Courseiva

Cisco CyberOps Associate 200-201 (200-201) — Questions 301–375

979 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 14

Page 6
301
MCQmedium

During a security incident, an analyst needs to preserve network evidence for forensic analysis. Which action should be taken first?

A.Isolate the affected systems from the network.
B.Create a forensic image of all hard drives.
C.Shut down the affected systems to prevent further damage.
D.Capture the contents of volatile memory from affected systems.
AnswerD

Volatile data is lost when power is removed, so it must be captured first.

Why this answer

During a security incident, the first priority is to capture volatile memory (RAM) because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. Option D is correct because volatile data is ephemeral and must be collected before any action that could alter the system state, such as shutdown or isolation.

Exam trap

Cisco often tests the order of volatility (RFC 3227) and the misconception that isolating or shutting down the system is the safest first step, when in fact it destroys the most volatile evidence.

How to eliminate wrong answers

Option A is wrong because isolating the affected systems from the network may trigger network-level changes (e.g., ARP cache updates, connection teardowns) that alter volatile memory contents, and it does not preserve the current state of memory. Option B is wrong because creating a forensic image of hard drives is a non-volatile data acquisition step that should occur after volatile memory capture, as it does not preserve RAM contents and may be delayed without losing evidence. Option C is wrong because shutting down the system destroys all volatile memory data (e.g., running processes, open network sockets, encryption keys) and may also cause disk writes (e.g., pagefile updates) that overwrite evidence.

Full explanation →
302
MCQeasy

An organization wants to classify data based on its sensitivity and impact if disclosed. Which security principle is being applied?

A.Defense in depth
B.Confidentiality, integrity, and availability (CIA)
C.Least privilege
D.Data loss prevention
AnswerB

Data classification directly supports confidentiality and integrity by applying appropriate controls.

Why this answer

The organization's goal is to classify data based on sensitivity and impact if disclosed, which directly aligns with the confidentiality component of the CIA triad. Confidentiality ensures that sensitive information is accessed only by authorized individuals, and classification is the foundational step to enforce this principle. The CIA triad (Confidentiality, Integrity, Availability) is the core security model that governs how data is protected based on its value and risk.

Exam trap

Cisco often tests the distinction between a security principle (CIA) and a security mechanism (DLP, least privilege, defense in depth), leading candidates to confuse the 'what' (classification) with the 'how' (implementation).

How to eliminate wrong answers

Option A is wrong because defense in depth is a layered security strategy using multiple controls (e.g., firewalls, IDS, encryption) to protect assets, not a principle for classifying data by sensitivity. Option C is wrong because least privilege is an access control principle that grants only the minimum permissions needed to perform a task, which is applied after data classification, not the classification principle itself. Option D is wrong because data loss prevention (DLP) is a technology solution that monitors and prevents unauthorized data transfers, but it does not define how data should be classified based on sensitivity and impact.

Full explanation →
303
Multi-Selectmedium

Which TWO of the following are best practices for implementing a security policy?

Select 2 answers
A.Use technical jargon to ensure precision
B.Avoid enforcement to promote user compliance
C.Write the policy once and never change it
D.Review and update the policy annually
E.Obtain management approval and support
AnswersD, E

Periodic review keeps policy current.

Why this answer

Security policies must be living documents that adapt to evolving threats, regulatory changes (e.g., GDPR, PCI DSS), and organizational shifts. Annual reviews ensure the policy remains aligned with current risk posture and compliance requirements, as recommended by frameworks like NIST SP 800-53.

Exam trap

Cisco often tests the misconception that security policies are static, one-time documents, when in fact they require periodic review and management buy-in to remain effective and enforceable.

Full explanation →
304
MCQeasy

An analyst is monitoring network traffic and sees a large number of TCP SYN packets sent to various ports on a single host from the same source IP. Which type of attack is most likely occurring?

A.DNS amplification
B.ARP poisoning
C.Port scan
D.SYN flood
AnswerC

Port scan involves sending packets to many ports to discover open services.

Why this answer

A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

Exam trap

Cisco often tests the distinction between a port scan (reconnaissance, multiple ports) and a SYN flood (DoS, single port with high volume), so the trap here is confusing the reconnaissance technique of scanning many ports with the denial-of-service technique of overwhelming a single service.

