Cisco CyberOps Associate 200-201 (200-201) — Questions 151–225

Network segmentation divides a network into isolated zones and enforces traffic controls between them. By restricting traffic from the web tier to the database tier, the team limits lateral movement, so a compromised web server cannot freely reach the database. This directly matches the described control and its purpose.

Least privilege limits each identity to the minimum access needed for its task, reducing blast radius if credentials are compromised. Zero trust assumes breach, so scoping permissions tightly is a core principle alongside verify explicitly.

Per-user cron jobs are stored as individual files under /var/spool/cron/crontabs, so attackers can schedule recurring malicious execution without touching the shared /etc/crontab. This satisfies the persistence requirement because these entries survive reboots and re-launch the payload.

Least privilege grants each subject only the access required for its function. Restricting database reachability to one specific application server, and denying all other hosts, enforces exactly that minimal access, satisfying the segmentation constraint in the scenario.

Legal counsel interprets breach notification statutes and contractual obligations, advising when and to whom affected parties and regulators must be told. This satisfies the stem's data breach scenario, since notification deadlines and wording carry legal weight distinct from technical containment or forensic analysis.

Port 3389 is the registered TCP port for Remote Desktop Protocol, so a deny rule targeting it blocks RDP sessions. The stem's constraint — destination port 3389 — maps directly to RDP, Microsoft's protocol for remote graphical access to Windows hosts. No other listed service uses this port.

Process Explorer displays a live process tree, exposing parent-child relationships that reveal suspicious spawning, such as Office launching PowerShell. Its command-line column shows the exact arguments passed to each process, satisfying the investigation's requirement to inspect execution details on the suspect Windows host.

Mitigation reduces risk through controls.

Replacing the faulty hardware token and completing a correct re-synchronisation restores the second authentication factor the VPN policy demands, letting the employee authenticate again. Troubleshooting the existing unsynced token wastes time; issuing a fresh, properly synchronised token directly satisfies the mandated 2FA requirement.

Chain-of-custody documentation records every transfer, handler and storage condition of the seized media, proving the evidence was not altered or tampered with. Without this unbroken audit trail, courts may rule the malware artefacts inadmissible, regardless of how technically sound the forensic acquisition itself was.

HTTP dominates the NetFlow records, evidenced by the highest volume of flows to web service ports 80 and 443. This traffic profile identifies web browsing as the most prominent activity, satisfying the stem's requirement to name the leading protocol.

Detect is the NIST CSF Function that includes activities to identify the occurrence of a cybersecurity event, covering anomalies and events, continuous security monitoring, and detection processes. For the retailer's goal of improving event discovery, Detect is the correct focus because it addresses monitoring, analysis, and timely awareness. Investments in this Function, such as SIEM tuning and endpoint detection, directly strengthen the ability to notice malicious activity quickly.

The exact timing and same username point to a script; the lockout policy would lock the account after 3 attempts, but the script may be retrying from the same source, causing the SIEM alert before the lockout.

Cisco Secure Network Analytics, formerly Stealthwatch, consumes NetFlow and other flow telemetry to build network-wide visibility, then applies behavioural analytics and machine learning to flag anomalies such as unusual traffic patterns or potential exfiltration that signature-based tools would miss.

systemctl disable removes the service's symlinks from the systemd unit configuration, preventing it from starting automatically at boot while leaving the unit file intact. This directly addresses the autostart constraint, unlike stop, which only halts the running instance.

A 500 MB outbound FTP transfer at 2:00 AM, vastly exceeding the workstation's normal 10 MB daily volume, indicates bulk data leaving the network. This anomalous volume and timing point to data exfiltration rather than routine activity or a benign transfer.

Restricted data is usually subject to strict access controls, where only individuals with a specific need-to-know and proper approvals can access it. This minimizes the risk of insider threats and accidental exposure. Need-to-know access is a hallmark of handling requirements for the most sensitive data classifications.

ICMP tunneling hides data inside echo request and reply payloads, allowing covert communication through firewalls that permit ping. Non-default payload sizes and changing encoded bytes in replies are strong indicators that data is being exchanged, not just reachability tested. This matches the pattern of an ICMP-based covert channel.

A false positive is an alert that fires without any genuine malicious activity, exactly matching the scenario where triage confirms no attack occurred. The classification axis here is whether the detected event reflects real threat activity: benign or expected behaviour triggering detection logic is a false positive, distinct from a true positive.

