Cisco CyberOps Associate 200-201 (200-201) — Questions 901–968

Full packet capture records entire packet contents, including application layer headers and payload, enabling deep inspection of protocols and data. Flow logs and metadata sources only summarise traffic, so PCAP provides the detailed payload visibility required.

DNS tunneling uses DNS queries to exfiltrate data.

Hashing is deterministic, so the analyst recomputes the digest of the downloaded file using the same algorithm and compares it against the publisher's supplied value; any mismatch proves the file was altered in transit or storage.

HTTPS enforces TLS between client and server, covering data in transit. Transparent Data Encryption encrypts database files and backups at rest without application changes. Together they satisfy both halves of the policy's encryption mandate across the application's communication and storage layers.

The CIA triad is exactly what the CISO describes: confidentiality, integrity, and availability are the three foundational objectives of information security. Administrative, physical, and technical controls are implemented specifically to protect these three properties of information assets. This aligns with the Cisco CyberOps objective of understanding the core security principles that guide the design of a security program.

Reviewing LinkedIn profiles gathers employee names, roles and technologies without touching the target's systems, so no packets reach the organisation. This indirect, non-intrusive collection satisfies the stem's passive-reconnaissance constraint, unlike scanning or banner grabbing, which generate detectable traffic.

Unauthorised modification of patient records directly breaches integrity, which guarantees data remains accurate and unaltered except by authorised parties. The insider's tampering satisfies this constraint precisely, independent of the ransomware's availability impact, so integrity is one of the two principles primarily violated.

PCI DSS is the payment card industry standard governing organisations that store, process or transmit cardholder data. Its twelve requirements mandate controls such as encryption, access restriction and network monitoring, directly satisfying the stem's cardholder data protection obligation.

Separating keys from ciphertext ensures a compromised data store does not expose the keys needed to decrypt it, directly satisfying the policy's data-at-rest protection goal. This is a foundational key-management practise: compromise of one asset must not yield both the locked data and the means to unlock it.

Alternating small payloads, long duration, and steady delays are hallmarks of an interactive remote shell or beacon where each request and response carries a short command or result. A reverse shell keeps the session alive for hours, and the ten-second cadence reflects either human interaction or a beacon interval. The non-TLS payload on port 443 confirms deliberate port masquerading to blend with expected HTTPS traffic.

Blocking 203.0.113.5 at the firewall and dropping its traffic immediately severs the exfiltration channel and prevents further exploitation, containing the active incident. The IPS was alert-only, so enforcement must be applied at the firewall to stop the ongoing attack.

Web server access logs record each request's method, URI, status code, and user-agent, making them the primary source for spotting exploitation attempts such as SQL injection, path traversal, or command injection in request parameters. They reveal the initial attack vector and timing, which anchors the rest of the investigation. Correlating these entries with endpoint activity identifies the exploited process and any spawned child processes.

Malware analysis identifies the ransomware variant's behaviour, indicators, and capabilities, while correlating with other alerts reveals infection scope and lateral movement. This combination is the appropriate Tier 2 next step before escalation, satisfying the need to characterise a suspected new ransomware variant.

The Services console lists every installed Windows service along with its display name, start type, status, and, under the General tab or via the registry, the path to the service binary. This lets the analyst spot a service whose ImagePath points to an unusual directory or executable, which is a classic masquerading persistence technique. It requires no third-party tools.

Unusual time and volume strongly suggest exfiltration.

Reading `/proc/<pid>/cmdline` returns the exact command line and arguments that launched process 1234, with arguments separated by null bytes. This directly satisfies the scenario's requirement to identify how the process was started on the Linux host, exposing suspicious flags or scripts an attacker used.

Defining metrics that measure IR effectiveness belongs to Post-Incident Activity, quantifying detection, response and recovery performance after the event. This satisfies the phase's purpose of evaluating what occurred rather than preparing for or containing an incident.