How to eliminate wrong answers

Option A is wrong because DNS amplification uses spoofed source IPs to send small queries to open DNS resolvers, which then send large responses to the victim, not TCP SYN packets to various ports on a single host. Option B is wrong because ARP poisoning involves sending forged ARP replies to associate the attacker's MAC address with the IP of a legitimate host on a local network, not sending TCP SYN packets to multiple ports. Option D is wrong because a SYN flood targets a single port (or a few ports) with a high volume of SYN packets to exhaust the target's connection queue, not a large number of SYN packets sent to various ports as part of reconnaissance.

Full explanation →
305
Multi-Selecthard

A company is implementing a security policy to reduce risk. Which THREE activities are examples of risk mitigation? (Choose three.)

Select 3 answers
A.Implementing access controls
B.Accepting the risk without action
C.Encrypting sensitive data
D.Purchasing cyber insurance
E.Patching vulnerabilities
AnswersA, C, E

Access controls limit exposure, reducing risk.

Why this answer

Risk mitigation involves implementing controls to reduce risk: patching, access controls, and encryption.

Full explanation →
306
Multi-Selecthard

Which THREE components are part of a Public Key Infrastructure (PKI)? (Choose three.)

Select 3 answers
A.Registration Authority (RA)
B.Symmetric encryption key
C.Digital certificate
D.Hash function
E.Certificate Authority (CA)
AnswersA, C, E

The RA assists the CA by verifying certificate requestors' identities.

Why this answer

The Registration Authority (RA) is a key component of a PKI because it acts as the intermediary between the user and the Certificate Authority (CA). The RA is responsible for verifying the identity of an entity requesting a digital certificate before the CA issues the certificate, thereby offloading identity proofing tasks from the CA.

Exam trap

Cisco often tests the distinction between PKI components (CA, RA, digital certificate) and cryptographic primitives (hash functions, symmetric keys), so candidates mistakenly select hash functions or symmetric keys because they are associated with security, but they are not structural PKI components.

Full explanation →
307
MCQeasy

Which term describes a weakness in a system that could be exploited by a threat?

A.Vulnerability
B.Risk
C.Exploit
D.Threat
AnswerA

A vulnerability is a weakness that can be exploited.

Why this answer

A vulnerability is a weakness in a system, such as a missing security patch, misconfiguration, or design flaw, that a threat actor could exploit to compromise confidentiality, integrity, or availability. In the context of the 200-201 exam, this aligns with the core security concept that vulnerabilities are the specific gaps that make an asset susceptible to attack.

Exam trap

Cisco often tests the distinction between vulnerability and exploit by describing a scenario where a tool is used to break into a system, leading candidates to mistakenly select 'exploit' when the question asks for the weakness itself.

How to eliminate wrong answers

Option B (Risk) is wrong because risk is the potential for loss or damage when a threat exploits a vulnerability, not the weakness itself. Option C (Exploit) is wrong because an exploit is the actual code, technique, or tool used to take advantage of a vulnerability, not the weakness. Option D (Threat) is wrong because a threat is any potential danger (e.g., a hacker, malware, or natural disaster) that could cause harm, not the system weakness.

Full explanation →
308
MCQhard

An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?

A.Golden ticket
B.Pass-the-hash
C.Kerberoasting
D.Pass-the-ticket
AnswerB

Identical NTLM hash across multiple SMB sessions indicates pass-the-hash.

Why this answer

Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.

Full explanation →
309
MCQmedium

During incident response on a Linux server, an analyst runs 'ss -tlnp' and sees an SSH service listening on a non-standard high port. Which step should the analyst take next to investigate potential unauthorized access?

A.Review the bash history of root user.
B.Check /etc/crontab for malicious scheduled tasks.
C.Run 'ps aux' to list all processes.
D.Examine /var/log/auth.log for successful logins.
AnswerD

Auth.log contains SSH login records that can reveal unauthorized access.

Why this answer

Checking /var/log/auth.log for successful SSH logins on that port helps identify unauthorized connections.

Full explanation →
310
Multi-Selecthard

Which TWO of the following are characteristics of behavioral-based anomaly detection in network monitoring? (Select 2)

Select 2 answers
A.Establishes a baseline of normal traffic
B.Relies on predefined signatures
C.Can inspect encrypted traffic without decryption
D.Uses static rules written by administrators
E.Can detect zero-day attacks
AnswersA, E

Behavioral analysis uses baselines to find deviations.

