Cisco CyberOps Associate 200-201 (200-201) — Questions 751–825

Repeated denied TCP connections from the same source to the same destination web server are a classic indicator of a potential reconnaissance or attack pattern, such as a port scan or brute-force attempt. The first priority in security monitoring is to investigate the source IP for malicious activity (Option C) to determine intent and scope before taking any irreversible action. This aligns with the incident response process of identification and analysis before containment or eradication.

A decrease in security incidents attributed to user error directly measures the behavioral outcome of the training. Effective security awareness training should reduce the frequency of incidents caused by human mistakes, such as clicking malicious links or mishandling data. This metric reflects the ultimate goal of the training, not just participation or short-term knowledge retention.

A hardware token for remote access implements multifactor authentication (something you have), which directly prevents unauthorized access by requiring a physical device in addition to credentials. This is a preventive control because it stops the threat before it can occur, aligning with the NIST definition of preventive controls that block or mitigate attacks.

False positives occur when IPS signatures incorrectly match legitimate traffic. The most direct and effective tuning approach is to disable or modify the specific signatures causing the false positives, which reduces unnecessary blocking without compromising overall security posture.

Web server logs record HTTP requests and responses, including methods, URLs, response codes, and user-agent information.

The correct sequence for packet capture analysis starts by opening the capture file, then applying filters to isolate relevant traffic, examining the filtered packets for anomalies, correlating findings across different packets or sessions, and finally documenting the analysis results for reporting and future reference. This order ensures efficiency and accuracy.

The 'sc query' command queries the Service Control Manager for service status and configuration, and with 'sc qc' it reveals the binary path, start type, and service account — exactly what's needed to spot non-standard service names or paths. It works from the command line, making it suitable for scripted forensic triage. Analysts use 'sc query state= all' to enumerate all services and 'sc qc <name>' to inspect suspicious ones.

The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry hive stores the configuration for all Windows services, including their executable paths and startup types. Malware often installs itself as a service to achieve persistence, and evidence of this can be found by examining the ImagePath value under a suspicious service subkey. This is the correct location for service-based persistence, unlike the Run keys which handle startup programs for users.

A vulnerability is a weakness or flaw in a system's design, configuration, or code that could be exploited to violate security. The scenario describes a path traversal weakness in the server configuration, which is a classic vulnerability. This is the precise security term for the condition described.

The firewall logs show multiple denied TCP connection attempts from a single external IP to various internal IPs on different ports (e.g., 80, 443, 22). This pattern of sequential probes across multiple destinations and ports is characteristic of a port scan, where an attacker systematically probes for open services. The rule OUTSIDE_IN is correctly logging and blocking these attempts, indicating the firewall is functioning as designed to prevent reconnaissance.

The alert indicates an anomaly (unusual hour), but not necessarily malicious activity. The most appropriate first step is to verify the user's intent through direct communication, as this aligns with the principle of validation before escalation. In security monitoring, contacting the user helps confirm whether the access was authorized, reducing false positives and unnecessary incident response activation.

To ensure proper evidence collection and preservation of chain of custody, the analyst should make a bit-for-bit copy of the audit log files using a forensic tool, hash both the original and the copy, and document the process. This maintains the integrity of the evidence and provides a verifiable record. Hashing ensures that any tampering can be detected, and documentation establishes the chain of custody.

DNS tunneling often involves high volumes of DNS queries to a single domain, large payloads in TXT records, and encoded data in subdomains to exfiltrate data.

Isolating the host from the network immediately stops the outbound connections to known malicious destinations, preventing further data exfiltration, lateral movement, or command-and-control (C2) communication. This containment step is critical in incident response to limit the blast radius before any other investigative or remediation actions are taken.

A SPAN session on a managed switch replicates traffic from a source interface or VLAN to a destination port. When a rogue administrator or attacker with device access creates such a session aimed at an unknown internal host, every frame on the radiology VLAN is duplicated there while normal forwarding continues unaffected. The other techniques either degrade forwarding, enable cross-VLAN access, or manipulate host caches rather than producing a sustained, targeted copy of one VLAN's traffic.

Under Article 33 of the GDPR, a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it. This 72-hour window is the maximum timeframe, making option B correct for the 200-201 exam context.