Rapid, widespread writes to numerous network file shares from one account is consistent with a ransomware binary encrypting shared data after initial execution. This pattern distinguishes encryption activity from normal user file access, which is typically limited in scope. Combined with suspicious script execution, it provides strong corroboration of an active or imminent ransomware incident.

High entropy and few imports indicate packing.

FTP 530 responses indicate failed logins. A high frequency of these within a short period strongly suggests automated brute-force attempts, as legitimate users rarely fail repeatedly in rapid succession. This is a key indicator of brute-force activity.

Inspecting the TLS handshake reveals the server name indication and certificate details, exposing whether 203.0.113.55 is a known update server or an attacker-controlled endpoint. Since Firepower raised no alerts, encrypted exfiltration over 443 bypassed signature detection, so packet-level inspection is the only way to confirm the anomaly Stealthwatch flagged.

RDP listens on TCP port 3389 by default, so this directly satisfies the stem's requirement. Attackers repeatedly target 3389 with brute force credential attempts because exposed RDP endpoints accept authentication requests, making weak passwords exploitable. Restricting access via Microsoft Entra ID conditional access or a VPN mitigates this exposure.

Sticky Keys (sethc.exe) can be replaced with cmd.exe to provide a command prompt at login.

User-specific crontab entries are stored under /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), one file per user. Examining this directory directly reveals attacker-added scheduled jobs, satisfying the requirement to identify user-specific cron persistence rather than system-wide schedules held in /etc/crontab or /etc/cron.d/.

This is correct because a BCP must clearly assign roles and responsibilities so that team members know what to do during a disruption. Without defined roles, recovery efforts can stall due to confusion or duplication. The scenario identifies missing components, and role clarity is a fundamental part of any effective continuity plan.

A shared static credential used for automation cannot be attributed to a specific person, is rarely rotated, and often spreads across scripts and configuration files where it can be harvested. If compromised, it grants persistent privileged access with no MFA and no clear accountability, making containment difficult. This combination of anonymity, persistence, and wide exposure represents the greater risk.

Event ID 4625 is generated on failed logon attempts. A high volume of these events for one account, especially from multiple source workstations, suggests an attacker is trying many passwords. Password spraying uses a few common passwords across many accounts, but repeated failures for a single account from different hosts also align with brute-force or credential-stuffing activity targeting that account.

Unvalidated file uploads let an attacker place executable code that the server later runs, which is remote code execution. This satisfies the stem's stated impact of executing a malicious file on the server, rather than mere cross-site scripting or information disclosure.

The HKLM Run key executes listed programs at logon for every user on the host, making it a machine-wide persistence location. This satisfies the stem's user logon persistence constraint, since malware written here survives reboots and affects all accounts.

Overwhelmed resources cause slowdowns.

A known software vulnerability is a documented weakness in software code that attackers can exploit. The outdated Apache version contains a published remote code execution flaw, which matches this definition. The analyst should classify it as a known vulnerability and prioritize patching or upgrading, consistent with vulnerability management practices in the CyberOps Security Concepts domain.

Data classification and handling procedures define how sensitive data is identified, labelled, stored, transmitted and disposed of. Without classification, controls cannot be applied consistently. This element directly satisfies the policy's purpose of governing sensitive data handling across the organisation.

Prefetch files record each executable's name, run count and last-run timestamps, so analysts can confirm that a program executed on the host, how often, and when. This directly satisfies the need to establish file execution evidence during host-based analysis.

A reverse shell is an outbound connection from the victim to an attacker-controlled listener, carrying interactive commands such as whoami, ls -la and cat /etc/passwd. The bidirectional stream to a remote IP matches this pattern rather than inbound exploitation.

The HKLM Run key executes programs at logon for all users and needs administrative privileges to modify. Malware with elevated access writes here for system-wide persistence, satisfying the scenario's requirement for a commonly abused Run-key location on the Windows host.