Why this answer

Correct: A (establishes baseline) and E (detects zero-day attacks). Behavioral-based anomaly detection learns normal traffic patterns and flags deviations, making it effective against unknown attacks. B is incorrect because it describes signature-based detection.

C is incorrect because while behavioral detection can analyze encrypted traffic metadata without decryption, it is not a defining characteristic; the main focus is on baseline deviations. D is incorrect because static rules are characteristic of rule-based detection, not behavioral.

Full explanation →
311
MCQhard

A SOC team is evaluating a SIEM rule that triggers on 'more than 10 failed login attempts from a single source within 5 minutes.' The rule is generating too many alerts from a legitimate external monitoring service. How should the rule be modified?

A.Increase the threshold to 20 failed attempts.
B.Disable the rule and rely on other detection methods.
C.Add an exception for the source IP of the monitoring service.
D.Extend the time window to 10 minutes.
AnswerC

Exceptions effectively reduce false positives without changing rule logic.

Why this answer

The rule is generating false positives from a known, legitimate source. Adding an exception for the monitoring service's source IP allows the SIEM to continue detecting actual brute-force attacks while ignoring expected traffic from that specific host. This is a standard whitelisting technique in SIEM rule tuning to reduce noise without compromising security coverage.

Exam trap

Cisco often tests the concept that tuning a SIEM rule should preserve detection capability for actual threats, so candidates mistakenly choose threshold or time-window adjustments (A or D) instead of the more precise fix of adding an exception for the known benign source.

How to eliminate wrong answers

Option A is wrong because increasing the threshold to 20 failed attempts would still generate alerts from the monitoring service if it performs more than 20 attempts in 5 minutes, and it could also delay detection of a real brute-force attack that uses fewer than 20 attempts. Option B is wrong because disabling the rule entirely removes detection of brute-force attacks from all sources, creating a critical security gap that cannot be justified by a single false positive source. Option D is wrong because extending the time window to 10 minutes would still trigger on the monitoring service if it performs more than 10 failed attempts in that longer period, and it would also slow down detection of actual attacks by requiring a longer observation window.

Full explanation →
312
Multi-Selecthard

A SOC Tier 1 analyst is processing alerts. Which THREE tasks are typical for a Tier 1 analyst? (Select three.)

Select 3 answers
A.Conduct deep malware analysis
B.Develop new detection signatures
C.Execute basic investigation using standard tools
D.Monitor alerts and events
E.Perform initial triage and categorization
AnswersC, D, E

Tier 1 uses predefined playbooks.

Why this answer

Tier 1 tasks include alert monitoring, initial triage, and basic investigation.

Full explanation →
313
MCQmedium

A SIEM correlation rule is designed to detect a brute-force attack. The rule triggers when an event includes 10 or more failed logins from the same source IP within 1 minute. An analyst sees an alert for 12 failed logins from IP 10.0.0.1 in 2 minutes. Why did the rule not trigger?

A.The source IP is not in the watch list
B.The time window is too short; the rule requires 10 failures in 1 minute, but this occurred over 2 minutes
C.The rule only counts successful logins
D.The alert severity is too low
AnswerB

The rule defines a 1-minute window, so 12 failures in 2 minutes averages 6/min.

Why this answer

The rule requires 10+ failures in 1 minute. In 2 minutes, the rate is 6 per minute, which is below threshold.

Full explanation →
314
MCQhard

A Linux analyst notices a process named '[kworker/1:1+events]' in the process list with high CPU usage. Which further analysis step would help determine if this is a legitimate kernel worker or a rootkit hiding as one?

A.Check /proc/[pid]/cmdline; if empty, it is likely a kernel thread, otherwise it is a user-space process masquerading.
B.Run 'ls -la /proc/[pid]/exe' to see the symbolic link target.
C.Examine /var/log/syslog for kernel messages.
D.Use 'strace' to trace system calls of the process.
AnswerA

Kernel threads have no command line (empty), while user-space processes have their arguments stored.

Why this answer

Checking /proc/[pid]/cmdline for the process ID can reveal if it has a command line; legitimate kernel threads have empty cmdline, while user-space processes do not.

Full explanation →
315
MCQmedium

A network analyst notices that a host is sending a large volume of traffic to an external IP address on port 443 during non-business hours. The traffic volume is significantly higher than the established baseline. Which type of data exfiltration technique should be suspected?