Two simultaneous active VPN sessions from distant geographies within four minutes cannot be produced by one traveler with one device, since physical travel between those points is impossible in that interval. This pattern is a classic indicator of stolen credentials being used in parallel with the legitimate user. Treating the account as compromised and verifying with the user is the correct monitoring response.

A vulnerability is precisely a weakness or flaw in a system that an attacker could exploit to violate confidentiality, integrity or availability; this definition distinguishes it from a threat, which is the potential cause of harm.

Adjusting signature thresholds to reflect normal traffic baselines reduces alerts triggered by legitimate activity. This satisfies the false-positive constraint because thresholds set above routine peaks stop benign traffic from matching signatures while genuine anomalies still fire.

The Startup folder is a directory that contains shortcuts or executables that run automatically when a user logs in. Malware often places a copy of itself or a shortcut in this folder to achieve persistence. The scenario describes an executable named 'updater.exe' in the Startup folder, which is a classic persistence technique. Thus, the Startup folder is the correct answer.

Normalization standardizes log data.

Port 4444 with regular small payloads and jittered timing matches beaconing, where infected hosts poll a command-and-control server for instructions. The irregular intervals evade simple threshold detection, and the low data volume distinguishes it from bulk exfiltration or normal interactive traffic.

Ransomware encryption renders files unreadable, directly denying legitimate access to data and systems. Availability is the CIA element concerned with ensuring authorised users can access resources when required, so encryption that blocks access satisfies the stem's constraint of disrupted data access. Confidentiality and integrity remain intact; the data is neither exposed nor altered.

The Data Classification Policy mandates that every document carry a sensitivity label before distribution. Sending unlabelled employee PII company-wide breaches that requirement directly, since the spreadsheet lacked the classification the policy demands. This satisfies the stem's constraint that labels must be applied to all documents.

Signature-based detection compares observed traffic against a database of known attack patterns, such as Snort or Suricata rules, matching the stem's requirement for a common network intrusion analysis technique. It identifies previously catalogued exploits by byte or protocol pattern, complementing anomaly-based methods that flag deviations from normal behaviour.

FTP transfers of internal document names to an external IP indicate unauthorised data movement off the network. The high outbound volume, external destination and sensitive file naming together satisfy the exfiltration pattern rather than normal FTP use or scanning.

Cisco Talos Intelligence maintains a database of file hashes associated with malware. When a hash query returns a known malware detection name, it means the exact file has been previously identified as malicious. This is a strong indicator that the file is indeed malware, and the analyst should treat it as such, initiating incident response procedures.

Legal hold suspends normal retention and deletion schedules, preserving data that may be relevant to anticipated or active litigation. It satisfies the stem's requirement to prevent destruction of lawsuit-relevant data, unlike spoliation, which describes the improper loss itself. Microsoft Entra ID and Microsoft Purview apply holds to mailboxes, sites and identities.

Common C2 indicator.

A business-critical application that cannot function under a policy control justifies an exception because operational continuity outweighs the control's risk reduction. The exception is scoped to that application's specific technical incompatibility, not a blanket policy waiver, and should carry compensating controls, documented approval and a review date to limit exposure.

The NIST Cybersecurity Framework is structured around the five core functions: Identify, Protect, Detect, Respond, and Recover. No other framework in the stem's list uses this exact function set, so it directly matches the required structure.

Firewall logs capture allowed and denied connection attempts with source, destination and port details, satisfying the security-event source requirement. They reveal scanning, policy violations and lateral movement attempts, providing essential network telemetry for security monitoring and incident investigation.

Passive reconnaissance relies on publicly available sources without directly interacting with the target's systems, so no packets reach the organisation's infrastructure. LinkedIn and Google searches match this exactly, satisfying the stem's constraint of gathering employee and structural details covertly, leaving no trace in the target's logs.

Preparation is the first phase of the NIST incident response lifecycle. It encompasses establishing an incident response capability, developing plans, training personnel, and conducting exercises. In this scenario, the security manager wants to ensure the team practices and tests capabilities, which is exactly what happens during Preparation. This phase sets the foundation for effective incident handling.

A fixed 60-second interval, random-looking identifiers in the User-Agent and URI, and a large response body despite a 404 status are classic HTTP beaconing with covert channel encoding. Legitimate clients do not send random hex in these fields, and a true 404 would not carry kilobytes of meaningful content. The implant is polling for instructions and receiving tasking data disguised as an error page.