The log entry shows a deny action for traffic from internal IP 10.0.0.5 to external IP 203.0.113.50 on TCP port 445, which is the default port for SMB (Server Message Block) protocol. Since the source is internal (RFC 1918 address) and the destination is external, this indicates an outbound connection attempt that was blocked by the firewall. SMB is commonly used for file sharing and is often restricted outbound to prevent data exfiltration or malware propagation.

AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning the same secret key is used for both encryption and decryption. It operates on fixed-size blocks (128 bits) with key sizes of 128, 192, or 256 bits and is the current NIST standard for symmetric encryption. Because both parties must share the same key, AES is fast and efficient for bulk data encryption.

The Preparation phase includes developing the IR plan, team, tools, and conducting exercises.

Unusual spikes in outbound network traffic at odd hours (Option C) are a common indicator of a compromised host because they often signal data exfiltration, command-and-control (C2) beaconing, or botnet activity. Attackers frequently schedule malicious traffic during off-peak hours to evade detection, and the abnormal volume or timing relative to baseline behavior is a key anomaly in security monitoring.

SRUM maintains a rolling record of per-application resource usage, including bytes sent and received and network interface activity, in the SRUDB.dat ESE database. Because it is populated by the SRUM service rather than by the APIs malware commonly hooks to hide from netstat or GetTcpTable, it can surface external communications that live commands miss. Parsing SRUM therefore gives the analyst network evidence the live system concealed.

SSH configuration requires domain name, RSA keys, a local user, and enabling SSH on vty lines.

SSL/TLS interception using a proxy with a trusted certificate allows the IPS to decrypt, inspect, and re-encrypt HTTPS traffic. The proxy acts as a man-in-the-middle, presenting a certificate trusted by internal clients, so the IPS can apply security policies to the decrypted content before forwarding it to the internet.

The legitimate svchost.exe (Service Host) runs from C:\Windows\System32, not C:\Windows\Temp. The Temp directory is a common location for malware to masquerade as system processes to evade detection. High CPU usage combined with an anomalous path strongly indicates malicious activity, as legitimate svchost.exe instances are signed by Microsoft and reside in System32.

The log entry shows 'Accepted password for admin from 10.10.10.10 port 22 ssh2' followed by 'Failed password for root from 10.10.10.10 port 22 ssh2'. The sequence indicates that the attacker first successfully logged in as 'admin' (accepted password), then attempted to escalate privileges by brute-forcing the 'root' account. Option D correctly identifies that the admin account was accessed by an attacker who then attempted to brute-force root, as evidenced by the failed root attempts after a successful admin login.

PCI DSS is an industry-mandated framework of requirements and control objectives that applies to any organization handling cardholder data. It specifies outcomes, such as protecting stored data and encrypting transmission over open networks, but leaves specific technical implementation to the organization. It is enforced contractually through acquiring banks, not as advisory guidance or as government legislation.

The combination of small payloads, PSH flag, and regular 30-second intervals strongly suggests C2 beaconing. Malware often beacons to its C2 server at set intervals to receive commands or exfiltrate small amounts of data. This pattern is distinct from floods, file transfers, or scans.

Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.

The string '/etc/passwd' is a classic indicator of a directory traversal attack, where an attacker attempts to access files outside the web root directory by manipulating path parameters. An IDS detecting this string in a packet payload (e.g., in a URL or HTTP request) suggests the attacker is trying to read the Unix password file, which is a common target in path traversal exploits. This attack exploits insufficient input validation to navigate the file system using '../' sequences or absolute paths.

A sudden spike in DNS queries to unknown domains from a single host is a classic sign of DNS tunneling or command-and-control (C2) activity. Attackers often use DNS to exfiltrate data or communicate with external servers by encoding data in DNS queries, bypassing traditional firewall rules that allow DNS traffic.

DGA malware generates numerous pseudo-random domain names to locate its C2 server. This results in a high volume of queries for random-looking domains, often with varied TLDs, and many NXDOMAIN responses for unregistered names. These two characteristics together strongly indicate DGA behavior.

The presence of SMB traffic on port 445 carrying a command shell payload such as 'cmd.exe /c whoami' is a strong indicator of lateral movement and remote command execution. Attackers often use SMB to move between systems and execute commands, making this the most likely malicious activity in the scenario.

