Knowledge + Practice

Cisco CyberOps Associate 200-201 (200-201) — Questions 76–150

979 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 2 of 14

76

MCQeasy

An organization wants to ensure that security logs are tamper-proof and available for forensic analysis. Which logging best practice should be implemented?

A.Retain logs for only 30 days to reduce storage costs

B.Forward logs to a centralized, hardened log server with access controls

C.Encrypt logs before sending them to a remote server

D.Store logs locally on each device with read-only permissions

AnswerB

Centralization and access controls improve security and forensics.

Why this answer

Forwarding logs to a centralized, hardened log server with strict access controls ensures that logs are protected from tampering and are available for forensic analysis. Centralized storage prevents attackers from altering logs on individual devices, and hardening the server along with access controls adds layers of security. Option A is incorrect because a 30-day retention period may not comply with legal or forensic requirements.

Option C is incorrect because encryption alone does not prevent tampering if the logs are stored on a compromised device. Option D is incorrect because storing logs locally still leaves them vulnerable to deletion or modification by an attacker who gains access to the device.

Full explanation →

77

Multi-Selecthard

An analyst is tuning Snort IDS rules and wants to reduce false positives. Which TWO rule options can be adjusted to decrease sensitivity?

Select 2 answers

A.Change the rule action from 'alert' to 'drop'

B.Add a 'suppress' rule to ignore traffic from known benign IPs

C.Change protocol from TCP to UDP

D.Increase the rule priority from low to high

E.Use the 'detection_filter' to require a certain number of matches within a time window

AnswersB, E

Suppression prevents alerts from trusted sources.

Why this answer

Setting a higher threshold (e.g., detection_filter) reduces alerts for low-frequency events. Enabling 'suppress' can ignore specific sources or destinations that generate false positives.

Full explanation →

78

Multi-Selectmedium

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Select 2 answers

A.IP address whitelist

B.Smart card

C.Password

D.Fingerprint scan

E.Security question

AnswersB, D

Smart card is a possession factor.

Why this answer

Smart card (Option B) is a valid MFA factor because it falls under the 'something you have' category. Multi-factor authentication requires at least two different categories from 'something you know' (e.g., password), 'something you have' (e.g., smart card, token), and 'something you are' (e.g., biometric). A smart card stores a digital certificate and private key, used for cryptographic authentication, typically requiring a PIN (knowledge factor) to unlock it, thus providing two-factor authentication when combined.

Exam trap

Cisco often tests the distinction between authentication factors and access control lists; the trap here is that candidates mistake an IP address whitelist (a security policy control) for an authentication factor, or think a security question counts as a separate factor when it is merely another form of 'something you know'.

Full explanation →

79

MCQeasy

During a security monitoring review, an analyst notices an unusual amount of traffic on port 445. Which protocol is most likely associated with this port?

A.HTTPS

B.SMB

C.DNS

D.HTTP

AnswerB

SMB uses port 445.

Why this answer

Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

Exam trap

Cisco often tests the association of well-known ports with their protocols, and the trap here is that candidates may confuse port 445 with HTTPS (443) or HTTP (80) due to similar numbering, or assume DNS uses a non-standard port.

How to eliminate wrong answers

Option A is wrong because HTTPS uses port 443, not 445, and is secured with TLS/SSL for encrypted web traffic. Option C is wrong because DNS primarily uses UDP port 53 (and TCP port 53 for zone transfers), not port 445. Option D is wrong because HTTP uses port 80 by default, not port 445, and is used for unencrypted web traffic.

Full explanation →

80

MCQhard

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

A.Remote access policy

B.Information security policy

C.Password policy

D.Acceptable Use Policy (AUP)

AnswerD

The AUP prohibits personal use of corporate resources.

Why this answer

The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Full explanation →

81

MCQmedium

A security policy requires that all mobile devices connecting to corporate email must have a screen lock and be able to be remotely wiped. An employee's personal phone is lost. The employee reports the loss immediately. The phone is enrolled in MDM with remote wipe capability. However, the employee has not set a screen lock, violating policy. The phone contains synced email and contacts. What should the security team do?

A.Remotely wipe the phone immediately.

B.Ask the employee to set a screen lock remotely.

C.Accept the risk since the phone is lost and wipe is possible.

D.Report the violation and suspend the employee's email access until compliance.

AnswerA

This prevents unauthorized access to corporate data.

Why this answer

Remote wipe is the most critical action to protect corporate data. Option B is wrong because wiping should be done; Option C delays protection; Option D is impossible as the phone is lost.

Full explanation →

82

MCQeasy

You are a SOC analyst for a school district. The district uses a Cisco Firepower NGFW for traffic inspection and a SIEM for log aggregation. A teacher reports that her workstation is slow and unresponsive. You check the SIEM and see that the workstation (IP 10.1.2.10) has been generating thousands of DNS queries to a domain 'badstuff.example.com' over the past hour. The firewall logs show that the workstation also made many outbound connections to IP 203.0.113.50 on port 80. The DNS queries are for various random subdomains of 'badstuff.example.com'. The school's web filter has no policy for this domain. The user is not technical and cannot explain the behavior. What is the most likely cause and the appropriate first action?

A.Run a full antivirus scan on the workstation

B.Isolate the workstation from the network and add the domain to the block list

C.Update the web filter to block the domain and continue monitoring

D.Ignore the alert because DNS tunneling is not a real threat

AnswerB

Isolation stops the DNS tunneling immediately; blocking the domain prevents future connections.

Why this answer

The workstation is generating thousands of DNS queries for random subdomains of 'badstuff.example.com' and making outbound connections to IP 203.0.113.50 on port 80. This behavior is classic DNS tunneling, where an infected host encodes data in DNS queries to bypass security controls. Isolating the workstation stops the immediate threat and data exfiltration, while adding the domain to the block list prevents further communication from other hosts.

A full antivirus scan is insufficient because DNS tunneling malware often evades signature-based detection and requires network containment first.

Exam trap

Cisco often tests the principle that containment (isolation) is the first priority in an active compromise, not remediation (scanning) or policy updates, and that DNS tunneling is a real exfiltration technique, not a false positive.

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan is a reactive step that does not stop ongoing data exfiltration; the malware may be unknown to signature databases, and the immediate priority is network containment. Option C is wrong because updating the web filter to block the domain does not address the already-compromised workstation that is actively tunneling data; the host must be isolated to prevent further damage. Option D is wrong because DNS tunneling is a well-documented exfiltration technique (e.g., using TXT or A record queries) and ignoring it could lead to significant data loss; it is a real threat, especially when combined with outbound HTTP connections to a suspicious IP.

Full explanation →

83

Multi-Selecteasy

Which TWO protocols are commonly used for remote administration and should be monitored for unauthorized access?

Select 2 answers

A.Telnet (port 23)

B.SSH (port 22)

C.RDP (port 3389)

D.SNMP (port 161/162)

E.FTP (port 20/21)

AnswersB, C

SSH is a secure remote administration protocol.

Why this answer

SSH (port 22) is correct because it provides encrypted remote administration, making it a common target for brute-force attacks and unauthorized access attempts. RDP (port 3389) is correct because it is the primary protocol for remote GUI administration on Windows systems and is frequently exploited via credential stuffing or vulnerability scanning. Both protocols should be monitored for anomalous login patterns and unauthorized access.

Exam trap

Cisco often tests the distinction between protocols used for remote administration (SSH, RDP) versus those used for network management (SNMP) or file transfer (FTP), and candidates may mistakenly include Telnet because it is historically associated with remote access, despite its lack of encryption and modern disuse.

Full explanation →

84

MCQhard

A SOC Tier 3 analyst is performing threat hunting. Which activity best describes the primary focus of a Tier 3 analyst?

A.Monitoring incoming alerts for potential incidents

B.Correlating alerts from multiple sources

C.Proactively searching for advanced threats

D.Creating user accounts and permissions

AnswerC

Threat hunting is a Tier 3 function.

Why this answer

Tier 3 focuses on proactive threat hunting and advanced analysis.

Full explanation →

85

MCQmedium

A security analyst wants to monitor file creation events on a critical Windows server without installing additional software. Which Windows audit policy should be configured?

A.Audit Detailed Tracking

B.Audit File System

C.Audit Account Logon

D.Audit Process Creation

AnswerB

Audit File System logs file system operations like create, write, delete.

Why this answer

Audit File System policy is the correct choice because it specifically enables auditing of file creation, modification, and deletion events on NTFS volumes. By configuring this policy under Advanced Audit Policy in Windows, the security analyst can monitor file creation events on the critical server without requiring any third-party software, as the events are logged to the Windows Security log with Event ID 4663.

Exam trap

Cisco often tests the distinction between 'Audit File System' (file-level operations) and 'Audit Detailed Tracking' (process-level operations), causing candidates to confuse file creation with process creation events.

How to eliminate wrong answers

Option A is wrong because Audit Detailed Tracking focuses on process creation, termination, and handle duplication events (e.g., Event ID 4688), not file creation events. Option C is wrong because Audit Account Logon monitors authentication events against domain controllers or local SAM (e.g., Event ID 4624), not file system operations. Option D is wrong because Audit Process Creation logs when a process is created or starts (Event ID 4688), which does not capture file creation events on the file system.

Full explanation →

86

Multi-Selectmedium

An analyst is examining a PCAP file for signs of lateral movement. Which TWO of the following are typical indicators of lateral movement using pass-the-hash?

Select 2 answers

A.Multiple SMB authentication attempts from a single host to multiple other hosts

B.HTTP requests to a web server

C.ICMP timestamp requests

D.Large file transfers using FTP

E.Use of NTLM authentication without a password, only the hash

AnswersA, E

SMB is commonly used for lateral movement in Windows environments.