A.HTTP post
B.HTTPS exfiltration
C.ICMP tunneling
D.DNS tunneling
AnswerB

HTTPS provides encryption, making detection harder, and large volumes are suspicious.

Why this answer

Port 443 is the default port for HTTPS (HTTP over TLS). The large volume of traffic during non-business hours, exceeding the baseline, strongly suggests the attacker is using encrypted HTTPS connections to hide data exfiltration. Unlike plaintext HTTP, HTTPS encryption makes it difficult for network monitoring tools to inspect the payload, allowing the attacker to blend malicious traffic with legitimate encrypted web traffic.

Exam trap

Cisco often tests the association of common protocols with their default ports; the trap here is that candidates might see 'large volume of traffic' and immediately think of HTTP post (option A) without noticing the port number 443, which clearly indicates encrypted HTTPS traffic.

How to eliminate wrong answers

Option A is wrong because HTTP post uses port 80, not port 443, and while it could be used for data exfiltration, the question specifies port 443 which is HTTPS. Option C is wrong because ICMP tunneling uses ICMP echo request/reply packets (typically on the network layer) and does not use TCP port 443; it would also likely show unusual ICMP traffic patterns, not high-volume TCP traffic on port 443. Option D is wrong because DNS tunneling uses UDP port 53 (or TCP port 53 for large queries) to encode data in DNS queries and responses, not TCP port 443.

Full explanation →
316
Multi-Selectmedium

A SOC analyst is investigating a potential malware outbreak. Which THREE actions should the analyst take to preserve evidence? (Select three.)

Select 3 answers
A.Calculate a hash of the original drive before imaging
B.Reboot the system to clear memory
C.Document the chain of custody
D.Use a write blocker to create a forensic image
E.Run a full antivirus scan to remove malware
AnswersA, C, D

Hashing verifies integrity after imaging.

Why this answer

Hashing before imaging, using write blockers, and maintaining chain of custody are key evidence preservation steps.

Full explanation →
317
MCQhard

During forensic analysis of a Windows host, an analyst finds a file in C:\Windows\Prefetch with the name 'MALWARE.EXE-3F2A1B0C.pf'. Which type of information can be extracted from this prefetch file to assist the investigation?

A.The number of times the executable has been run and the last execution timestamp
B.The file's SHA256 hash and digital signature status
C.The registry keys modified by the executable during execution
D.The command-line arguments used when the executable was launched
AnswerA

Correct. Prefetch tracks execution count and last run time.

Why this answer

Prefetch files (.pf) contain the last run time, run count, and paths of files loaded by the executable. This helps determine how many times the malware was executed and when.

Full explanation →
318
MCQmedium

A SOC analyst is reviewing alerts from a network-based intrusion detection system (NIDS). An alert indicates a potential SQL injection attempt, but the destination server is a web application that accepts SQL queries as part of its normal function. What should the analyst do?

A.Disable the alert to reduce noise.
B.Tune the NIDS signature to ignore that server.
C.Immediately block the source IP.
D.Correlate with web server logs to determine if the request was malicious.
AnswerD

Correlation provides context to differentiate between normal and malicious SQL queries.

Why this answer

The NIDS alert alone cannot confirm malicious intent when the destination server legitimately accepts SQL queries. Correlating with web server logs allows the analyst to examine the full HTTP request (e.g., parameters, payload, referrer) to distinguish between a benign feature usage and an actual SQL injection attack, such as detecting unexpected SQL keywords or syntax in input fields that should not contain them.

Exam trap

Cisco often tests the misconception that any NIDS alert indicating a known attack pattern must be acted upon immediately with a blocking action, without considering the application's normal behavior or the need for log correlation.

How to eliminate wrong answers

Option A is wrong because disabling the alert removes visibility into a potential threat and violates the principle of maintaining detection coverage; alerts should be tuned or suppressed, not disabled entirely. Option B is wrong because tuning the NIDS signature to ignore that server would create a blind spot for all future SQL-related traffic to that host, including genuine attacks, and does not address the need to investigate the current alert. Option C is wrong because immediately blocking the source IP is an overly aggressive response that could block legitimate users and disrupt business operations; the analyst must first verify malicious intent through log correlation.

Full explanation →
319
MCQmedium

A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?

A.The Snort rule is misconfigured and should be disabled
B.The rule is too broad and matches all DNS queries
C.The Snort signature is too generic and should be tuned
D.The threat intelligence feed contains a false positive for that domain
AnswerD

The domain is legitimate but was erroneously flagged by the threat feed, causing a false positive alert.

