Cisco CyberOps Associate 200-201 (200-201) — Questions 76–150

The Acceptable Use Policy defines permitted and prohibited use of corporate resources, including personal email access on a company laptop. The employee's action breaches that policy directly, and the resulting malware infection stems from this specific violation.

This prevents unauthorized access to corporate data.

Tier 3 analysts perform proactive threat hunting, using advanced analytics and intelligence to find threats evading existing detection. This satisfies the stem's focus on hunting, distinguishing it from Tier 1 triage and Tier 2 escalation duties.

A Trojan is malware that disguises itself as legitimate software or a benign file to trick users into executing it. In this case, the executable appears to be a PDF but actually performs malicious actions like encrypting files. This deception is the defining characteristic of a Trojan, which often delivers ransomware or other payloads.

Pass-the-hash lateral movement produces a fan-out pattern: one compromised host authenticating via SMB to many targets in quick succession. This satisfies the stem's requirement for a typical indicator, since legitimate users rarely generate such broad single-source SMB authentication bursts.

The encoded command hides the payload from casual log inspection, while the unsigned child spawned by a signed parent indicates process injection or masquerading. Sysmon Event ID 1 captures this parent-child mismatch, which is the specific indicator the stem asks you to interpret.

A SYN scan probes ports by sending SYN packets; receiving SYN-ACK proves the port is open, and the scanner immediately sends RST to tear down the half-open connection rather than completing the handshake. That SYN-then-RST pattern distinguishes it from a full connect scan.

The pstree plugin reconstructs parent-child relationships by following inherited process identifiers, revealing the ancestry and nesting that pslist's flat enumeration omits. This satisfies the stem's comparison requirement, exposing processes whose parent has exited and been reparented, which a simple listing cannot show.

An advanced persistent threat often involves stealthy, prolonged access to a network to steal data over time. The scenario describes data exfiltration using an encrypted channel during non-business hours, which aligns with APT tactics. APTs aim to maintain persistence and exfiltrate sensitive information without detection, making this the most likely threat type.

Non-repudiation uses cryptographic evidence such as digital signatures to bind an action to a specific identity, so the actor cannot later credibly deny performing it. This directly satisfies the requirement that a user be unable to deny an action.

A half-open scan sends a SYN packet and, on receiving SYN-ACK, replies with RST rather than completing the three-way handshake, so no connection is established. This matches the PCAP exactly: SYN-only packets followed by RST, satisfying the stem's requirement that no session is ever opened.

AES is a symmetric block cipher, so encryption and decryption share one secret key. This satisfies the stem's same-key requirement, and symmetric ciphers process data far faster than asymmetric algorithms such as RSA, which rely on computationally expensive modular arithmetic.

A Trojan disguises itself as legitimate software, so the victim must execute or install it before it runs. That dependency on the user launching the file satisfies the stem's user-interaction requirement, unlike worms, which self-propagate across networks without any user action.

Behavioural profiling establishes a baseline of normal activity, then flags deviations from it. Anomaly-based detection compares current events against that learned baseline, so unusual patterns trigger alerts without relying on known signatures — exactly the mechanism the stem describes.

Corporate accounts are provided for business purposes, so personal use breaches the acceptable-use policy and exposes the organisation to data loss and reputational risk. Sending personal email from the corporate account violates the policy's scope-of-use constraint, making it a typically prohibited action.

The periodic, fixed-interval queries with random subdomains to one domain, combined with NXDOMAIN responses, are classic signs of a DNS beacon. The implant generates unique subdomains to check in and receives no response because the C2 domain may not be active yet or the analyst is seeing only the beacon attempts. This pattern is a well-known indicator of compromise.

High entropy in a file section indicates compressed or encrypted data, which is typical of packed malware. Packers compress or encrypt the original code to evade signature detection, and the unpacking stub restores it at runtime. The high-entropy section is a strong static indicator that the executable is packed or encrypted.

With the host isolated and volatile memory captured, the immediate priority is examining that dump for indicators of compromise, since memory holds running processes, injected code and network artefacts lost once power is removed or the system is rebooted.

A stolen laptop containing sensitive customer data represents a physical asset loss enabling data exposure, which falls under threat classification in risk models. The threat is the potential actor or event exploiting the missing device's unencrypted data, satisfying the scenario's requirement to categorise the incident as a threat rather than a vulnerability or exploit.

The ASA log records a denied inbound TCP connection to the internal web server's port, matching a firewall ACL drop. This confirms traffic from an external host was blocked before reaching the server, exactly the scenario described.