An SSDLC embeds security reviews, threat modelling and testing into every phase, so third-party search components are assessed before integration. This prevents vulnerable concatenated queries from reaching production, addressing the root cause rather than the single injection point.

Email filtering inspects incoming messages and blocks those containing known malicious attachments, URLs, or sender reputations. This directly reduces the volume of phishing emails reaching user inboxes, lowering the chance of a successful attack. It is a preventive control that operates before the user interacts with the message, making it a core component of anti-phishing defense in depth.

Detection and analysis is the phase where analysts validate whether an incident occurred, determine its scope, and identify affected systems and data. The analyst's goal of understanding which systems were compromised and what data was accessed aligns directly with this phase. This step precedes containment and eradication and is critical for making informed decisions about subsequent response actions.

A centralised collector buffers events in local storage and forwards them once the SIEM recovers, preventing loss during outages. Direct source-to-SIEM shipping would drop logs while the platform is unavailable, so the collector satisfies the no-loss constraint.

This directory contains per-package cron definitions.

Legitimate ARP is request-driven, so a flood of unsolicited ARP replies, especially gratuitous ones claiming an IP already in use, indicates an attacker updating victims' caches. This behavior is characteristic of ARP poisoning tools that continuously send forged replies. Detecting a high rate of unsolicited replies is a reliable network-level indicator.

The successful login is the pivot point: after repeated failures, it signals the attacker guessed valid credentials and gained access. Correlating it with the preceding failures and the following privilege escalation confirms a brute-force-to-compromise chain rather than isolated noise.

ICMP normally carries small, predictable payloads. Oversized echo requests with random data hide exfiltrated or tunnelled traffic inside a protocol firewalls often permit, letting the host bypass egress filtering while appearing as benign ping activity.

SSH encrypts the entire session, including authentication credentials and configuration commands, whereas Telnet transmits everything in cleartext. This satisfies the policy's mandate that administrative access to network devices be encrypted, protecting against credential interception and session eavesdropping on the management path.

The HIPAA Security Rule sets national standards for protecting electronic protected health information and is organized precisely around administrative, physical, and technical safeguards. It applies to covered entities such as hospitals and to their business associates. The rule requires risk analysis, access controls, audit controls, integrity controls, and transmission security, making it the direct match for the scenario's described obligations.

The signature correctly matched genuine XSS payload characters in the URI, and inspection confirms an actual attack attempt rather than benign traffic. A true positive means the IDS alerted on real malicious activity, satisfying the stem's requirement for accurate classification of the confirmed script injection.

A port scan sends TCP SYN packets to many ports on one host, seeking open services. The half-open SYN pattern, with no completed handshake, distinguishes scanning from a SYN flood, which targets a single port. This matches the stem's high-volume SYN traffic to various ports.

Syslog messages are a standard telemetry source, carrying device and application events into a Cisco security architecture for correlation. Firewall and IDS platforms emit syslog, making it a valid monitoring input alongside NetFlow and endpoint telemetry.

The log shows a denied TCP connection from an external IP (203.0.113.5) on port 443 to an internal IP (10.1.1.10) on port 3389. Port 3389 is used for RDP. The firewall denied the connection, indicating an attempt to access RDP from the outside was blocked. This is a common indicator of scanning or exploitation attempts.

DGAs produce many pseudo-random subdomains that malware queries until one resolves to a C2 server. The NXDOMAIN responses for most queries are expected because only a few generated domains are registered by the attacker. This pattern, with high volumes of random-looking names under one domain, is a classic DGA indicator in DNS logs.

An Acceptable Use Policy governs employee conduct on company systems, explicitly prohibiting installation of unauthorised software. The stem's clause requiring IT approval before installation is a use restriction, not a technical control, so the employee breached the AUP's behavioural mandate rather than any configuration-based safeguard.

Short-lived connections to TCP port 3389 across many internal hosts in rapid succession match a scan probing for reachable RDP services. Scanners often open and close sessions quickly to test responsiveness rather than complete authentication. The fan-out to multiple hosts from one external source reinforces scanning behavior, so this pattern indicates reconnaissance against RDP endpoints rather than any legitimate administrative session.

The CISO owns the risk decision, weighing containment's operational and financial consequences against continued exposure. Isolating a critical server can halt revenue-generating services, so authority rests with the executive accountable for business impact rather than the technical responders.