Why this answer

Pass-the-hash attacks use NTLM authentication with hashed credentials. Indicators include multiple SMB authentication attempts from one host to many others and the use of NTLM hashes.

Full explanation →

87

MCQhard

An analyst is reviewing Sysmon logs on a Windows host and sees Event ID 1 (process creation) with a signed parent process but an unsigned child. The child has a CommandLine that includes 'powershell -EncodedCommand'. What is the most likely threat?

A.PowerShell-based malware using encoded commands to evade detection

B.Privilege escalation attempt

C.Process hollowing attack

D.Phishing email attachment

AnswerA

Encoded commands are a common obfuscation technique in PowerShell attacks.

Why this answer

Event ID 1 with a signed parent process and an unsigned child using 'powershell -EncodedCommand' strongly indicates PowerShell-based malware. Attackers use Base64-encoded commands to obfuscate malicious actions and bypass simple string-based detection, as the encoded payload is decoded and executed by PowerShell at runtime.

Exam trap

Cisco often tests the distinction between execution indicators (like encoded PowerShell commands) and other attack stages (like privilege escalation or process hollowing), leading candidates to confuse a common obfuscation technique with a different attack type.

How to eliminate wrong answers

Option B is wrong because privilege escalation typically involves exploiting vulnerabilities to gain higher privileges, not simply executing an encoded PowerShell command from a signed parent. Option C is wrong because process hollowing replaces the memory of a legitimate process with malicious code, which would not manifest as a child process with an encoded PowerShell command. Option D is wrong because a phishing email attachment is a delivery vector, not a direct threat indicator; the Sysmon log shows execution, not the initial infection method.

Full explanation →

88

MCQeasy

During network intrusion analysis, an analyst reviews logs and observes an alert for a TCP SYN scan. Which characteristic of a SYN scan would the analyst look for in packet captures?

A.The scan sends SYN packets and expects ICMP unreachable messages for open ports.

B.The scan sends SYN packets and waits for a timeout on closed ports.

C.The scan sends SYN packets and, upon receiving SYN-ACK, sends RST packets.

D.The scan sends SYN packets and completes the three-way handshake for open ports.

AnswerC

Correct. SYN scan sends RST after SYN-ACK to avoid establishing a full connection.

Why this answer

A SYN scan sends a SYN packet and, upon receiving a SYN-ACK from the target, responds with a RST instead of completing the handshake. This avoids a full connection and is stealthier.

Full explanation →

89

MCQmedium

An analyst uses Volatility on a memory dump and runs the 'pstree' command. What specific information does this provide compared to 'pslist'?

A.It shows only hidden processes.

B.It extracts command line arguments.

C.It displays the process tree hierarchy.

D.It lists loaded kernel modules.

AnswerC

pstree displays parent-child relationships in a tree format.

Why this answer

pstree shows parent-child relationships between processes, which pslist does not.

Full explanation →

90

MCQmedium

Which security principle ensures that a user cannot deny having performed an action?

A.Availability

B.Confidentiality

C.Non-repudiation

D.Integrity

AnswerC

Non-repudiation provides undeniable evidence.

Why this answer

Non-repudiation ensures that a user cannot deny having performed an action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In network security, this is often implemented through protocols like PKI (Public Key Infrastructure) where a sender signs data with their private key, and the receiver verifies it with the corresponding public key, providing irrefutable proof of origin.

Exam trap

Cisco often tests the distinction between integrity and non-repudiation, where candidates mistakenly choose integrity because they associate hashing with proof of origin, but integrity only verifies data has not changed, not who sent it.

How to eliminate wrong answers

Option A is wrong because availability ensures that systems and data are accessible when needed, often through redundancy and fault tolerance, but it does not prevent denial of actions. Option B is wrong because confidentiality protects data from unauthorized disclosure via encryption or access controls, but it does not provide proof of who performed an action. Option D is wrong because integrity ensures that data has not been altered in transit or at rest, typically via hashing or checksums, but it does not tie an action to a specific user in a non-repudiable way.

Full explanation →

91

MCQhard

During incident response, a security analyst reviews a PCAP file and sees TCP packets with only the SYN flag set, followed by RST packets upon receiving a SYN-ACK. No connection is established. Which scanning technique is being used?

A.Half-open scan (SYN scan)

B.FIN scan

C.Christmas tree scan

D.Full connect scan

AnswerA

Half-open scan sends SYN, receives SYN-ACK, then RST to avoid detection.

Why this answer

The described behavior—sending a SYN packet, receiving a SYN-ACK, and immediately replying with an RST—is the hallmark of a half-open (SYN) scan. This technique never completes the three-way handshake, so the target does not log an established connection, making it stealthier than a full connect scan. The RST sent after the SYN-ACK terminates the handshake before it can be fully established, confirming the port is open without creating a full session.

Exam trap

Cisco often tests the distinction between a half-open scan and a full connect scan by focusing on whether the three-way handshake is completed; the trap here is that candidates may confuse the RST sent after SYN-ACK as part of a normal connection teardown, rather than recognizing it as the defining characteristic of a SYN scan that never completes the handshake.

How to eliminate wrong answers

Option B (FIN scan) is wrong because a FIN scan sends a packet with only the FIN flag set, expecting an RST from closed ports and no response from open ports; it does not involve SYN or SYN-ACK exchanges. Option C (Christmas tree scan) is wrong because it sends packets with the FIN, URG, and PSH flags set (a 'lit-up' combination), not just the SYN flag, and relies on different responses from open vs. closed ports per RFC 793. Option D (Full connect scan) is wrong because it completes the full three-way handshake (SYN, SYN-ACK, ACK) before sending an RST to close the connection, whereas the scenario shows an RST sent immediately after the SYN-ACK, before the final ACK.

Full explanation →

92

MCQmedium

Refer to the exhibit. A security analyst observes a SIEM alert and a firewall log. The firewall allowed the traffic. According to the company's security policy, which action should the analyst take first?

A.Check if the firewall blocked the traffic.

B.Investigate the user's recent activity.

C.Ignore the alert as it is a false positive.

D.Create a firewall rule to block the source IP.

AnswerD

Immediate containment by blocking the IP is appropriate.

Why this answer

The firewall log shows the traffic was allowed, and the SIEM alert indicates a security event. According to the security policy, the immediate action is to block the source IP to prevent further potential malicious activity. Creating a firewall rule to block the source IP is a direct and effective response to mitigate the threat.

Exam trap

Cisco often tests the candidate's ability to prioritize containment over investigation, leading them to mistakenly choose 'investigate the user's recent activity' instead of immediately blocking the malicious source IP.

How to eliminate wrong answers

Option A is wrong because the firewall log explicitly shows the traffic was allowed, so checking if it was blocked is redundant and wastes time. Option B is wrong because while investigating user activity may be necessary later, the first priority under the security policy is to contain the threat by blocking the source IP. Option C is wrong because the SIEM alert and firewall log together indicate a real security event, not a false positive, so ignoring it would violate security policy.

Full explanation →

93

MCQeasy

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

A.Availability

B.Authentication

C.Integrity

D.Confidentiality

AnswerC

Integrity ensures data is not altered by unauthorized parties.

Why this answer

The integrity element of the CIA triad ensures that data cannot be modified by unauthorized parties. Integrity mechanisms, such as hashing algorithms (e.g., SHA-256) or digital signatures, detect any unauthorized changes to data in transit or at rest. If an attacker alters a packet or file, the hash value will not match, alerting the system to the breach.

Exam trap

Cisco often tests the distinction between confidentiality and integrity, where candidates mistakenly choose confidentiality because they associate encryption with all data protection, but encryption only prevents reading, not modification.

How to eliminate wrong answers

Option A is wrong because availability ensures that data and services are accessible when needed, not that data remains unmodified; it focuses on uptime and resilience against denial-of-service attacks. Option B is wrong because authentication verifies the identity of a user or device (e.g., via passwords or certificates), but does not protect data from modification once access is granted. Option D is wrong because confidentiality ensures that data is not disclosed to unauthorized parties (e.g., via encryption), but does not prevent unauthorized modification of that data.

Full explanation →

94

MCQmedium

Which cryptographic method uses the same key for both encryption and decryption, and is typically faster than asymmetric encryption?

A.Digital signature

B.RSA

C.AES

D.SHA-256

AnswerC

AES is a symmetric encryption algorithm.

Why this answer

Symmetric encryption uses a single shared key for both operations.

Full explanation →

95

Multi-Selecteasy

Which TWO of the following are examples of malware that rely on user interaction to spread? (Select two.)

Select 2 answers

A.Rootkit

B.Worm

C.Trojan

D.Virus

E.Ransomware

AnswersC, D

Trojans rely on users to download and execute them.

Why this answer

A virus requires user action (e.g., opening an infected file) to execute and spread. A Trojan also relies on user deception to install. Worms spread without user interaction.

Full explanation →

96

MCQhard

A security team implements an IPS that uses behavioral profiling. Which type of detection method is being used?

A.Heuristic

B.Signature-based

C.Rule-based

D.Anomaly-based

AnswerD

Behavioral profiling defines normal behavior and detects anomalies.

Why this answer

Behavioral profiling establishes a baseline of normal network traffic patterns and then flags deviations from that baseline as potential threats. This is the core mechanism of anomaly-based detection, which identifies malicious activity by comparing observed behavior against a learned model of normal behavior rather than against predefined signatures or rules.

Exam trap

Cisco often tests the distinction between anomaly-based and heuristic detection, where candidates mistakenly choose heuristic because both involve 'behavior' or 'profiling,' but heuristic relies on predefined rules of thumb while anomaly-based relies on a learned baseline of normal behavior.

