetric uses two keys, asymmetric uses one

C.Symmetric is slower than asymmetric

D.Symmetric uses a single shared key; asymmetric uses a key pair

AnswerD

Correct: symmetric uses one key for both operations; asymmetric uses a public and private key.

Why this answer

Symmetric uses one shared key; asymmetric uses a public-private key pair.

Full explanation →

62

Multi-Selectmedium

An analyst identifies a series of SMB authentication attempts from a compromised host to multiple internal servers. The authentication uses NTLM hashes. Which TWO techniques are most likely being used for lateral movement? (Select 2)

Select 2 answers

A.Kerberoasting

B.SMB relay

C.Brute force

D.Golden ticket

E.Pass-the-hash

AnswersB, E

Relays authentication to other hosts.

Why this answer

SMB relay (B) is correct because the attacker can intercept NTLM authentication attempts from the compromised host and relay them to other internal servers, gaining unauthorized access without needing to crack the hash. This technique leverages the SMB protocol's lack of channel binding in older implementations, allowing the relayed hash to authenticate to multiple targets.

Exam trap

Cisco often tests the distinction between 'pass-the-hash' (reusing a hash directly from the compromised host) and 'SMB relay' (forwarding the authentication challenge to another server), which candidates confuse as the same technique.

Full explanation →

63

MCQhard

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

A.DNS tunneling for data exfiltration.

B.HTTP beaconing to a C2 server.

C.DNS amplification attack.

D.Port scanning using DNS.

AnswerA

Uses DNS queries to covertly send data.

Why this answer

The sudden spike in DNS queries to random subdomains of a legitimate domain (e.g., randomstring.google.com) is a classic indicator of DNS tunneling. This technique encodes data into DNS query names and exfiltrates it through the DNS protocol, bypassing network security controls that allow DNS traffic.

Exam trap

Cisco often tests the distinction between DNS tunneling (data exfiltration) and DNS amplification (DDoS attack), so candidates may confuse the high volume of queries in tunneling with the reflection/amplification mechanism of a DDoS attack.

How to eliminate wrong answers

Option B is wrong because HTTP beaconing involves periodic HTTP requests to a C2 server, not a burst of DNS queries to random subdomains. Option C is wrong because a DNS amplification attack uses open resolvers to flood a victim with large DNS responses, not queries from an internal host to a legitimate domain. Option D is wrong because port scanning using DNS would involve querying DNS for SRV or other records to map services, not random subdomain queries for data exfiltration.

Full explanation →

64

MCQeasy

A network administrator has configured a SPAN port to send traffic to an intrusion detection system (IDS). However, the IDS is not seeing traffic from a specific VLAN. What is the most likely cause?

A.The SPAN source does not include that VLAN.

B.The IDS interface is set to promiscuous mode.

C.The SPAN destination port is in trunk mode.

D.The IDS is in inline mode.

AnswerA

If the VLAN is not in the SPAN source list, its traffic is not monitored.

Why this answer

A SPAN (Switched Port Analyzer) port copies traffic from specified source interfaces or VLANs to a destination port. If the IDS is not seeing traffic from a specific VLAN, the most likely cause is that the SPAN configuration does not include that VLAN as a source. The administrator must explicitly specify the VLAN(s) to monitor using the `monitor session` command with the `vlan` keyword; otherwise, traffic from that VLAN will not be forwarded to the IDS.

Exam trap

Cisco often tests the misconception that SPAN automatically mirrors all VLANs on a trunk port, when in fact the administrator must explicitly specify which VLANs to monitor using the `vlan` keyword in the SPAN configuration.

How to eliminate wrong answers

Option B is wrong because setting the IDS interface to promiscuous mode is a requirement for the IDS to receive all packets on a SPAN destination, not a cause of missing VLAN traffic. Option C is wrong because the SPAN destination port being in trunk mode is irrelevant; SPAN destination ports are typically access ports or configured as trunk only if needed for encapsulation, but trunk mode does not prevent traffic from a specific VLAN from being seen. Option D is wrong because if the IDS were in inline mode, it would be placed directly in the traffic path and would inherently see all VLAN traffic; the problem described is about a SPAN-based (out-of-band) deployment, so inline mode is not applicable.