Magic bytes are fixed signature values at the start of a file's binary content, so they identify the true format independently of the filename extension. An attacker can rename a malicious executable to .txt, but the magic bytes still reveal the actual type, satisfying the requirement to determine file type regardless of extension.

Malware often masquerades as HTTPS by using port 443 while speaking a custom binary protocol to evade port-based filtering and TLS inspection. The periodic small keepalives are a hallmark of beaconing, where the implant checks in with its controller at regular intervals. Because the traffic is not actually TLS, signature-based TLS inspection will not flag it, making behavioral analysis essential for detection.

Pass-the-Hash attacks often leverage SMB for lateral movement. Capturing network traffic that includes NTLMSSP authentication attempts can reveal the use of NTLM hashes instead of plaintext passwords. Specifically, the NTLMSSP_AUTH message contains the username and the challenge response derived from the hash. If the same hash is used from multiple hosts or in an unusual pattern, it strongly suggests Pass-the-Hash. This artifact provides direct network-level evidence.

modinfo displays information about a kernel module, including its filename, description, author, and license. Running 'modinfo hideproc' will show the full path to the module file, which can then be analyzed or removed. This directly helps identify the rootkit's location.

This is correct because data classification assigns labels such as 'Restricted' or 'Internal' based on sensitivity, and each label maps to specific handling, encryption, and access requirements. The policy in the scenario applies stronger controls to more sensitive data, which is the core function of classification. It enables risk-based protection aligned with business and compliance needs.

The tcp.stream eq 0 filter isolates a single reassembled TCP conversation by its stream index, letting the analyst follow the full exchange between the two hosts. Following the stream reconstructs the session payload for forensic review.

Endpoint detection and response (EDR) or endpoint protection platform telemetry records process execution, file modification, registry changes, and command-line arguments on the target. Correlating the Firepower intrusion event timestamp and source IP with this endpoint data reveals whether the dropped packet was part of a successful exploit chain or whether the host actually spawned a malicious process. This is the authoritative source for confirming host-level compromise after a partial network capture.

Using one service account to authenticate to many servers over SMB suggests credential reuse for lateral movement, especially if the account is not normally used interactively. Attackers commonly harvest service account credentials and spray them across hosts, so this pattern supports the SMB lateral movement hypothesis.

Unsanitized input creates injection vulnerabilities such as cross-site scripting, and unapproved browser extensions add untrusted code to endpoints. Together these weaknesses enlarge the attack surface, giving threat actors more paths to exploit. The architect's findings describe exploitable vulnerabilities rather than a specific attack technique or a compliance gap.

The first step in the incident response process is to validate that the alarm represents a real security event and to identify the affected asset and user. This establishes scope, confirms whether the traffic is expected, and determines whether escalation is warranted. Only after validation and identification can the analyst make informed containment decisions. Jumping to blocking or disabling accounts without this step risks disrupting legitimate business activity and missing related compromised systems.

The access list permits TCP from any source to host 10.1.1.1 on port 80, so only that specific web traffic is allowed inbound. Other protocols, ports, or destinations are implicitly denied by the trailing ACL rule.

An interactive shell where the remote host executes commands such as whoami and ls indicates the attacker's machine is receiving a session from the victim, the defining pattern of a reverse shell. The victim initiated the outbound connection, evading inbound firewall rules.

Containment precedes eradication per the plan, and disconnecting the server from the network isolates the malware, preventing lateral spread or data exfiltration. This is the containment step, satisfying the stem's ordering requirement before any eradication or recovery actions begin.

Long, random-looking subdomains encode exfiltrated data or command payloads, since DNS labels carry limited bytes per query. Repeated queries to one domain, rather than many domains, match tunnelling's need for a stable server endpoint. This pattern satisfies the stem's requirement for a characteristic distinguishing tunnelling from ordinary DNS resolution.

Risk mitigation involves applying controls to reduce the likelihood or impact of a vulnerability. Given the high CVSS score and exposure, patching or implementing a web application firewall is necessary. Mitigation is the most appropriate response to protect sensitive data and maintain compliance.

The 'UNION SELECT' string in URI parameters is a classic SQL injection signature, used to append attacker-controlled queries onto a legitimate database statement. Its presence across multiple HTTP requests confirms attempts to manipulate backend SQL through unsanitised input.