Why this answer

The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.

Exam trap

Cisco often tests the distinction between a false positive caused by a rule or signature issue versus a false positive caused by inaccurate threat intelligence, leading candidates to incorrectly blame the rule configuration or signature specificity.

How to eliminate wrong answers

Option A is wrong because disabling the rule would remove detection for legitimate threats; the rule itself is not misconfigured, as it correctly matches the feed. Option B is wrong because the rule is not too broad—it specifically matches DNS queries to domains in the threat intelligence feed, not all DNS queries. Option C is wrong because the Snort signature is not too generic; it is precisely targeting domains from the feed, and tuning the signature would not fix an incorrect feed entry.

Full explanation →
320
Multi-Selecthard

An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)

Select 2 answers
A.ROP gadgets
B.NOP sled
C.Heap spray
D.Shellcode
E.DNS tunnelling
AnswersA, D

ROP gadgets are small instruction sequences used to chain calls.

Why this answer

Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.

Full explanation →
321
Matchingmedium

Match each Windows event log type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Logs success/failure audit events

Logs operating system events

Logs events from applications

Logs installation events

Logs events forwarded from other computers

Why these pairings

In Windows Event Viewer, the main logs are Application (software events), Security (audit events), Setup (installation events), System (system component events), and Forwarded Events (remote logs). Common confusions include mixing Application and System logs, or Security with Setup.

Full explanation →
322
Multi-Selectmedium

A security analyst is configuring Snort IDS rules. Which TWO components are mandatory in a Snort rule header?

Select 2 answers
A.Message (msg) option
B.Action (e.g., alert, drop)
C.Signature ID (sid) option
D.Direction operator (e.g., ->, <>)
E.Protocol (e.g., tcp, udp, icmp)
AnswersB, D

The action (e.g., alert, drop) is a mandatory part of the rule header.

Why this answer

In a Snort rule header, the mandatory components are the action (e.g., alert, drop) and the direction operator (-> or <>). While protocol is also a required field, it is not considered a separate mandatory component in the context of this question; the action and direction operator are the two components that are always required in the rule header. Options like msg and sid are part of the rule body and are optional.

Exam trap

Cisco often tests the distinction between mandatory header components and optional rule body options. Candidates may mistakenly select 'msg' or 'sid' as mandatory because they appear frequently, but they are not part of the header. Additionally, candidates may think that protocol is one of the two mandatory components, but the correct pair is action and direction operator.

Full explanation →
323
Multi-Selecteasy

A security analyst is establishing a data classification policy. Which TWO categories are commonly included in a data classification policy?

Select 2 answers
A.Archived
B.Encrypted
C.Backup
D.Confidential
E.Public
AnswersD, E

Confidential data requires strict access controls.

Why this answer

Common categories include public, internal, confidential, and restricted.

Full explanation →
324
MCQeasy

A small retail company has a security policy that requires all point-of-sale (POS) systems to be isolated on a separate network segment with strict firewall rules. During a network audit, you discover that the POS system is connected to the same network as the office workstations, violating policy. The store manager says it was done for convenience because the network cable was too short. What is the best course of action?

A.Accept the risk because it's a small store.
B.Implement a software firewall on the POS system to compensate.
C.Purchase a longer cable and reconnect the POS to the correct segment.
D.Move the POS system to the correct network segment immediately and report the violation.
AnswerD

This restores compliance and ensures proper documentation.

Why this answer

Immediate remediation and reporting is required to address the security policy violation. Option A is incorrect because risk acceptance should be a formal process, not a casual decision based on convenience. Option B is incorrect because a software firewall does not provide the same level of isolation as a separate network segment and may not comply with policy.

Option C is incorrect because it only addresses the symptom (cable length) but does not address the violation; the POS system must be moved to the correct segment.

Full explanation →
325
MCQeasy

A security analyst observes repeated ICMP port unreachable responses from a target host. The source IP is sending packets to multiple UDP ports. Which type of scan is most likely being performed?

A.TCP SYN scan
B.UDP scan
C.TCP connect scan
D.Ping sweep
AnswerB

UDP scan sends UDP datagrams; closed ports respond with ICMP port unreachable.

Why this answer

UDP scans elicit ICMP port unreachable messages from closed ports; open ports typically do not respond.