How to eliminate wrong answers

Option A is wrong because heuristic detection uses algorithms or rules of thumb to identify suspicious behavior based on general characteristics, not by learning and comparing against a baseline of normal behavior. Option B is wrong because signature-based detection relies on predefined patterns (e.g., byte sequences or known exploit payloads) to match known threats, not on behavioral profiling. Option C is wrong because rule-based detection uses static, manually defined rules (e.g., 'if port 445 and SMB traffic, then alert') rather than dynamically learned behavioral baselines.

Full explanation →

97

Multi-Selecteasy

An organization's security policy defines acceptable use of corporate email. Which THREE of the following actions are typically prohibited?

Select 3 answers

A.Using email to subscribe to personal newsletters.

B.Emailing the IT support for assistance.

C.Sending personal emails using the corporate account.

D.Forwarding corporate emails to personal external accounts.

E.Using email to send sensitive customer data without encryption.

AnswersC, D, E

Often restricted to incidental use only.

Why this answer

Corporate email accounts are company property intended for business use. Sending personal emails consumes company resources and can expose the organization to legal liability, data leakage, or productivity loss, which is why acceptable use policies (AUPs) typically prohibit this action.

Exam trap

Cisco often tests the distinction between actions that are 'typically prohibited' versus those that are merely discouraged or context-dependent, leading candidates to over-select options like personal newsletter subscriptions (Option A) that are not universally banned.

Full explanation →

98

Multi-Selecthard

Which three steps are part of the network intrusion analysis process according to Cisco best practices?

Select 3 answers

A.Collection

B.Detection

C.Prevention

D.Analysis

E.Remediation

AnswersA, B, D

Collecting data from network sources is the first step.

Why this answer

Collection is correct because the network intrusion analysis process begins with gathering raw data from sources such as NetFlow, syslogs, and packet captures (PCAP). This step ensures that all relevant evidence is preserved for subsequent detection and analysis, aligning with Cisco's best practices for incident response.

Exam trap

Cisco often tests the distinction between the analysis process steps and adjacent security functions (prevention, remediation) to see if candidates confuse the reactive analysis workflow with proactive or corrective actions.

Full explanation →

99

Multi-Selecteasy

A security analyst is creating a procedure for responding to a phishing email reported by a user. Which TWO steps should be included?

Select 2 answers

A.Delete the email from the user's inbox remotely.

B.Ask the user to forward the original email to the security team.

C.Immediately block the sender's email address at the gateway.

D.Require the user to change their password.

E.Investigate if any other users received similar emails.

AnswersC, E

Blocking prevents further phishing attempts from that sender.

Why this answer

Immediately blocking the sender's email address at the gateway (e.g., using SMTP rejection or a content filter rule) prevents the same phishing email from reaching other users, containing the threat at the perimeter. This step aligns with incident response containment procedures and leverages email security controls like SPF, DKIM, or DMARC checks to stop further delivery.

Exam trap

Cisco often tests the distinction between containment (blocking at the gateway) and remediation (password reset or deletion), tricking candidates into selecting user-focused actions like password changes or forwarding instead of the network-level containment step.

Full explanation →

100

MCQmedium

During a security incident, a security analyst isolates an affected host and collects a memory dump. According to incident response procedures, what is the next step the analyst should take?

A.Reboot the host to clear any malware from memory

B.Notify the public relations team immediately

C.Restore the host from a known good backup

D.Analyze the memory dump to identify indicators of compromise

AnswerD

Analysis is the logical next step after data collection to determine the cause and extent.

Why this answer

After isolating the host and collecting a memory dump, the next step is to analyze the dump to extract volatile evidence such as running processes, network connections, and injected code. This analysis identifies indicators of compromise (IoCs) that inform containment and eradication. Skipping analysis would lose critical forensic data and hinder understanding of the attack vector.

Exam trap

Cisco often tests the misconception that immediate remediation (reboot or restore) is the priority, when in fact forensic preservation and analysis must occur first to understand the full scope of the compromise.

How to eliminate wrong answers

Option A is wrong because rebooting the host destroys volatile memory evidence, including malware artifacts and process information, which is essential for forensic analysis. Option B is wrong because notifying the public relations team is a communication step that occurs after technical analysis and containment, not immediately after evidence collection. Option C is wrong because restoring from a known good backup should only occur after the root cause and IoCs are identified, to avoid reintroducing the same vulnerability or missing persistent threats.

Full explanation →

101

MCQeasy

A security analyst is notified that an employee's laptop was stolen. The laptop contains sensitive customer data. Which type of threat does this incident represent?

A.Exploit

B.Risk

C.Threat

D.Vulnerability

AnswerC

A threat is any potential danger that could exploit a vulnerability.

Why this answer

The threat is the potential compromise of confidentiality due to physical theft of a device containing sensitive data.

Full explanation →

102

MCQmedium

An analyst reviews the Cisco ASA syslog message shown in the exhibit. What does this entry indicate?

A.A successful HTTP connection from the outside to the inside server

B.A VPN tunnel initiation that was rejected due to authentication failure

C.An attempted connection from an external host to an internal web server that was blocked by the firewall

D.A NAT translation failure for an outbound connection

AnswerC

Correctly describes the denied inbound TCP connection to port 80.

Why this answer

The syslog message shows a deny action for an HTTP connection (port 80) from an external IP (outside) to an internal IP (inside). The '%ASA-4-106023' message indicates a packet was denied by the firewall's access control list (ACL). This matches the scenario of an attempted external-to-internal web connection being blocked, which is option C.

Exam trap

Cisco often tests the ability to distinguish between different syslog message IDs (e.g., 106023 for ACL denies vs. 305006 for NAT failures) and to correctly interpret the 'Deny' keyword as a block, not a successful connection.

How to eliminate wrong answers

Option A is wrong because the syslog explicitly says 'Deny', not 'Allow', so a successful HTTP connection is not indicated. Option B is wrong because VPN tunnel initiation failures are typically logged with different syslog IDs (e.g., 713228 for IKE failure) and involve authentication or phase-1/phase-2 errors, not a simple TCP deny on port 80. Option D is wrong because NAT translation failures generate syslog messages like '%ASA-3-305006' for 'no translation group found', not a deny action on a specific port/protocol.

Full explanation →

103

MCQeasy

A security analyst is investigating a suspected malware infection on a Windows host. The analyst wants to identify processes that have network connections. Which built-in Windows tool should the analyst use?

A.netstat

B.ipconfig

C.tasklist

D.nslookup

AnswerA

netstat shows active connections and listening ports with associated process IDs.

Why this answer

Netstat (network statistics) is the correct built-in Windows tool for displaying active TCP and UDP connections, listening ports, and the associated process IDs (PIDs). By using netstat with the `-b` or `-o` flag, the analyst can map each network connection to its owning process, which is essential for identifying suspicious processes communicating over the network.

Exam trap

Cisco often tests the distinction between tools that show process lists (tasklist) and tools that show network connections (netstat), trapping candidates who confuse 'process enumeration' with 'network connection enumeration'.

How to eliminate wrong answers

Option B (ipconfig) is wrong because it displays IP configuration details such as IP address, subnet mask, and default gateway, but it does not show active network connections or the processes using them. Option C (tasklist) is wrong because it lists running processes and their memory usage, but it does not reveal which processes have open network sockets or connections. Option D (nslookup) is wrong because it is a DNS query tool used to resolve domain names to IP addresses or perform reverse lookups, and it provides no information about local processes or their network connections.

Full explanation →

104

MCQeasy

When performing file analysis, which method is most reliable for determining the actual file type regardless of its extension?

A.Opening the file in a text editor

B.Checking the file extension

C.Examining the file's magic bytes

D.Checking the file size

AnswerC

Magic bytes are consistent and reliable for file type identification.

Why this answer

Magic bytes (or file signatures) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. This method is reliable because it examines the actual binary content, such as the 'PK' header for ZIP files or '‰PNG' for PNG images, rather than relying on user-assigned metadata that can be easily changed.

Exam trap

Cisco often tests the concept that file extensions are user-modifiable metadata and thus unreliable, while magic bytes provide a content-based verification that is independent of the filename.

How to eliminate wrong answers

Option A is wrong because opening a file in a text editor only displays raw text or garbled characters for binary files, and it does not reliably identify the file type; it may also misinterpret encoding or execute harmful content. Option B is wrong because checking the file extension is unreliable—extensions can be renamed arbitrarily (e.g., renaming a .exe to .jpg) and do not reflect the actual file content. Option D is wrong because checking the file size provides no information about the file's structure or format; two files of identical size can be completely different types.

Full explanation →

105

MCQeasy

In network forensics, which Wireshark filter would be used to reconstruct a TCP conversation between two hosts?

A.ip.addr

B.http.request

C.tcp.stream eq 0

D.dns.qry.name

AnswerC

Correct. tcp.stream allows viewing the full TCP conversation.

Why this answer

The tcp.stream filter isolates all packets belonging to a specific TCP connection.

Full explanation →

106

MCQmedium

You are an analyst in a SOC that monitors a retail company with multiple branch offices. The company uses VPN connections between branches. The SIEM reports that a branch office router (IP 10.99.0.1) has been sending large amounts of data to an external IP 185.220.101.10 on port 123 (NTP) during off-hours. The NTP traffic is abnormal because the branch uses a local time server. The amount of data sent is 2 GB over 8 hours. The router logs show normal administrative traffic. The branch manager reports no issues. You check threat intelligence and find that 185.220.101.10 is a known malicious IP associated with data exfiltration. What should be your immediate response?

A.Disable NTP service on the branch router

B.Notify the CISO and wait for further instructions

C.Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router

D.Contact the branch manager to confirm if any scheduled backups are running

AnswerC

Blocking the IP stops the exfiltration, and investigating the router determines if it is compromised.