IRC remains a common botnet C2 channel; compromised hosts beacon to IRC servers on non-standard ports to evade simple filtering. This satisfies the stem's traffic-indicator requirement, since such connections reveal command-and-control rendezvous rather than legitimate user activity.

A firewall enforces network traffic filtering through predefined rule sets, directly implementing a preventive technical control that restricts unauthorised access. It satisfies the stem's requirement for technical controls because it operates automatically via hardware or software mechanisms, unlike administrative or physical controls such as policies or locks.

Suppression rules let the IDS ignore matching traffic from the specific source IP or application while retaining the signature for all other sources, eliminating the recurring false positives without losing genuine detection coverage. This directly addresses the high false-positive rate constraint.

Oversized ICMP echo requests exploit the protocol's normal 64-byte payload ceiling, indicating tunnelling or data exfiltration hidden inside ping traffic. This satisfies the stem's malicious-activity criterion because legitimate diagnostics never require 65,000-byte payloads, and such frames often signal covert channels or ping floods.

Repeated denied connections to port 22, the SSH service, from one source indicate automated credential guessing against remote shell access. The firewall's consistent blocking of these attempts confirms brute-force behaviour rather than legitimate administrative traffic, matching the log pattern described in the stem.

Web server logs record each HTTP transaction, capturing request method, URL path, query strings, status codes and User-Agent headers. This satisfies the requirement for detailed request-level data, unlike firewall logs that show only connection metadata or NetFlow records lacking application-layer detail.

MISP is an open-source threat intelligence sharing platform where organisations exchange indicators, events and correlated attributes. It satisfies the sharing requirement by providing a common repository and community, complementing the STIX format and TAXII transport protocol named elsewhere.

ARP spoofing lets an attacker send forged ARP replies, poisoning victims' caches so traffic is redirected through the attacker's machine. Positioned between two communicating hosts, the attacker relays traffic while reading or altering it, producing a man-in-the-middle condition.

DNS log analysis inspects query records for anomalies such as unusually long subdomains, high query volumes, or TXT record abuse, which are hallmarks of DNS tunnelling. Since the malware exfiltrates data through DNS queries, examining these logs directly satisfies the stem's requirement to detect the tunnelling activity.

The accounting command points to a TACACS+ server group name that has no matching aaa group server tacacs+ definition. Authentication succeeds through a valid method list, but accounting records cannot be sent because the referenced group does not exist.

NetFlow/IPFIX records flow metadata — source, destination, byte counts and timestamps — letting the analyst compare the 50 MB foreign transfer against the 1-2 MB hourly baseline. Encryption hides payload contents, but flow volume and destination still confirm exfiltration.

Sudo execution records commands run with elevated privileges, making it a direct indicator of privilege escalation attempts. Monitoring these events reveals when a user gains or attempts root-level access, satisfying the requirement to detect escalation activity in system logs.

pstree renders the parent-child process hierarchy, exposing anomalous parentage such as a word processor spawning cmd.exe, which hints at injected or masquerading code. Combined with network and injection plugins, it satisfies the requirement to identify suspicious processes during memory analysis.

The server sends FIN+ACK to start a graceful close, meaning it has no more data to send. The client, however, continues to transmit data, which is a violation of TCP half-close semantics. Eventually, the client sends an RST, abruptly terminating the connection. This could indicate a malfunctioning client or an attempt to disrupt the session.

Bollards are physical barriers that prevent vehicles from ramming into a building or accessing restricted areas. They are tangible structures designed to deter or block physical threats, which makes them a classic physical control. In a data center, bollards help protect the facility from vehicle-borne attacks and accidental damage. This option is correct because it directly addresses physical access and protection of the premises.

Segmenting the web server into a DMZ with the database on the internal network, plus a firewall denying DMZ-to-internal outbound traffic, prevents a compromised web server from initiating connections inward. This blocks lateral pivoting, satisfying the stem's containment goal.

SMB on port 445 is used by ransomware and worms such as WannaCry to propagate laterally. Repeated outbound attempts to many external addresses indicate the workstation scanning for reachable SMB shares, consistent with infection rather than legitimate file sharing.

Passive monitoring avoids impacting network performance.

The self-signed certificate claiming google.com from a non-Google IP indicates likely command-and-control or credential theft, so isolating the host contains the threat before lateral movement. Forensic analysis then determines scope and persistence while preserving evidence.

The magic bytes 50 4B 03 04 are the ZIP local file header signature ('PK\x03\x04'). Despite the .pdf extension, the file's actual container format is ZIP, which is typical of Office documents and JAR archives and indicates the extension has been spoofed.