Full explanation →

65

MCQeasy

What is the primary goal of the 'integrity' pillar of the CIA triad?

A.Keep data secret from unauthorized users

B.Ensure data is accessible when needed

C.Provide proof that a user performed an action

D.Protect data from unauthorized modification

AnswerD

Integrity prevents unauthorized changes.

Why this answer

The 'integrity' pillar of the CIA triad ensures that data is not altered or tampered with by unauthorized parties. This is achieved through mechanisms such as hashing (e.g., SHA-256), checksums, and digital signatures that detect any unauthorized modification. Option D correctly identifies this goal, as protecting data from unauthorized modification is the core purpose of integrity controls.

Exam trap

Cisco often tests the distinction between integrity and non-repudiation, as candidates may confuse 'proof of action' (non-repudiation) with 'data unchanged' (integrity), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because keeping data secret from unauthorized users is the goal of the 'confidentiality' pillar, not integrity. Option B is wrong because ensuring data is accessible when needed is the goal of the 'availability' pillar, not integrity. Option C is wrong because providing proof that a user performed an action is the goal of 'non-repudiation', which is often associated with digital signatures and audit logs, not the integrity pillar itself.

Full explanation →

66

MCQmedium

You are analyzing network traffic from a compromised host. The host is running Windows and is connected to a corporate network. The IDS generated an alert for a known malware signature matching traffic from the host to an external IP on port 443. However, you see that the traffic is encrypted and the destination IP is a cloud storage provider. The host also shows periodic DNS queries to a domain that closely resembles the cloud provider's domain but with a single character difference (typosquatting). The employee on that host reports no unusual activity. Which step should you take first to confirm the compromise?

A.Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.

B.Dismiss the alert as a false positive because the user reports no issues.

C.Examine the full packet capture for the encrypted session to see the payload.

D.Enable SSL/TLS decryption on the corporate firewall to inspect the encrypted traffic.

AnswerA

DNS logs can show resolution of suspicious domains, indicating potential C2 communication.

Why this answer

Correlating DNS logs with encrypted traffic timestamps is the fastest, least intrusive way to confirm whether the host actually communicated with the typosquatted domain. If the DNS query for the lookalike domain resolved just before the encrypted session to the external IP, it strongly indicates the malware is using the typosquatted domain for command-and-control (C2) over HTTPS, bypassing simple domain-based blocklists. This step validates the alert without requiring decryption or assuming user reports are reliable.

Exam trap

Cisco often tests the misconception that encrypted traffic cannot be analyzed at all, leading candidates to choose decryption (Option D) as the first step, when in fact DNS log correlation is a non-disruptive, immediate method to confirm the compromise.

How to eliminate wrong answers

Option B is wrong because user reports are unreliable in compromise scenarios—malware often runs silently without user-visible symptoms, and dismissing the alert based on user feedback ignores the IDS signature and DNS evidence. Option C is wrong because the traffic is encrypted (TLS/SSL), so examining the full packet capture will only show encrypted payloads; without the session keys, you cannot see the plaintext content. Option D is wrong because enabling SSL/TLS decryption on the corporate firewall is a major operational change that requires policy approval, certificate deployment, and may break certificate pinning; it is not a first step and could alert the malware if it checks for interception.

Full explanation →

67

MCQmedium

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a server is sending encrypted data to an external IP address during non-business hours. The server is supposed to only communicate with internal systems. What is the best immediate action?

A.Disconnect the server from the network

B.Block the external IP address at the firewall

C.Notify the server's administrator

D.Capture a packet capture (PCAP) of the traffic for analysis

AnswerA

This immediately stops data transfer, preserving evidence and preventing further loss.

Why this answer

Disconnecting the server from the network immediately stops the potential data exfiltration by severing all communication paths. This is the fastest way to contain the threat and prevent further data loss, aligning with the first step in incident response: containment. In a suspected exfiltration scenario, preserving the system state for forensic analysis is secondary to stopping the active data transfer.

Exam trap

Cisco often tests the principle that containment must precede analysis; the trap here is that candidates choose 'Capture a PCAP' (Option D) because they think evidence collection is the first step, but in an active exfiltration, stopping the data loss is the priority.