Why this answer

The branch router is sending 2 GB of NTP traffic to a known malicious IP (185.220.101.10) during off-hours, which is a strong indicator of data exfiltration using NTP (often via tunneling or covert channels). The immediate response should be to block the external IP on the firewall to stop the data flow and initiate incident response to investigate the compromised router, as the traffic is abnormal (branch uses a local time server) and the IP is associated with exfiltration.

Exam trap

Cisco often tests the candidate's ability to prioritize immediate containment (blocking the malicious IP) over administrative or investigative delays, and the trap here is that candidates may choose to disable the service (Option A) without realizing that the exfiltration is already in progress and must be stopped at the network level first.

How to eliminate wrong answers

Option A is wrong because disabling NTP service on the branch router would not stop the ongoing exfiltration (the traffic is already being sent to the malicious IP) and could disrupt legitimate time synchronization if the local time server fails; the priority is to block the external communication. Option B is wrong because notifying the CISO and waiting for further instructions delays the immediate containment action required to stop data exfiltration, violating the SOC's duty to mitigate active threats. Option D is wrong because contacting the branch manager to confirm scheduled backups is irrelevant—backups would not use NTP port 123 to send 2 GB of data to a known malicious IP, and this action wastes time during an active security incident.

Full explanation →

107

Multi-Selecthard

Which TWO standards/protocols are directly associated with threat intelligence sharing as defined by the CyberOps Associate curriculum?

Select 2 answers

A.ISO 27001

B.TAXII

C.OpenIOC

D.STIX

E.MISP

AnswersB, D

Trusted Automated eXchange of Indicator Information is a protocol for sharing STIX.

Why this answer

STIX and TAXII are the primary standards for threat intelligence sharing. OpenIOC and MISP are related but not the core standards defined.

Full explanation →

108

MCQhard

Refer to the exhibit. A security analyst is reviewing the ASA configuration. Which traffic will be permitted from the outside interface?

A.Any IP traffic to host 10.1.1.1

B.All traffic from the outside to the inside network

C.TCP traffic to host 10.1.1.1 on port 80

D.HTTP traffic from internal hosts to the outside

AnswerC

The first ACL line permits TCP to 10.1.1.1 port 80.

Why this answer

The ASA configuration shown includes an access-list entry that permits TCP traffic from any source to host 10.1.1.1 on port 80. This is the only rule that explicitly allows traffic from the outside interface to the inside network, and since the outside interface has the access-group applied inbound, only traffic matching this permit statement will be allowed.

Exam trap

Cisco often tests the distinction between 'any IP traffic' and 'any TCP traffic' — the trap here is that candidates may assume 'permit tcp any host 10.1.1.1 eq 80' allows all IP traffic to that host, but it strictly permits only TCP with destination port 80.

How to eliminate wrong answers

Option A is wrong because the access-list permits only TCP traffic to host 10.1.1.1, not any IP traffic (which would include UDP, ICMP, etc.). Option B is wrong because the access-list does not permit all traffic from outside to inside; it only permits TCP traffic to a specific host on a specific port. Option D is wrong because the question asks about traffic permitted from the outside interface, not traffic originating from internal hosts; HTTP traffic from internal hosts to the outside would be evaluated by a different access-list applied to the inside interface or by stateful inspection rules.

Full explanation →

109

MCQmedium

An analyst is reviewing PCAP and sees a TCP stream with a Wireshark filter 'tcp.stream eq 0'. The conversation shows an interactive shell session with commands like 'whoami' and 'ls'. This is most likely evidence of what?

A.DNS tunneling

B.Reverse shell

C.SQL injection

D.ARP spoofing

AnswerB

Reverse shell provides command-line access.

Why this answer

An interactive shell session over TCP indicates a reverse shell, allowing the attacker to execute commands remotely.

Full explanation →

110

MCQmedium

An incident response plan specifies that containment must be completed before eradication. A security analyst identifies a malware infection on a critical server. What should be done first?

A.Disconnect the server from the network

B.Run antivirus scans

C.Notify law enforcement

D.Reinstall the operating system

AnswerA

Disconnecting is a containment action that prevents further spread.

Why this answer

According to the incident response plan, containment must be completed before eradication. Disconnecting the server from the network (Option A) is the immediate containment action that prevents the malware from spreading laterally to other hosts, preserving the integrity of the network and allowing for forensic analysis. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized to limit damage before any eradication or recovery steps are taken.

Exam trap

Cisco often tests the strict ordering of the incident response phases (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident Activity), and the trap here is that candidates confuse eradication actions (like running antivirus or reinstalling the OS) with the required first containment step, leading them to choose a technically plausible but procedurally incorrect answer.

How to eliminate wrong answers

Option B is wrong because running antivirus scans is an eradication or detection step, not a containment action; performing scans before containment could alert the malware or cause it to spread further. Option C is wrong because notifying law enforcement is a post-containment notification step that occurs after the scope of the incident is understood and evidence is preserved, not the first action. Option D is wrong because reinstalling the operating system is a recovery/eradication step that should only occur after containment is complete and forensic evidence has been collected; doing so first would destroy volatile data and potentially violate chain of custody.

Full explanation →

111

MCQeasy

An analyst is investigating a potential DNS tunneling attack. Which characteristic in DNS traffic would most likely indicate DNS tunneling?

A.DNS queries with long, random-looking subdomains to a single domain.

B.Frequent DNS queries to the same domain at regular intervals.

C.DNS queries for domains that are known to be malicious.

D.DNS query responses with unusually large payload sizes.

AnswerA

Correct. Tunneling encodes data in subdomains, making them long and random.

Why this answer

DNS tunneling often encodes data in subdomains, resulting in long, random-looking domain names that differ from legitimate traffic.

Full explanation →

112

MCQeasy

In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?

A.SQL injection

B.Buffer overflow

C.Cross-site scripting

D.Command injection

AnswerA

UNION SELECT is a classic SQL injection pattern.

Why this answer

SQL injection attacks often include SQL keywords like UNION and SELECT in crafted parameters.

Full explanation →

113

Multi-Selectmedium

Which THREE indicators are commonly found in network traffic that suggest a host is part of a botnet? (Choose three.)

Select 3 answers

A.Connections to known IRC servers on non-standard ports

B.Large file downloads from external servers

C.Periodic connections to IP addresses with poor reputation

D.High volumes of outbound traffic to multiple destinations

E.Frequent DNS queries to legitimate corporate DNS servers

AnswersA, C, D

IRC is a common C2 channel.

Why this answer

Botnets often use IRC (Internet Relay Chat) for command and control (C2) communication. Attackers configure IRC servers on non-standard ports (e.g., TCP 6667–6669 are common, but botnets may use ports like 8080, 8443, or random high ports) to evade detection by security tools that monitor default IRC ports. The presence of persistent IRC connections to unusual ports is a strong indicator of botnet activity.

Exam trap

Cisco often tests the distinction between normal network behavior (like large downloads or frequent DNS queries) and specific botnet indicators (IRC on non-standard ports, connections to low-reputation IPs, and asymmetric outbound traffic patterns), trapping candidates who confuse generic high-bandwidth activity with botnet C2 signatures.

Full explanation →

114

Multi-Selecteasy

Which TWO are examples of technical security controls? (Select two.)

Select 2 answers

A.Firewall

B.Security policy

C.Security awareness training

D.Background checks

E.Encryption

AnswersA, E

Firewalls are technical controls that filter network traffic.

Why this answer

A firewall is a technical security control because it is a hardware or software device that enforces access policies by inspecting network traffic based on rules (e.g., permit/deny IP addresses, ports, protocols). Encryption is a technical control that transforms plaintext data into ciphertext using algorithms like AES-256 or RSA, ensuring confidentiality during storage or transmission. Both are implemented through technology rather than administrative or physical means.

Exam trap

Cisco often tests the distinction between administrative, physical, and technical controls, and the trap here is that candidates confuse a security policy (a document) or training (a human process) with a technical control, because they are all part of a defense-in-depth strategy.

Full explanation →

115

MCQmedium

A SOC analyst is tuning IDS signatures and notices that a particular signature triggers frequently on legitimate traffic from a specific internal application. The signature has a high false positive rate. What is the best action to take?

A.Disable the signature entirely.

B.Increase the severity of the signature to get more attention.

C.Create a suppression rule to ignore the specific source IP or application.

D.Change the signature action to 'alert' instead of 'drop'.

AnswerC

A suppression rule allows the signature to remain active but not alert on known benign traffic.

Why this answer

To reduce false positives without losing detection capability, the analyst should create a suppression filter that excludes the known benign IP or application from triggering the signature.

Full explanation →

116

MCQeasy

Based on the exhibit, which host is likely engaged in data exfiltration?

A.10.0.0.1

B.10.0.0.3

C.10.0.0.2

D.None of the above

AnswerA

This host has large volumes of data to external web servers.

Why this answer

Host 10.0.0.1 is likely engaged in data exfiltration because the exhibit shows a large volume of outbound TCP traffic from this IP to an external destination on port 443 (HTTPS), with a significantly higher byte count compared to other hosts. This pattern is consistent with data being encrypted and sent to an external server, a common exfiltration technique to bypass inspection.

Exam trap

Cisco often tests the concept that data exfiltration is indicated by a high volume of outbound traffic to an external destination, especially over encrypted channels, and the trap here is that candidates may overlook the byte count asymmetry and focus only on the destination port or protocol, missing the key behavioral indicator.

How to eliminate wrong answers

Option B (10.0.0.3) is wrong because its traffic pattern shows a balanced exchange of packets with internal hosts, typical of normal internal communication, not exfiltration. Option C (10.0.0.2) is wrong because its outbound traffic volume is low and primarily to internal IPs, indicating routine operations rather than data theft. Option D (None of the above) is wrong because the exhibit clearly identifies 10.0.0.1 as the host with anomalous outbound data volume, making it the correct choice.