When a domain is categorized as malware and command-and-control with a high security score, the immediate priority is to prevent further communication and identify affected hosts. Blocking at DNS via Umbrella stops resolution, and querying logs for internal clients that resolved the domain helps scope the incident. This aligns with containment and investigation best practices.

DNS server response logs record whether a query received a valid answer, an NXDOMAIN, or a blocked response from a protective DNS service. This directly shows if the domain was resolved or denied, answering whether the workstation could have connected. Correlating these responses with firewall or proxy logs then confirms whether an actual connection followed the resolution.

Firewall logs record denied connections when a rule or access control list evaluates the traffic and drops it. The most likely cause is that no ACL entry permits the flow, so the implicit deny terminates the session before it reaches the destination.

Tuning improves alert accuracy and reduces noise.

The default deny rule is dropping the web server's database queries, causing the application errors. A rule permitting only 10.0.1.10 to reach 10.0.2.10 on TCP 3306 restores that specific flow while keeping all other outbound traffic blocked, preserving the DMZ segmentation.

A TCP connect scan completes the full three-way handshake for each port and then immediately sends an RST to tear down the connection. This matches the observed SYN, SYN-ACK, ACK, and RST sequence. It is used when the scanner does not have raw packet privileges and relies on the OS connect() call.

HIPAA safeguards protected health information, a subset of personal data, through its Privacy and Security Rules. It satisfies the compliance constraint by mandating administrative, physical and technical safeguards for individually identifiable health data, making it a framework specifically designed to protect personal information rather than general security controls.

Effective monitoring requires correlating events across every environment; centralised logging from all cloud services and on-premises gives the SOC one aggregated source, enabling detection of lateral movement and cross-boundary attacks that siloed, per-service logs would miss.

The alert indicates an attempted exploit against a known vulnerable version of Apache Struts2. The analyst must determine if the exploit succeeded by examining web server logs, looking for unusual processes or files, and confirming the patch level. This response aligns with incident handling: validate the alert, assess impact, and contain if necessary.

A registry modification with no matching network activity during a scheduled maintenance window suggests legitimate administrative change rather than intrusion. Verifying the change management system confirms whether the modification was authorised, preventing a false positive escalation before treating the HIDS alert as a genuine compromise.

On Linux, when an executable is deleted while a process is running, the /proc/<PID>/exe symlink still exists but points to the original path with a ' (deleted)' suffix, and the file is no longer visible on disk. This is a common malware technique to hide the binary while keeping it running. The analyst can recover the binary from /proc/<PID>/exe before the process exits.

The Network layer (Layer 3) handles logical addressing and routing, satisfying the stem's requirement. IP spoofing attacks forge source addresses within IP packets at this layer, exploiting the lack of authentication in the IP protocol. This makes Layer 3 the precise target, unlike the Transport layer's ports or Data Link layer's MAC addresses.

The legacy MSIE 6.0 user-agent on Windows NT 5.1 (XP) contradicts the host's expected Windows 10 baseline, so the string is spoofed rather than genuine. Malware commonly hard-codes outdated user-agents for HTTP command-and-control or payload retrieval, making this anomalous egress consistent with infection.

Using ip.addr twice with the AND operator matches packets where either field equals the first address and either field equals the second, effectively isolating bidirectional traffic between the two hosts. This is the standard way to view a conversation regardless of direction, which is exactly what the analyst needs when the role of client and server may vary during the exchange.

A SYN flood sends numerous TCP SYN packets to open ports without completing the three-way handshake, exhausting the server's connection backlog. The scenario describes exactly this: multiple SYNs to different ports from one source with no completed handshakes. This matches the classic half-open connection pattern used to deny service to legitimate users.

Risk avoidance eliminates the risk by discontinuing the activity entirely, which matches management stopping the process outright. Unlike mitigation, which reduces likelihood or impact, or transfer, which shifts financial consequence, avoidance removes the exposure at source.

HTTP and HTTPS are permitted because the ACL explicitly matches TCP ports 80 and 443, satisfying the requirement to allow web browsing outbound. SSH is denied since port 22 is absent from the permit statements and the implicit deny any catches it, blocking remote shell access from 192.168.1.0/24 to the internet.

Mitigate reduces risk through controls.

IPsec is a suite of protocols that authenticates and encrypts IP packets at the network layer, securing site-to-site VPNs and host-to-host traffic. It satisfies the question's requirement for a common network security protocol, operating at Layer 3 rather than the application layer.