Event 4769 records Kerberos service ticket requests. A burst of requests for multiple service principal names using RC4, the weaker encryption type, from a single non-server host matches the Kerberoasting pattern, since the attacker requests tickets and cracks them offline. The volume, encryption downgrade, and unusual requesting host together distinguish this from normal service access.

Contain authentication and system events.

Because recursive resolver query logs are already forwarded to the SIEM, searching for the workstation's source IP paired with the suspicious domain directly confirms whether the host issued that lookup and when. This is the most direct and authoritative evidence of resolution attempts. It also establishes a timeline anchor that the analyst can use to pivot to proxy, firewall, and endpoint data for corroboration.

Risk is a function of likelihood and impact. The probability that a threat actor will exploit a weakness in the application or its cloud infrastructure directly contributes to the overall risk level. Without considering likelihood, the analyst cannot estimate how probable a loss event is. This factor is a core component of risk assessment in the Security Concepts domain.

Rootkits often manipulate the module's reference count (refcount) to prevent removal. They may increment it or hook the `delete_module` syscall to return an error. This makes the module appear 'in use' even when no legitimate process uses it. Thus, the rootkit maintains persistence by blocking `rmmod`. This is a common rootkit technique.

This file stores the XML definition of the scheduled task, including its creation time, author, and actions. It is the authoritative source for the task's configuration and metadata. Analyzing this file can reveal when and by whom the task was created, which is crucial for determining if it is malicious.

Pulling the network cable removed power-dependent state before capture, destroying running processes and memory-resident artefacts. The evidence preservation procedure requires collecting volatile data in order of volatility before any containment action. Isolating the host via network-level controls instead would have preserved that volatile evidence while still containing the compromise.

Confidential data is defined as information whose unauthorized disclosure could cause harm to the organization, such as competitive harm. Strategic pricing information fits this definition because its exposure could damage the company's market position. This classification aligns with the policy's description and ensures appropriate handling controls are applied.

The deny action combined with destination port 22 shows a connection attempt to the SSH service that the firewall rejected. The source host never established a session, so the entry records blocked traffic rather than a successful login.

In ARP poisoning, an attacker sends gratuitous ARP replies to associate their MAC address with multiple IP addresses, or to impersonate the gateway. Seeing a single MAC address claiming ownership of several IPs is a strong indicator. Legitimate hosts typically have one IP per MAC address (or a few in specific configurations), so this behavior is suspicious.

Image File Execution Options supports a Debugger value that Windows launches instead of the named executable. Attackers abuse this for persistence by pointing the debugger at malicious code, so the key's legitimate purpose is specifying a debugger for the image.

A single source sending hundreds of requests per second to many different URL paths with an identical User-Agent is characteristic of automated content discovery or directory brute-forcing tools. These tools enumerate paths to find hidden files or administrative interfaces. The high rate and fixed User-Agent distinguish it from normal user browsing or legitimate crawling.

DNS poisoning corrupts a resolver's cache with forged records, so subsequent queries return the attacker's IP address and redirect victims. This matches the stem exactly: fake entries inserted into the cache, sending users to a malicious site.

Hundreds of distinct destination addresses contacted in a very short window, each with minimal data transferred, is the classic NetFlow signature of a host sweep. Because the flows target port 443, the sweep is aimed at discovering reachable HTTPS services. NetFlow's IP, port, and byte-count fields are sufficient to identify this fan-out behavior without full packet capture.

A password is a knowledge factor: something the user knows. Multifactor authentication requires factors from different categories, so pairing it with a possession or inherence factor satisfies the two-factor requirement rather than duplicating the same category.

ldrmodules enumerates loaded modules via three linked lists (InLoad, InInit, InMem) and flags discrepancies, exposing injected DLLs unlinked from the loader's lists. This directly satisfies the scenario's requirement to detect code injection in the memory dump.

A digital certificate binds a public key to a verified identity by having a trusted certificate authority digitally sign the certificate, which contains the subject's public key and identifying details. This binding lets relying parties confirm the key genuinely belongs to the claimed entity, preventing impersonation and enabling trusted encryption and authentication.

SNMP traps are unsolicited notifications sent from agents to the manager, and they travel over UDP port 162. The manager listens on 162, while queries use UDP 161. This connectionless transport suits one-way alert delivery without acknowledgement overhead.