Full explanation →

117

MCQhard

A Cisco Firepower sensor is generating a high number of false positives from a rule that triggers on large ICMP packets. The analyst suspects the rule threshold is too low. Which tuning action most effectively reduces false positives while maintaining detection of actual attacks?

A.Change the rule action from alert to drop.

B.Disable the rule entirely.

C.Add an exception for trusted source IPs.

D.Increase the packet size threshold.

AnswerD

This directly addresses the cause of false positives without disabling detection.

Why this answer

Increasing the packet size threshold (Option D) directly addresses the root cause of the false positives: the rule is triggering on legitimate large ICMP packets that are below the actual attack size. By raising the threshold to a value that still captures known attack vectors (e.g., ICMP echo requests exceeding 65,535 bytes in a fragmented attack), the sensor reduces noise while preserving detection of true malicious oversized packets. This is the most effective tuning action because it adjusts the detection parameter without disabling or bypassing the rule.

Exam trap

Cisco often tests the misconception that changing the rule action (e.g., to drop) or adding exceptions is the best way to reduce false positives, when in fact the most precise and effective method is to adjust the detection threshold parameter that is causing the false positives.

How to eliminate wrong answers

Option A is wrong because changing the rule action from alert to drop would still generate false positives (the rule would still match and drop legitimate traffic), potentially causing denial of service for valid large ICMP packets, and does not reduce the false positive rate. Option B is wrong because disabling the rule entirely eliminates detection of all oversized ICMP attacks, leaving the network vulnerable to actual threats such as ICMP fragmentation or ping-of-death attacks. Option C is wrong because adding an exception for trusted source IPs only reduces false positives from those specific sources; it does not address the underlying threshold issue and may miss attacks originating from trusted IPs that have been compromised.

Full explanation →

118

Multi-Selecthard

During packet analysis in Wireshark, which THREE findings are indicators of potential malicious activity? (Choose THREE.)

Select 3 answers

A.An HTTPS connection to a well-known website.

B.An unusually large ICMP echo request packet (e.g., 65,000 bytes).

C.Unencrypted credentials in an HTTP packet.

D.A normal DNS query for a common domain.

E.A large number of TCP SYN packets to various ports on one host.

AnswersB, C, E

Large ICMP packets could indicate a ping flood or covert channel.

Why this answer

An unusually large ICMP echo request packet, such as 65,000 bytes, exceeds the maximum allowed size for a standard ICMP packet (typically 65,535 bytes total including headers, but the data payload should not exceed 65,527 bytes). This oversized packet is a classic indicator of a 'Ping of Death' attack, where the attacker sends a malformed packet that causes a buffer overflow on the target system, leading to a crash or remote code execution. In Wireshark, such an anomaly stands out against normal ICMP traffic, which usually has a small payload (e.g., 32 or 56 bytes).

Exam trap

Cisco often tests the distinction between normal traffic patterns and protocol anomalies; the trap here is that candidates may overlook the 'unusually large' qualifier and dismiss ICMP anomalies as benign, or mistake a legitimate HTTPS connection for suspicious activity due to encryption.

Full explanation →

119

MCQmedium

A firewall log shows repeated denied packets from IP 10.0.0.5 to destination 192.168.1.10 on port 22. What is the most likely attack?

A.HTTP flood

B.SMB exploit

C.SSH brute force

D.DNS amplification

AnswerC

Repeated connection attempts on port 22 suggest SSH brute force.

Why this answer

Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Exam trap

Cisco often tests the association between specific port numbers and common attack types, so the trap here is that candidates may confuse port 22 with HTTP (port 80) or SMB (port 445) and pick a wrong answer based on the attack name rather than the port number.

How to eliminate wrong answers

Option A is wrong because an HTTP flood targets port 80 or 443 with a high volume of HTTP requests, not port 22 (SSH). Option B is wrong because an SMB exploit targets port 445 (SMB over TCP) or 139 (NetBIOS), not port 22, and involves exploiting vulnerabilities like EternalBlue, not repeated authentication attempts. Option D is wrong because a DNS amplification attack uses UDP port 53 and involves spoofed source IPs to amplify traffic toward a victim, not repeated TCP connections to port 22.

Full explanation →

120

MCQmedium

Which log source would provide the most detailed information about HTTP requests, including URLs and user agents?

A.DNS logs

B.Firewall logs

C.Web server logs

D.System logs

AnswerC

Web server logs record access details including URL, method, user-agent, etc.

Why this answer

Web server logs capture HTTP requests with details like URL, method, response code, and user-agent. They are the best source for HTTP traffic details.

Full explanation →

121

Multi-Selecthard

An organization is implementing a threat intelligence sharing program. Which THREE elements are commonly used standards or platforms for sharing threat intelligence?

Select 3 answers

A.MISP

B.ISAC

C.TAXII

D.STIX

E.OpenIOC

AnswersA, C, D

Malware Information Sharing Platform is a platform for sharing.

Why this answer

STIX, TAXII, and MISP are widely used for threat intelligence sharing. ISAC is an organization, not a standard/platform. OpenIOC is a format but less common now.

Full explanation →

122

MCQhard

During a security audit, it is discovered that an organization’s network is vulnerable to ARP spoofing attacks. Which type of attack could result from exploiting this vulnerability?

A.DNS poisoning

B.Man-in-the-middle

C.Phishing

D.DoS

AnswerB

ARP spoofing enables MitM by intercepting traffic.

Why this answer

ARP spoofing can be used to perform man-in-the-middle attacks by associating the attacker's MAC address with the IP address of a legitimate host.

Full explanation →

123

MCQmedium

A host is infected with malware that uses DNS tunneling to exfiltrate data. Which type of analysis would best detect this activity?

A.DNS log analysis

B.Windows event log analysis

C.Firewall log analysis

D.NetFlow analysis

AnswerA

DNS logs show query names, sizes, and frequency.

Why this answer

DNS tunneling encodes exfiltrated data within DNS queries or responses, often using TXT or A record types to bypass network security controls. DNS log analysis is the most direct detection method because it reveals anomalous patterns such as unusually long domain names, excessive NXDOMAIN responses, or high volumes of DNS traffic to a single external server, which are hallmarks of tunneling activity.

Exam trap

Cisco often tests the misconception that firewall logs or NetFlow are sufficient for detecting application-layer tunneling, when in fact only DNS-specific logs provide the granularity to see the encoded payloads within DNS queries.

How to eliminate wrong answers

Option B is wrong because Windows event log analysis focuses on system-level events (e.g., process creation, user logins) and does not capture network-layer DNS traffic, so it would miss the outbound data exfiltration. Option C is wrong because firewall logs typically record IP addresses, ports, and protocols but lack the DNS query/response payload details needed to detect the encoded data within DNS messages. Option D is wrong because NetFlow analysis provides metadata (source/destination IP, bytes transferred) but does not inspect the content of DNS packets, making it unable to identify the tunneling pattern or the data being exfiltrated.

Full explanation →

124

MCQhard

Refer to the exhibit. A network administrator notices that remote SSH logins to the router succeed, but the router is not sending accounting records. Based on the configuration, what is the most likely cause?

A.The AAA authorization method is set to local, not TACACS+.

B.The TACACS+ server key is not configured correctly.

C.The AAA authentication method uses local database instead of TACACS+.

D.The accounting command references a TACACS+ group that is not defined.

AnswerD

The group 'tacacs+' is not defined; only a server is configured.

Why this answer

The `accounting exec default` command references a TACACS+ server group named 'tacacs_server_group' that is not defined in the configuration. Without a defined server group, the router cannot send accounting records to any TACACS+ server, even though SSH authentication succeeds via the local database.

Exam trap

Cisco often tests the distinction between authentication, authorization, and accounting (AAA) components, and the trap here is that candidates assume a working authentication implies accounting is also functional, overlooking that accounting requires a correctly defined and referenced server group.

How to eliminate wrong answers

Option A is wrong because the AAA authorization method is not the issue; authorization controls what commands or services a user can execute, not whether accounting records are sent. Option B is wrong because the TACACS+ server key is configured correctly with the `key cisco123` command under the TACACS+ server definition, so key mismatch is not the cause. Option C is wrong because the AAA authentication method uses the local database for login, which allows SSH access to succeed, but accounting is independent of authentication; the problem is that the accounting method references an undefined server group, not that authentication uses local.

Full explanation →

125

MCQhard

A network baseline shows that a server typically sends 1-2 MB of data per hour to external IPs. Suddenly, the server sends 50 MB of data to an IP in a foreign country within 10 minutes. The traffic is encrypted. Which monitoring tool would best confirm data exfiltration?

A.NetFlow/IPFIX analysis comparing current traffic to baseline

B.Snort IDS with a rule to detect large file transfers

C.Wireshark packet capture with a display filter for the destination IP

D.Windows Event Logs for file access

AnswerA

NetFlow measures byte counts and can alert on deviation from baseline.

Why this answer

NetFlow/IPFIX provides flow records with byte counts, enabling detection of unusual data volumes, even with encrypted payloads.

Full explanation →

126

Multi-Selectmedium

A security analyst is examining system logs for signs of privilege escalation. Which THREE events are most relevant to detect such activity?

Select 3 answers

A.Execution of commands with sudo

B.Multiple failed login attempts

C.Modification of user group memberships

D.User account creation with administrator privileges

E.Successful SSH login from a remote IP

AnswersA, C, D

Sudo allows running commands as another user, often root.

Why this answer

Privilege escalation often involves account creation with elevated rights, changes to user privileges, and successful use of 'sudo' commands.

Full explanation →

127

Multi-Selectmedium

During a security incident involving an insider threat, which TWO roles are most likely to be directly involved in the response?