The correct answer focuses on behavioral indicators: a long, steady, automated-looking outbound flow with uniform packet sizes and the PSH flag set on most packets. This pattern is typical of data exfiltration tools that chunk and push data continuously, unlike bursty interactive user traffic. The other options misattribute meaning to TCP flags or make incorrect claims about detection limits, which would mislead an analyst.

An advanced persistent threat is characterized by significant resources, advanced skills, and sustained, stealthy operations against specific targets, often for espionage or intellectual property theft. The scenario's emphasis on long duration, funding, and a defined victim set aligns with APT behavior. Hacktivists are ideologically driven, script kiddies lack sophistication and resources, and insider threats are authorized users, so none matches the described external, well-funded, persistent actor.

Image File Execution Options (IFEO) is a registry key that allows setting a debugger for a specific executable. Malware abuses this by setting the Debugger value to its own binary, so when the targeted process is launched, the malicious debugger runs instead. This provides persistence and can be used to hijack trusted processes, making detection challenging.

Non-repudiation ensures that a party cannot deny having performed a specific action, such as sending an email. This is typically achieved through digital signatures using asymmetric cryptography (e.g., RSA or ECDSA) and public key infrastructure (PKI), where the sender's private key creates a signature that can be verified by anyone with the sender's public key. The goal is to provide irrefutable proof of origin and integrity, preventing the sender from later claiming they did not send the message.

The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.

Chain of custody documentation tracks who handled evidence from collection to court presentation.

The use of a DGA to generate domain names that the malware contacts over HTTPS is the defining characteristic of the Command and Control (C2) phase. The malware is attempting to reach its operator's infrastructure to receive instructions or send data. This occurs after the malware is installed and before the attacker achieves their objectives.

AES-256 is a symmetric encryption algorithm, meaning it uses the same key for both encryption and decryption. It is widely used for data at rest due to its strength and efficiency. The '256' refers to the key size in bits, making it highly resistant to brute-force attacks.

Network authentication against a Windows file server is recorded in the Security log as logon events, which include the account, logon type, and originating address. Correlating successful and failed entries reveals password spraying, credential stuffing, or lateral movement with stolen credentials, making the Security log the correct first source for this question.

Pass-the-hash exploits the NTLM challenge-response protocol by replaying a captured NTLM hash directly to authenticate, without ever needing the plaintext password. The tell-tale sign is SMB authentication where the credential material is a hash rather than a password, especially when one host authenticates to many others in a fan-out pattern typical of lateral movement. Tools like Mimikatz, Impacket's psexec.py, and CrackMapExec perform this by injecting the hash into the NTLM authentication exchange.

Windows Security Event ID 4648 is logged when a process attempts an explicit-credential logon — that is, when a user or service supplies alternate credentials (via runas, New-PSSession -Credential, or similar) rather than using the current session's token. It records the account that requested the logon and the account whose credentials were used.

Passive reconnaissance involves gathering information about a target without directly interacting with its systems, such as searching public social media sites for employee details. Because the attacker only observes publicly available data and does not send packets or queries to the target's infrastructure, it is classified as passive. This contrasts with active reconnaissance, which involves direct interaction (e.g., port scanning).

A man-in-the-middle (MITM) attack occurs when an attacker intercepts and relays communication between two parties, allowing them to read, insert, and modify messages. This matches the scenario exactly. The attacker positions themselves between the client and server, often without either party's knowledge.

Exfiltration over HTTP often appears as large outbound uploads, especially to new or untrusted destinations. Regular large POST requests and high-volume uploads to newly registered domains both indicate data leaving the environment in a manner inconsistent with normal business traffic. These patterns warrant deeper investigation.

A SYN flood attack is a type of denial-of-service (DoS) attack where the attacker sends a high volume of TCP SYN packets to a target server but never completes the three-way handshake by sending the final ACK. This leaves the server with half-open connections, consuming resources and potentially exhausting the connection backlog, which prevents legitimate clients from establishing connections.

Tier 1 analysts monitor alerts and perform initial triage to determine if further investigation is needed.

The massive outbound transfer of 10 GB from an internal host to an external IP, far exceeding the 100 MB/day baseline, is a classic indicator of data exfiltration. Exfiltration involves unauthorized data transfer from inside the network to an external destination, often after a compromise. The volume and direction (internal to external) align with this activity, not with inbound flooding or scanning.