How to eliminate wrong answers

Option B is wrong because blocking the external IP address at the firewall only prevents traffic to that specific IP, but the server could still be compromised and may attempt to communicate with other external IPs or use alternate protocols (e.g., DNS tunneling) to exfiltrate data. Option C is wrong because notifying the server's administrator introduces unnecessary delay; the immediate priority is containment, not notification, and the administrator may not be available or may inadvertently alert an insider threat. Option D is wrong because capturing a packet capture (PCAP) of the traffic for analysis is a forensic step that should occur after containment; continuing to allow the traffic to flow while capturing could result in further data loss and gives the attacker more time to complete the exfiltration.

Full explanation →

68

MCQhard

A security analyst is responding to an incident on a critical Windows server that hosts a database application. The server is running Windows Server 2019 with all current patches. The analyst suspects that a remote attacker gained access and is using living-off-the-land binaries to move laterally. The analyst has captured a memory dump and a full disk image. The analyst needs to determine if the attacker used PowerShell to download additional tools. Which analysis step should the analyst perform first to identify PowerShell usage?

A.Examine the Windows Registry for Run keys to identify persistence mechanisms.

B.Parse PowerShell operational logs (Event ID 4104) to extract executed scripts and commands.

C.Review prefetch files (.pf) to determine when PowerShell was last executed.

D.Analyze network connection logs to identify outbound connections to known malicious IPs.

AnswerB

PowerShell ScriptBlock logging captures the full script content, directly showing attacker commands.

Why this answer

PowerShell operational logs, specifically Event ID 4104 (Script Block Logging), capture the full text of PowerShell scripts and commands executed on the system. Since the analyst suspects the attacker used PowerShell to download additional tools, parsing these logs is the most direct and efficient first step to confirm that activity. This log source provides the actual commands run, including any download commands like Invoke-WebRequest or Start-BitsTransfer, without relying on indirect artifacts.

Exam trap

Cisco often tests the distinction between artifacts that show execution (prefetch, registry) versus artifacts that capture the actual command or script content (PowerShell operational logs), leading candidates to choose a less direct indicator like prefetch files.

How to eliminate wrong answers

Option A is wrong because examining Windows Registry Run keys focuses on persistence mechanisms (e.g., programs that start automatically), not on identifying whether PowerShell was used to download tools during the incident. Option C is wrong because prefetch files (.pf) only show that PowerShell.exe was launched and when, but they do not reveal the specific commands or scripts executed, so they cannot confirm tool downloads. Option D is wrong because analyzing network connection logs may show outbound connections but does not directly prove PowerShell was the method used; the attacker could have used other tools or protocols, and logs may be incomplete or not capture encrypted traffic.

Full explanation →

69

MCQhard

A company's security policy states that all network traffic must be inspected by an IPS. However, encrypted traffic (SSL/TLS) is bypassing inspection. The network team wants to implement SSL decryption. What is the primary policy consideration before implementing?

A.Configure the firewall to block SSL traffic that cannot be decrypted.

B.Notify all users that their traffic will be inspected.

C.Create a certificate authority to issue certificates to all internal servers.

D.Ensure that the SSL decryption device has enough CPU capacity.

E.Obtain legal approval for decryption of user traffic.

AnswerE

Decryption raises privacy and legal issues.

Why this answer

SSL/TLS decryption involves intercepting and inspecting encrypted communications, which can violate privacy laws and regulations such as GDPR, HIPAA, or the Wiretap Act. Before implementing decryption, the organization must obtain legal approval to ensure compliance with applicable laws and to define the scope of inspection, especially regarding personal or sensitive data. Without legal clearance, the company could face severe penalties, even if the technical implementation is sound.

Exam trap

Cisco often tests the distinction between policy considerations (legal, regulatory, organizational) and technical implementation steps (certificates, performance, blocking rules), leading candidates to confuse a technical prerequisite with the primary policy requirement.

How to eliminate wrong answers

Option A is wrong because blocking all SSL traffic that cannot be decrypted is a technical control, not a primary policy consideration; it addresses what to do with non-decryptable traffic after the decision to decrypt is made, but the foundational policy step is legal approval. Option B is wrong because notifying users is an operational or transparency step that should follow legal approval, but it is not the primary policy consideration; notification alone does not satisfy legal or regulatory requirements. Option C is wrong because creating a certificate authority (CA) to issue certificates to internal servers is a technical implementation step for SSL decryption (e.g., for man-in-the-middle inspection), but it does not address the policy or legal justification required before deploying such a solution.