Select 2 answers

A.Legal counsel

B.HR

C.SOC Tier 1 analyst

D.PR

E.External auditor

AnswersA, B

Legal counsel advises on legal implications and procedures.

Why this answer

HR handles personnel issues, and legal counsel handles legal aspects like termination and potential charges.

Full explanation →

128

Multi-Selecthard

An analyst is investigating an alert triggered by a Snort rule that matches traffic on port 445 (SMB). The analyst sees that the signature has a high false positive rate. Which THREE factors should the analyst evaluate to tune the signature for better accuracy? (Choose three.)

Select 3 answers

A.Implementing a behavioral analysis heuristic to detect anomalous SMB activity.

B.Disabling the rule to eliminate false positives.

C.Creating a rule exception for internal subnets that use SMB for file sharing.

D.Adjusting the detection threshold to only alert when a certain number of SMB events occur within a time window.

E.Adding specific destination IP addresses of legitimate SMB servers.

AnswersC, D, E

Exceptions for known benign traffic improve accuracy.

Why this answer

Creating a rule exception for internal subnets that legitimately use SMB for file sharing reduces false positives by excluding known benign traffic. This allows the Snort rule to focus on external or anomalous SMB traffic on port 445, improving detection accuracy without disabling the rule entirely.

Exam trap

Cisco often tests the distinction between tuning an existing signature (e.g., adding exceptions or thresholds) versus implementing entirely new detection methods (e.g., behavioral analysis), which leads candidates to mistakenly select options that propose changing the detection approach rather than refining the rule.

Full explanation →

129

Multi-Selectmedium

During memory analysis using Volatility, an analyst wants to identify processes with suspicious network connections and potentially injected code. Which THREE plugins should the analyst use? (Select THREE)

Select 3 answers

A.hashdump

B.pstree

C.hivelist

D.malfind

E.netscan

AnswersB, D, E

Shows parent-child relationships to identify anomalies.

Why this answer

pstree shows process hierarchy, netscan lists network connections, and malfind detects injected code.

Full explanation →

130

MCQhard

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

A.Place both servers on the internal network with host-based firewalls

B.Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal

C.Use a VPN between the web server and database server

D.Place both servers on the same VLAN with a firewall between them

AnswerB

DMZ isolates web server; blocking outbound from DMZ prevents pivot.

Why this answer

Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Exam trap

Cisco often tests the misconception that host-based firewalls or VLANs alone provide sufficient segmentation, when in fact network-level DMZ isolation with explicit direction-based firewall rules is required to prevent lateral movement after a perimeter breach.

How to eliminate wrong answers

Option A is wrong because placing both servers on the internal network with host-based firewalls still allows the compromised web server to directly reach the database server if the host firewall is misconfigured or bypassed, and it lacks network-level segmentation to prevent lateral movement. Option C is wrong because a VPN between the web server and database server encrypts traffic but does not restrict the direction of connection initiation; an attacker on the web server could still use the VPN tunnel to pivot to the database server. Option D is wrong because placing both servers on the same VLAN with a firewall between them still permits Layer 2 adjacency and potential ARP spoofing or VLAN hopping attacks, and the firewall would need to inspect all traffic, which is less effective than true network segmentation with a DMZ.

Full explanation →

131

MCQmedium

A security analyst is reviewing firewall logs and notices a high number of denied outbound connections from an internal workstation to various external IP addresses on port 445 (SMB). What is the most likely explanation for this activity?

A.The user is browsing the web and the firewall is blocking HTTP

B.The workstation is performing a DNS lookup

C.The workstation is infected with malware attempting to spread via SMB

D.The workstation is performing a legitimate file transfer using FTP

AnswerC

Many worms and ransomware use SMB to propagate.

Why this answer

Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

Exam trap

Cisco often tests the association of specific ports with their services (e.g., SMB = 445) and expects candidates to recognize that anomalous outbound scanning on a file-sharing port indicates malware, not a benign application.

How to eliminate wrong answers

Option A is wrong because HTTP traffic uses ports 80 and 443, not port 445, and the firewall would block HTTP on those ports, not SMB. Option B is wrong because DNS lookups use UDP or TCP port 53, not port 445, and would not generate denied outbound connections to multiple external IPs. Option D is wrong because FTP uses ports 20 and 21 for control and data transfer, not port 445, and legitimate file transfers would not exhibit a high volume of denied connections to random external IPs.

Full explanation →

132

Multi-Selecteasy

Which two are best practices for deploying network-based intrusion detection systems? (Choose two.)

Select 2 answers

A.Place sensors behind firewalls to reduce false positives.

B.Enable all signatures to maximize detection.

C.Use tap or SPAN ports to ensure traffic visibility.

D.Use inline mode for all sensors to enable blocking.

E.Deploy sensors at network choke points.

AnswersC, E

Passive monitoring avoids impacting network performance.

Why this answer

Network-based intrusion detection systems (NIDS) must have full visibility into network traffic to detect malicious activity. Using a network tap or a SPAN (Switched Port Analyzer) port on a switch provides a copy of all traffic traversing a segment without introducing latency or single points of failure, ensuring the sensor can inspect packets without interfering with production traffic.

Exam trap

Cisco often tests the distinction between NIDS and IPS, and the trap here is that candidates confuse 'detection' with 'prevention,' leading them to select inline mode (Option D) even though the question specifically asks about intrusion detection systems, not prevention systems.

Full explanation →

133

MCQmedium

You are a cybersecurity analyst in a SOC. The company uses a combination of Snort NIDS and Windows Event Log monitoring. At 3:00 PM, you receive a critical alert: 'ET TROJAN Observed Malicious SSL Certificate (Fake Google)'. The alert shows that a workstation (IP 10.0.1.45) initiated an SSL connection to IP 192.0.2.10 on port 443. The certificate presented by the server is self-signed and claims to be 'google.com'. The destination IP is not in any known Google IP range. You check the firewall logs and see that the outbound connection was allowed. The workstation's host logs show that the user is a marketing employee who frequently accesses webmail. The user reports no unusual behavior. You also check the company's web proxy logs and see that the user accessed 'http://www.google.com' earlier today, but the SSL connection is to a different IP. What should be your next step?

A.Ignore the alert because the user is unaware of any issue

B.Isolate the workstation from the network and perform a forensic analysis

C.Wait and monitor the workstation for further alerts before taking action

D.Block the destination IP 192.0.2.10 on the firewall

AnswerB

Isolating the workstation prevents further damage, and forensic analysis can determine the root cause and scope of compromise.

Why this answer

The alert indicates a potential man-in-the-middle (MITM) attack or malware using a self-signed SSL certificate impersonating google.com. Isolating the workstation is critical to prevent lateral movement or data exfiltration while preserving evidence for forensic analysis. The combination of Snort NIDS detecting the malicious certificate and the connection to an unknown IP (192.0.2.10) strongly suggests compromise, regardless of user reports.

Exam trap

Cisco often tests the principle that user reports of 'no unusual behavior' are unreliable in incident response, and that immediate containment (isolation) takes precedence over monitoring or partial blocking.

How to eliminate wrong answers

Option A is wrong because ignoring the alert based solely on user denial is a security risk; users are often unaware of silent compromise (e.g., malware or MITM). Option C is wrong because waiting for further alerts could allow the attacker to exfiltrate data or pivot to other hosts; immediate containment is required. Option D is wrong because blocking the destination IP alone does not address the potential compromise of the workstation; the attacker could use other IPs or the malware may already be active locally.

Full explanation →

134

MCQmedium

An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?

A.The file is a genuine PDF file

B.The file is a plain text file

C.The file is a ZIP archive

D.The file is an executable

AnswerC

PK signature indicates ZIP.

Why this answer

The magic bytes 50 4B 03 04 correspond to a ZIP archive (PK is the signature). This suggests the file is actually a ZIP file disguised with a PDF extension, possibly containing malicious content.

Full explanation →

135

MCQeasy

A security analyst reviews the firewall log. What is the most likely reason for the denied connection?

A.The destination port is blocked by default

B.The source IP address is an external threat

C.The destination IP is a known malicious host

D.The access control list does not permit the traffic

AnswerD

Denied by access-group indicates ACL blocking.

Why this answer

The firewall log shows a denied connection, and the most likely reason is that the access control list (ACL) does not permit the traffic. Firewalls enforce security policies by evaluating traffic against ACL rules; if no rule explicitly allows the packet (based on source/destination IP, port, and protocol), the implicit deny at the end of the ACL drops the connection. This is the default behavior for stateful firewalls and is the most common cause of denied connections in logs.

Exam trap

Cisco often tests the concept that the implicit deny at the end of an ACL is the most common reason for denied traffic, tempting candidates to overthink with threat-based answers like external IPs or malicious hosts.

How to eliminate wrong answers

Option A is wrong because destination ports are not 'blocked by default' in a generic sense; firewalls block traffic based on ACL rules, not a default port blocklist, and many ports (e.g., 80, 443) are often permitted unless explicitly denied. Option B is wrong because the source IP being an external threat is a specific threat intelligence match, not the most likely reason for a denied connection; firewalls deny traffic primarily due to ACL mismatches, not because of external threat lists unless a rule explicitly references them. Option C is wrong because the destination IP being a known malicious host would require the firewall to have a threat intelligence feed or a specific block rule; without such a rule, the firewall would not deny traffic based solely on reputation, and the log entry would typically indicate a threat block, not a generic ACL deny.

Full explanation →

136

MCQmedium

During a change management process, a security administrator approves a firewall rule change. After implementation, a critical application becomes unreachable. Which step in the change process was likely missed?

A.Post-implementation documentation

B.Backout plan development

C.Testing in a staging environment

D.Peer review of the change

AnswerB

Without a backout plan, reverting changes is delayed.