The combination of an outbound connection from the web server process on a common reverse shell port (4444) and an obfuscated PHP file in the web root is a classic indication of a web shell. Attackers use web shells to execute commands and maintain access, often leading to data exfiltration or further network compromise.

The presence of a service named 'sshd' listening on port 4444, especially with unusual outbound traffic, is a red flag for a backdoor or reverse shell. Attackers frequently use common ports like 4444 for command-and-control and name their processes after legitimate services to blend in. Legitimate SSH should listen on port 22 unless explicitly changed, and such a change would be documented.

In Zeek, S0 indicates that a SYN packet was sent but no SYN-ACK was received (connection attempt without completion). This could be part of a port scan or a half-open connection.

Event ID 4625 in the Security log indicates a failed logon attempt. This is often used to detect brute-force attacks or unauthorized access attempts.

Quantitative risk assessment uses numerical values (e.g., monetary, percentages) to calculate risk.

Legitimate svchost.exe processes are spawned by services.exe, not cmd.exe. A parent of cmd.exe indicates that svchost.exe was launched manually, which is abnormal and suggests malicious activity.

The incident involves a targeted email that appears to be from the IT department, requesting credential verification—this is spear phishing because it's tailored to the organization. The employee providing credentials leads to credential theft, which the attacker then uses to access the VPN. Thus, spear phishing and credential theft best describe the attack.

Automated exfiltration is best identified by behavior: uploads at fixed intervals with near-identical sizes indicate a scheduled tool, and outbound data with no matching user-driven inbound requests shows the transfer is not interactive browsing. Domain age, certificate issuer, and TLS version describe infrastructure or protocol choices that legitimate and malicious traffic share, so they are weaker indicators and do not specifically demonstrate automation.

Multi-factor authentication (MFA) is the most effective enforcement mechanism because it requires a second factor (e.g., a one-time passcode from an authenticator app, a hardware token, or a biometric) in addition to the password. Even if employees share their passwords, MFA prevents unauthorized access because the second factor is tied to the individual's device or identity and cannot be easily shared. This directly addresses the root cause of credential sharing by making shared credentials useless without the additional factor.

In the Lockheed Martin Cyber Kill Chain, Delivery is the phase where the attacker transmits the weaponised payload to the victim — for example, via a phishing email with a malicious attachment, a malicious link, or a USB drop. Sending the malicious attachment to a targeted user is the textbook definition of Delivery. Weaponization (the prior phase) is where the attacker pairs the exploit with the payload, but the actual transmission to the target is Delivery.

In an urgent security situation where an active exploit must be blocked immediately, the network administrator should apply the change immediately and then submit an emergency change request for post-approval. This aligns with ITIL change management practices, which allow for emergency changes to be implemented first and documented/approved afterward to address critical incidents.

Repeated login failures are a classic indicator of a brute-force attack, where an attacker attempts to guess credentials by trying many passwords. The security policy should require investigation to confirm the attack pattern (e.g., frequency, source, target accounts) before taking irreversible actions like blocking or disabling. Option C is correct because it follows the principle of verify-then-act, aligning with incident response procedures.

Delivery is the phase where the attacker transmits the weaponized payload to the target, such as via email attachments.

An incident response policy governs how incidents are handled consistently by defining team roles, decision authority, and severity-based escalation and notification criteria. Those elements give responders clear direction and give auditors measurable expectations. Detection signatures, exact command syntax, and the full business continuity plan belong to tooling, procedures, or a separate discipline, so they are not essential policy components.

Zeek's http.log records all HTTP requests and responses, including the host header, URI, method, and user agent. To identify HTTP requests to a known malicious domain, the http.log is the most direct source because it contains the destination host and URL. Analysts can search this log for the malicious domain in the 'host' or 'uri' fields.

ARP spoofing and forged ICMP redirects both manipulate how a host forwards traffic so the attacker becomes an on-path device, enabling interception and modification. ARP spoofing targets the mapping of IP to MAC on the local segment, while ICMP redirect manipulation alters the next-hop decision. Both are detectable through switch features such as dynamic ARP inspection and through monitoring for unexpected redirect messages.