Wireshark's Export Objects feature reconstructs files carried over protocols such as HTTP, SMB and TFTP from captured packets and writes them to disk. This directly satisfies the requirement to extract files from a PCAP for further analysis, unlike tools that only inspect headers or statistics.

Blocking the external source at the firewall immediately stops further inbound attempts to the MySQL port, containing the threat while investigation proceeds. This satisfies the need for the fastest containment action against a confirmed external probe of an internal database.

The `!$HOME_NET` negation operator matches any source outside the defined internal network, satisfying the "not from the internal network" constraint. `alert tcp` sets the action and protocol, `any` covers all source ports, and `-> any 21` targets FTP destination port 21 on any host.

NIST SP 800-61 Rev 2 orders the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication and Recovery; then Post-Incident Activity. This sequence reflects the standard's four-phase structure, with lessons learned occurring only after recovery completes.

NetFlow records export metadata about IP flows — source, destination, ports, and byte counts — letting a SIEM correlate traffic patterns and detect anomalies such as scanning or exfiltration. They feed network-level event data alongside logs and alerts.

Detection and Analysis covers initial triage, validating alerts and deciding whether an event meets the incident criteria before escalating to containment. This satisfies the stem's requirement, since qualification happens during that phase rather than Preparation, Containment Eradication and Recovery, or Post-Incident Activity.

An IP address is a network-level IoC, recording the source or destination of malicious traffic such as command-and-control contact. It satisfies the stem's requirement for a valid IoC type because it provides concrete, observable evidence of compromise that analysts can correlate across logs and block at perimeter controls.

The signature name identifies an outbound connection from an internal host to an IP address listed on a threat intelligence blacklist, indicating possible command-and-control or data exfiltration traffic. The rule triggers on the destination reputation, not on payload content, so it flags the connection itself as suspicious.

A signature false positive occurs when legitimate traffic matches an attack pattern the IPS was not designed to see in that context. Here, benign web requests containing SQL-like strings trigger the SQL injection signature, causing the IPS to drop them. This directly explains the over-blocking of legitimate web traffic described in the stem.

The rule correlates two distinct events: account creation followed by privileged group membership within ten minutes. That sequence captures both the creation of the account and its elevation to privileged rights, which is exactly the behaviour the correlation logic is designed to surface.

Post-exploitation callback traffic from the target to a known command-and-control address is strong evidence that the earlier exploit succeeded and the host is now under adversary control. Correlation between the initial intrusion event and later outbound C2 activity links cause and effect. This behavioral evidence outweighs static metadata such as severity or direction when assessing compromise.

Capturing traffic across a representative period such as a week captures diurnal and weekly usage variation, producing a baseline that reflects genuine normal operation. Short captures miss periodic activity, so this duration satisfies the requirement for a reliable traffic-pattern baseline.

A Vulnerability Disclosure Policy sets out how researchers and staff report discovered flaws to the organisation, plus expected response timelines. It directly satisfies the stem's requirement for a defined reporting process, unlike awareness or acceptable-use policies that cover behaviour rather than vulnerability intake.

Because a HIDS agent runs on the host itself, it observes local file system changes, registry modifications and process activity that network sensors cannot see. This host-level telemetry satisfies the stem's comparison against NIDS, which only inspects traffic crossing the wire.

TLS encrypts data in transit using symmetric and asymmetric methods.

Sysmon logs detailed process creation events (Event ID 1) and image loaded events (Event ID 7), which can show if a legitimate process loaded an unexpected DLL or if a process was created with suspicious parameters. This is the most direct source for detecting code injection, as it captures the loading of images into processes.

Repeated inbound connections to TCP 445 across multiple hosts, followed by SMB negotiation, indicate an external actor probing or attacking SMB services. Port 445 is used by SMB for file sharing and is a common target for enumeration and exploitation. The breadth of targets suggests scanning or worm-like behavior rather than a single targeted connection.