Why this answer

A backout plan is a critical step in change management that defines the specific actions to revert a change if it causes issues. Without a pre-defined backout plan, the administrator has no structured method to quickly restore the firewall rule to its previous state, leading to extended downtime for the critical application. The backout plan should include the exact commands or steps to remove or disable the new rule, such as deleting an access control entry (ACE) in a Cisco ASA or NGFW.

Exam trap

Cisco often tests the distinction between a backout plan and testing in a staging environment, where candidates mistakenly think thorough testing eliminates the need for a rollback procedure, but in production, unforeseen interactions (e.g., asymmetric routing, NAT overlap) can still cause failures.

How to eliminate wrong answers

Option A is wrong because post-implementation documentation is performed after the change is verified successful, and its absence does not cause the application to become unreachable; it only affects future audits or troubleshooting. Option C is wrong because testing in a staging environment, while valuable, is not the step that directly addresses the immediate need to revert a failed change; the missed step is the backout plan, which provides a safety net even if staging tests were passed. Option D is wrong because peer review of the change is a quality check on the proposed rule syntax and intent, but it does not provide a mechanism to undo the change if it breaks production; the backout plan is the operational fallback that was missing.

Full explanation →

137

MCQhard

A security analyst for a medium-sized enterprise is monitoring the network using Cisco Stealthwatch. They notice a sudden spike in traffic originating from an internal host (IP 10.10.10.50) communicating with multiple external IP addresses on port 445 (SMB). The host is a Windows server that typically serves web applications on ports 80 and 443. The analyst checks the host's firewall logs and finds that Windows Firewall is disabled. The host's antivirus is up to date and no alerts were triggered. The traffic pattern shows multiple connection attempts to /24 subnets across the internet, each with a single packet per destination. Based on this behavior, what is the most likely issue?

A.The host is infected with malware that is performing network reconnaissance.

B.The host is part of a distributed vulnerability scanning initiative.

C.The host is being used for a DDoS amplification attack.

D.The host is legitimately scanning the internet for outdated SMB shares.

AnswerA

The pattern matches malware scanning for SMB vulnerabilities (e.g., EternalBlue).

Why this answer

The traffic pattern—multiple connection attempts to /24 subnets across the internet, each with a single packet per destination—is classic behavior for network reconnaissance, specifically scanning for open SMB ports. The host's Windows Firewall being disabled and the lack of antivirus alerts indicate that the host is likely compromised and running malware that is performing this reconnaissance, as legitimate scanning or DDoS amplification would not exhibit this single-packet-per-destination pattern.

Exam trap

Cisco often tests the distinction between reconnaissance (scanning) and attack (exploitation/DDoS), where candidates may confuse the single-packet scanning pattern with DDoS amplification or legitimate scanning, but the key is the lack of handshake completion and the disabled firewall indicating compromise.

How to eliminate wrong answers

Option B is wrong because a distributed vulnerability scanning initiative would typically be coordinated and authorized, with consistent scanning patterns and proper logging, not originating from a single host with a disabled firewall and no alerts. Option C is wrong because a DDoS amplification attack would involve sending small queries to reflectors that then send large responses to a victim, not the host itself making single-packet connections to multiple destinations on port 445. Option D is wrong because legitimate scanning of the internet for outdated SMB shares would be authorized and would not occur from a web server with a disabled firewall and no antivirus alerts; such activity is almost always malicious.

Full explanation →

138

Multi-Selectmedium

Which TWO of the following are best practices when configuring a SIEM for security monitoring?

Select 2 answers

A.Tune rules to reduce false positives.

B.Disable logging for low-security systems.

C.Prioritize alerts based on risk.

D.Use the same log source for all event types.

E.Enable all default correlation rules.

AnswersA, C

Tuning improves alert accuracy and reduces noise.

Why this answer

Tuning SIEM rules to reduce false positives is a best practice because it improves the signal-to-noise ratio, ensuring that security analysts focus on genuine threats rather than being overwhelmed by irrelevant alerts. By adjusting thresholds, whitelisting known benign activity, or refining correlation logic, the SIEM becomes more efficient and reduces alert fatigue, which is critical for effective security monitoring.

Exam trap

Cisco often tests the misconception that more logging or more rules always equals better security, when in fact untuned defaults and excessive logging degrade monitoring effectiveness and increase operational burden.

Full explanation →

139

MCQhard

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following: - Allowed inbound HTTPS to 10.0.1.10 from various external IPs. - Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306. - Allowed outbound from 10.0.1.10 to external IPs on port 443. You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

A.Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.

B.Move the database server to the DMZ to avoid firewall restrictions.

C.Create a rule allowing all outbound traffic from the DMZ to the internal network.

D.Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.

AnswerD

This specifically allows the needed traffic while minimizing exposure.

Why this answer

The firewall logs show that outbound traffic from the web server (10.0.1.10) to the database server (10.0.2.10) on TCP 3306 is being denied, which causes the database errors. Since the web server initiates the connection to the database, a rule allowing this specific outbound traffic from the web server to the database server on port 3306 restores functionality while maintaining the default-deny posture. This is the most secure approach because it permits only the necessary traffic between the two specific hosts and port, without opening broader access.

Exam trap

Cisco often tests the misconception that you need an inbound rule for the database server when the traffic is actually initiated from the web server outbound, leading candidates to choose Option A or C.

How to eliminate wrong answers

Option A is wrong because allowing inbound traffic on TCP 3306 to the database server from any source would expose the database directly to the internet, bypassing the web server and creating a severe security risk. Option B is wrong because moving the database server to the DMZ would expose it to the same network segment as the web server and potentially the internet, increasing the attack surface and violating the principle of defense in depth. Option C is wrong because allowing all outbound traffic from the DMZ to the internal network would permit any DMZ host to reach any internal host on any port, which is overly permissive and could enable lateral movement by an attacker who compromises a DMZ device.

Full explanation →

140

Multi-Selecteasy

A security analyst is reviewing network logs and identifies several failed login attempts followed by a successful login from an unusual geographic location. Which TWO security concepts are most directly related to this scenario? (Choose two.)

Select 2 answers

A.Exploit

B.Non-repudiation

C.Threat

D.Risk

E.Vulnerability

AnswersA, C

The successful login from an unusual location suggests an exploit was successful.

Why this answer

The failed attempts indicate an active attempt to exploit a vulnerability (threat), and the unusual location suggests unauthorized access (exploitation).

Full explanation →

141

MCQeasy

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

A.All TCP traffic is blocked

B.Only outgoing BitTorrent traffic is blocked

C.Incoming BitTorrent traffic using ports 6881-6889 is blocked

D.All BitTorrent traffic is permitted

AnswerC

The ACL denies those ports inbound, blocking incoming BitTorrent connections.

Why this answer

The ACL shown in the exhibit (not provided here but implied by the question) is applied to the WAN interface and blocks incoming TCP traffic on ports 6881-6889. BitTorrent traffic typically uses these ports, so the ACL specifically denies incoming BitTorrent connections while leaving outgoing BitTorrent traffic unaffected. This is why option C is correct.

Exam trap

Cisco often tests the concept of ACL directionality, where candidates mistakenly think an inbound ACL on the WAN interface affects outgoing traffic, when in fact it only filters incoming traffic from the internet.

How to eliminate wrong answers

Option A is wrong because the ACL only blocks TCP traffic on ports 6881-6889, not all TCP traffic; other TCP ports are permitted. Option B is wrong because the ACL is applied to the WAN interface in the inbound direction, which filters traffic coming into the network from the WAN, not outgoing traffic; outgoing BitTorrent traffic is not blocked. Option D is wrong because the ACL explicitly denies BitTorrent traffic on ports 6881-6889, so it is not permitted.

Full explanation →

142

Multi-Selectmedium

A security engineer is implementing controls to meet compliance requirements. Which TWO of the following frameworks are specifically designed for protecting personal data?

Select 2 answers

A.HIPAA

B.NIST Cybersecurity Framework

C.GDPR

D.PCI DSS

E.ISO 27001

AnswersA, C

HIPAA protects health information.

Why this answer

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that mandates specific safeguards for protecting individually identifiable health information (PHI). It directly addresses the privacy and security of personal health data, making it a framework specifically designed for protecting personal data in the healthcare context.

Exam trap

Cisco often tests the distinction between frameworks that are specifically designed for personal data protection (like HIPAA and GDPR) versus general cybersecurity or information security frameworks (like NIST CSF, PCI DSS, and ISO 27001) that may include data protection but are not their primary purpose.

Full explanation →

143

MCQmedium

A security analyst is reviewing logs from multiple network devices and notices that a large number of ICMP echo requests with a payload size of 65507 bytes are being sent to a single server from various external IP addresses. The server is becoming unresponsive. Which type of attack is most likely occurring?

A.Ping of death

B.SYN flood

C.Smurf attack

D.ICMP flood

AnswerD

An ICMP flood sends a high volume of ICMP echo request packets to overwhelm the target's resources, matching the description of many large ping packets from multiple sources.

Why this answer

D is correct because an ICMP flood attack involves overwhelming a target with a high volume of ICMP echo request packets, consuming bandwidth and processing resources. The large payload size (65507 bytes) is a characteristic of a crafted ICMP packet, but the key indicator here is the sheer volume from multiple sources causing the server to become unresponsive, which aligns with a volumetric ICMP flood rather than a single malformed packet.

Exam trap

Cisco often tests the distinction between a Ping of Death (single malformed packet) and an ICMP flood (high volume of normal or large packets), where candidates mistakenly choose 'Ping of Death' because they see the large payload size, but the key is the volume and the fact that 65507 bytes is within the legal limit for a single packet.