Option D is wrong because ensuring the SSL decryption device has enough CPU capacity is a performance and capacity planning consideration, not a policy consideration; it is a technical prerequisite that comes after the policy and legal framework is established.

Full explanation →

70

MCQeasy

Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?

A.Windows Event Logs

B.Registry hives

C.Scheduled tasks

D.Prefetch files

AnswerD

Prefetch files are in C:\Windows\Prefetch.

Why this answer

Prefetch files (*.pf) are created by Windows to speed up application loading. They contain metadata about executed programs, including execution count and last run time.

Full explanation →

71

MCQeasy

A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?

A./var/log/kern.log

B./var/log/auth.log

C./var/log/messages

D./var/log/syslog

AnswerB

auth.log is the standard authentication log.

Why this answer

On most Linux distributions, /var/log/auth.log (or /var/log/secure on Red Hat-based systems) records authentication events including SSH logins.

Full explanation →

72

MCQeasy

A network administrator is using Cisco ISE to monitor endpoint authentication. Which report provides details on failed authentication attempts and the reasons?

A.RADIUS Authentication Report

B.Endpoint Profiler Report

C.RADIUS Accounting Report

D.Active Session Report

AnswerA

This report includes details of authentication attempts and failure reasons.

Why this answer

The RADIUS Authentication Report in Cisco ISE specifically logs all authentication attempts, including failures, and provides detailed reasons for each failure (e.g., invalid credentials, user not found, or authorization policy mismatch). This report is the primary tool for troubleshooting failed authentications because it captures the RADIUS Access-Reject messages and the corresponding failure reasons from the ISE policy evaluation.

Exam trap

Cisco often tests the distinction between RADIUS Authentication (which captures failures and reasons) and RADIUS Accounting (which tracks session usage), leading candidates to mistakenly choose the Accounting report when asked about failed authentications.

How to eliminate wrong answers

Option B is wrong because the Endpoint Profiler Report focuses on endpoint classification and profiling (e.g., OS, device type) based on probe data, not on authentication success or failure details. Option C is wrong because the RADIUS Accounting Report tracks session start, stop, and interim updates (e.g., traffic usage, session duration), not authentication failures or their reasons. Option D is wrong because the Active Session Report shows currently active authenticated sessions, not historical failed attempts or the reasons for those failures.

Full explanation →

73

MCQhard

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

A.Accept the risk because the mitigation cost is higher than the ALE

B.Avoid the risk by discontinuing the activity

C.Transfer the risk by purchasing cyber insurance

D.Mitigate the risk by implementing the control

AnswerD

Since the mitigation cost is less than the ALE, it is cost-effective to mitigate.

Why this answer

If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Full explanation →

74

MCQmedium

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

A.tcp.stream

B.tcp.port

C.http.request

D.ip.addr

AnswerA

Filters by TCP stream index for conversation reconstruction.

Why this answer

The tcp.stream filter allows viewing a specific TCP stream by its number, which is useful for analysis.

Full explanation →

75

Multi-Selectmedium

Which TWO incident types must be reported within 1 hour under the company's incident response policy?

Select 2 answers

A.Unauthorized access

B.Malware outbreak

C.Phishing simulation failure

D.Spam campaign

E.Policy violation

AnswersA, B

Unauthorized access is a security breach requiring immediate action.

Why this answer

Unauthorized access is a security incident that directly compromises the confidentiality, integrity, or availability of systems or data. Under most incident response policies, including those aligned with NIST SP 800-61, any confirmed unauthorized access must be reported within 1 hour to initiate containment and prevent lateral movement or data exfiltration.

Exam trap

Cisco often tests the distinction between actual security incidents (unauthorized access, malware outbreak) and operational nuisances (spam, policy violations) to see if candidates understand the urgency criteria defined in incident response policies.

Full explanation →

Page 1 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 200-201 by domain

Target a specific domain to shore up weak areas.

Security Policies and Procedures Security Monitoring Network Intrusion Analysis Host-Based Analysis Security Concepts

See all domains with question counts →