Centralizing logs on a hardened server with restricted access, combined with integrity measures such as hashing or write-once storage, preserves both trustworthiness and availability. If the source host is compromised or destroyed, the copies remain intact for examination. This design also supports retention policies and search during audits, directly meeting the regulator's expectation that records can be produced reliably.

Event ID 8 logs CreateRemoteThread, which fires when a process starts a thread inside another process. That cross-process thread creation is the classic Sysmon signature of remote code injection, directly matching the injection technique named in the stem.

High-entropy subdomains carrying small queries at fixed 60-second intervals indicate data encoded into DNS labels and exfiltrated or commanded through recursive resolvers. The absence from blocklists and regular beaconing fit DNS tunnelling used for command-and-control rather than normal resolution.

NIST SP 800-53, 'Security and Privacy Controls for Information Systems and Organizations,' provides a comprehensive catalog of security and privacy controls. It is the primary source for federal agencies and many private organizations to select and implement controls. In this scenario, the retail company needs a control catalog, making SP 800-53 the correct reference.

A false positive occurs when detection logic flags activity that is actually benign, so a confirmed benign file triggering a known-malware signature matches this classification. The alert fired correctly per the signature, but the underlying file is harmless, distinguishing it from a true positive.

TAXII provides the transport mechanism for exchanging cyber threat intelligence over HTTPS, supporting both structured indicators and full reports through its collections and channels model. It satisfies the ISAC sharing requirement by enabling automated, bidirectional exchange between members, complementing STIX's data representation with the delivery protocol needed for programmatic sharing.

The combination of an unexpected path under a world-writable directory, a system-process name, and outbound SMB connections to multiple internal servers is a strong behavioural anomaly regardless of signature validity. Signed binaries are routinely abused for lateral movement, so the analyst should preserve volatile data and investigate parent process, logon session, and network peers before clearing the alert.

Average bandwidth usage per hour establishes a quantitative norm for traffic volume, so deviations such as sudden spikes or sustained drops become detectable against the baseline. It directly satisfies the stem's requirement for metrics that reveal anomalies in normal traffic patterns, complementing flow-based measures like protocol distribution or connection counts.

Phishing uses fraudulent emails impersonating a trusted entity, such as the IT department, to trick recipients into clicking links and surrendering credentials. This matches the stem's constraint of a spoofed internal email harvesting login details.

PCI DSS is the Payment Card Industry Data Security Standard, mandated for any organisation that stores, processes or transmits cardholder data. The stem's credit card handling constraint maps directly to this standard, unlike HIPAA (health) or GDPR (personal data).

A SYN scan sends a lone SYN packet to probe a port; a closed port replies with RST, and no handshake completes. This matches the stem's single SYN to a closed port, satisfying the constraint that the connection never finished the TCP three-way handshake.

Port scanning actively probes target hosts to discover open ports and running services, generating traffic that touches the target directly, which defines active reconnaissance. It contrasts with passive techniques such as searching public records or monitoring traffic, where the attacker never interacts with the target's systems.

A large outbound HTTP POST to an untrusted external address, with a response that does not match normal application behaviour, indicates data being uploaded out of the network. Exfiltration over HTTP commonly abuses permitted web traffic to move stolen data past egress controls.

Blocking the source IP at the firewall immediately halts the ongoing brute-force attempts against multiple accounts, satisfying the requirement for the fastest containment action. The single attacking address makes a perimeter block effective without disrupting legitimate users.

DLP inspects outbound email content and metadata, matching the 'Confidential' classification label, then enforces the policy action of automatic encryption before the message leaves the tenant. This satisfies the stem's constraint that confidential spreadsheets sent to external partners are protected in transit, preventing unauthorised disclosure.

An ICMP port unreachable response means the target host received the UDP datagram but no application is listening on that port, which is the definitive indicator that the scanned port is closed rather than filtered.