How to eliminate wrong answers

Option A is wrong because a Ping of Death attack exploits a single malformed ICMP packet that exceeds the maximum IP packet size (65535 bytes), causing a buffer overflow; the question describes many packets with a payload of 65507 bytes (which is within the total IP packet limit when headers are included), not a single oversized packet. Option B is wrong because a SYN flood targets the TCP three-way handshake by sending numerous SYN packets without completing the handshake, exhausting the server's connection queue; ICMP echo requests are not part of TCP. Option C is wrong because a Smurf attack uses ICMP echo requests sent to a network's broadcast address with a spoofed source IP of the victim, causing all hosts on the network to reply to the victim; the question states the requests are sent directly to a single server from various external IPs, not to a broadcast address.

Full explanation →

144

MCQhard

A SOC team is implementing a security monitoring solution for a cloud-based infrastructure. Which of the following is the most important consideration for effective monitoring?

A.Centralized logging from all cloud services and on-premises.

B.Encrypting all logs at rest.

C.Reducing log retention to save cost.

D.Using only native cloud monitoring tools.

AnswerA

Centralized logging enables correlation and consistent analysis across the infrastructure.

Why this answer

Centralized logging is the most important consideration because it provides a single, unified view of security events across all cloud services and on-premises infrastructure. Without aggregation, the SOC cannot correlate events, detect distributed attacks, or perform effective threat hunting. This aligns with the principle of 'visibility first' in security monitoring.

Exam trap

Cisco often tests the misconception that encryption or cost-saving measures are the top priority in monitoring, when in fact the foundational requirement is complete visibility through centralized logging.

How to eliminate wrong answers

Option B is wrong because encrypting logs at rest protects confidentiality but does not address the core requirement of visibility and correlation; encryption is a secondary control, not the primary monitoring consideration. Option C is wrong because reducing log retention to save cost directly undermines forensic analysis and compliance requirements; logs must be retained long enough to support incident investigation and meet regulatory mandates. Option D is wrong because using only native cloud monitoring tools creates silos and blind spots; a hybrid environment requires a centralized solution that aggregates logs from multiple sources, including third-party and on-premises tools.

Full explanation →

145

MCQmedium

A security policy requires that all privileged access be logged and monitored. A junior admin uses a shared service account to perform maintenance. The logs show the account logged in from multiple IPs at the same time. What does this indicate?

A.There is a network issue causing duplicate logs.

B.The account is compromised.

C.The account is being used by multiple administrators simultaneously.

D.The account is being used by an automated script.

E.The logging system is malfunctioning.

AnswerC

Shared accounts lead to loss of accountability.

Why this answer

The scenario describes a shared service account being used by multiple administrators simultaneously, which is exactly what the logs indicate: the same account logged in from multiple IPs at the same time. This violates the security policy requiring privileged access to be logged and monitored because it breaks non-repudiation—you cannot determine which specific admin performed which action. The correct answer is C because it directly matches the observed behavior without introducing unnecessary assumptions.

Exam trap

Cisco often tests the distinction between 'compromised' and 'shared account misuse'—the trap here is that candidates jump to 'compromised' (Option B) because multiple IPs seem suspicious, but the question explicitly states a shared service account is in use, making simultaneous legitimate use the most logical conclusion without additional indicators of compromise.

How to eliminate wrong answers

Option A is wrong because duplicate logs would show identical timestamps and source IPs, not different IPs at the same time; network issues typically cause log duplication or loss, not simultaneous logins from distinct IPs. Option B is wrong because while a compromised account could show multiple IPs, the scenario explicitly states a junior admin uses a shared service account, making simultaneous legitimate use by multiple admins the more direct and likely explanation without evidence of malicious activity. Option D is wrong because an automated script would typically originate from a single IP or a predictable range, not multiple distinct IPs simultaneously, and scripts often use API keys or service principals rather than interactive logins.

Option E is wrong because a malfunctioning logging system would produce inconsistent timestamps, missing entries, or garbled data, not clean logs showing concurrent logins from different IPs.

Full explanation →

146

Multi-Selecthard

A security team is implementing a Public Key Infrastructure (PKI) to support digital signatures for email. Which THREE components are essential to the PKI framework? (Choose three.)

Select 3 answers

A.Registration Authority (RA)

B.Private key

C.Certificate Authority (CA)

D.Certificate Revocation List (CRL)

E.Digital certificates

AnswersA, C, E

The RA verifies identity before certificate issuance.

Why this answer

A PKI includes a Certificate Authority (CA) that issues certificates, certificates themselves that bind public keys to identities, and a registration authority (RA) that verifies identities. The private key is held by the user, not part of the PKI infrastructure. The CRL is a mechanism but not a core component.

Full explanation →

147

MCQmedium

Refer to the exhibit. An administrator configured AAA on a Cisco router. What is the expected outcome when a user tries to access privileged EXEC mode (enable) with the username 'admin' and password 'cisco123'?

A.The user is granted access to user EXEC mode only

B.The user is denied all access because no enable secret is set

C.The user is granted full privileged EXEC access

D.The user enters user EXEC mode but is denied enable access due to missing enable secret

AnswerD

Correct: local-case works for login, but enable authentication fails.

Why this answer

The configuration uses 'enable' authentication for enable mode, which means it uses the enable password (not set) or if not set, the local user database? Actually 'enable' method uses the enable secret/password. Since no enable secret is configured, authentication fails. However, the user must first log in to user EXEC mode.

For user EXEC, it uses local-case authentication, so 'admin' with password 'cisco123' works there. But for enable, it uses 'enable' method, which requires the enable password. Since no enable password is set, the user is denied enable access.

Option D is correct. Option A is wrong because user EXEC works. Option B is wrong because enable access fails.

Option C is wrong because the user cannot even enter enable mode.

Full explanation →

148

MCQmedium

An analyst examines a PCAP file and sees multiple packets with the same source IP, destination port 443, and a payload that starts with 'GET /login.php HTTP/1.1'. The packets occur in rapid succession with slight variations in the URL parameter. Which type of attack is most likely occurring?

A.SSL/TLS renegotiation attack

B.HTTP flood DDoS attack

C.DNS amplification

D.ARP poisoning

AnswerB

Rapid HTTP requests with variations are characteristic of HTTP flood.

Why this answer

The attack involves multiple packets with the same source IP, all targeting destination port 443 with HTTP GET requests to '/login.php'. The rapid succession and slight variations in URL parameters indicate an attempt to overwhelm the web server with legitimate-looking HTTP requests, which is characteristic of an HTTP flood DDoS attack. This attack exploits the application layer (Layer 7) by exhausting server resources through repeated HTTP requests, rather than exploiting SSL/TLS or network-layer vulnerabilities.

Exam trap

Cisco often tests the distinction between application-layer DDoS attacks (like HTTP floods) and protocol-specific attacks (like SSL/TLS renegotiation or DNS amplification), where candidates mistakenly associate any attack on port 443 with SSL/TLS issues rather than recognizing the HTTP payload as the key indicator.

How to eliminate wrong answers

Option A is wrong because an SSL/TLS renegotiation attack exploits the TLS renegotiation handshake to inject plaintext into an encrypted session, not by sending multiple HTTP GET requests with varying parameters. Option C is wrong because a DNS amplification attack uses small DNS queries with spoofed source IPs to generate large responses from open resolvers, targeting UDP port 53, not TCP port 443 with HTTP payloads. Option D is wrong because ARP poisoning involves sending forged ARP replies to associate the attacker's MAC address with a legitimate IP address on a local network, disrupting Layer 2 communication, not sending HTTP requests to a remote server.

Full explanation →

149

MCQmedium

An organization uses both network-based intrusion detection (NIDS) and host-based intrusion detection (HIDS). A HIDS alert reports that a critical server's registry key was modified. The NIDS shows no corresponding network activity. The change occurred during a scheduled maintenance window. What is the best course of action for the analyst?

A.Ignore the alert because it occurred during maintenance

B.Check the change management system to see if the modification was authorized

C.Escalate the alert as a potential security incident

D.Immediately revert the registry change

AnswerB

Scheduled maintenance windows often involve authorized changes; verifying with change management is the logical first step.

Why this answer

The registry modification occurred during a scheduled maintenance window, which is a legitimate time for authorized changes. The analyst should first verify the change management system to confirm whether the modification was planned and approved, as this aligns with standard change control processes. The absence of NIDS alerts further suggests the change was likely local and non-malicious, but confirmation via change management is essential before taking any action.

Exam trap

Cisco often tests the concept that maintenance windows do not automatically validate all changes; candidates must remember to verify against change management records rather than assuming safety or immediately escalating.

How to eliminate wrong answers

Option A is wrong because ignoring the alert solely because it occurred during maintenance is a dangerous assumption; maintenance windows can be exploited by attackers, and the alert must be verified against authorized changes. Option C is wrong because escalating immediately as a potential security incident without first checking the change management system could waste resources and cause unnecessary alarm, especially since the NIDS showed no corresponding network activity. Option D is wrong because immediately reverting the registry change could disrupt legitimate maintenance work and potentially cause system instability; the change should only be reverted after confirming it was unauthorized.

Full explanation →

150

MCQeasy

Which OSI layer is responsible for logical addressing and routing, and is commonly targeted by IP spoofing attacks?

A.Application layer

B.Network layer

C.Transport layer

D.Data Link layer

AnswerB

IP spoofing targets the Network layer.

Why this answer

The Network layer (Layer 3) handles logical addressing (IP addresses) and routing. IP spoofing involves falsifying the source IP address at this layer.

Full explanation →

Page 2 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice 200-201 by domain

Target a specific domain to shore up weak areas.

Security Policies and Procedures Security Monitoring Network Intrusion Analysis Host-Based Analysis Security Concepts

See all domains with question counts →