Full explanation →
326
MCQeasy

An analyst is investigating a Windows system for signs of malware persistence. Which registry key is commonly used by malware to run automatically at user logon?

A.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
B.HKLM\SYSTEM\CurrentControlSet\Services
C.HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
D.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
AnswerA

This key contains programs that run automatically when the current user logs in.

Why this answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a common persistence location for user-level autoruns.

Full explanation →
327
MCQmedium

An organization is implementing a new remote access policy. Which of the following is a key component that should be included in this policy?

A.Prohibition of personal device usage for any work
B.Mandatory use of social media for communication
C.Requirements for multi-factor authentication
D.Daily password changes for remote users
AnswerC

MFA is a common security control for remote access.

Why this answer

Remote access policies typically specify allowed methods (e.g., VPN), authentication requirements, and security controls.

Full explanation →
328
MCQhard

An analyst is analyzing a suspicious PE file. The file's entropy is high (close to 8.0), and the section names appear random. What does this likely indicate?

A.The file is likely packed or encrypted.
B.The file is a script compiled to an executable.
C.The file is a legitimate Windows system file.
D.The file has been digitally signed.
AnswerA

High entropy is characteristic of packing or encryption.

Why this answer

High entropy suggests the file is packed or encrypted. Normal executables have lower entropy. Packed malware uses compression/encryption to obfuscate code.

Full explanation →
329
MCQhard

An analyst is examining a YARA rule that contains the condition: 'uint16(0) == 0x5a4d and filesize < 500KB'. What type of file is this rule targeting?

A.Windows executable files
B.PDF files
C.JPEG images
D.Linux ELF files
AnswerA

The MZ header is characteristic of PE executables.

Why this answer

0x5A4D is the MZ header for Windows executables (PE files). The rule looks for files starting with 'MZ' and less than 500KB, likely targeting small malware executables.

Full explanation →
330
Multi-Selectmedium

Which THREE of the following are best practices for implementing security logging and monitoring? (Select 3)

Select 3 answers
A.Define alert thresholds based on baselines
B.Synchronize device clocks using NTP
C.Minimize log retention to reduce storage costs
D.Centralize logs to a dedicated log server
E.Log only during incident response to reduce noise
AnswersA, B, D

Baselines reduce false positives.

Why this answer

Defining alert thresholds based on baselines is a best practice because it allows the security monitoring system to distinguish between normal and anomalous behavior. By establishing a baseline of typical network traffic, CPU usage, or login patterns, you can set thresholds that trigger alerts only when deviations occur, reducing false positives and ensuring that genuine security incidents are not missed.

Exam trap

Cisco often tests the misconception that logging should be minimized to reduce noise or storage costs, but the correct approach is to log continuously and use baselines and centralized aggregation to manage volume and relevance.

Full explanation →
331
MCQeasy

You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?

A.Block the external IP address on the firewall and continue monitoring.
B.Isolate the workstation by disconnecting it from the network immediately.
C.Run a full forensic analysis on the workstation without disconnecting it.
D.Update the antivirus signatures and run a full scan on the workstation.
AnswerB

Isolation stops C2 communication and preserves evidence.

Why this answer

The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.

Exam trap

Cisco often tests the principle that containment (isolation) must precede analysis or remediation when active C2 traffic is observed, and the trap here is that candidates may choose to block the IP or run a scan, mistakenly thinking those actions are sufficient to stop the threat without removing the host from the network.

How to eliminate wrong answers

Option A is wrong because simply blocking the external IP on the firewall does not remove the malware from the workstation; the malware could use a different IP or domain to continue its C2 communication, and the infected host remains a risk to the network. Option C is wrong because running a full forensic analysis without disconnecting the workstation allows the malware to continue its malicious activity (e.g., exfiltrating data, spreading laterally) during the analysis, which violates the containment-first principle of incident response. Option D is wrong because the antivirus is already up-to-date and shows no threats, indicating the malware is likely unknown or obfuscated; running another scan with the same signatures will not detect it, and the infection remains active on the network.

Full explanation →
332
Multi-Selecteasy

A Windows analyst uses Process Explorer to investigate parent-child relationships. Which TWO characteristics are commonly associated with malicious processes?

Select 2 answers
A.A parent process with a valid digital signature
B.A process running from a user's Temp folder with a random name
C.A process with a long uptime and low CPU usage
D.A process chain where the parent is svchost.exe and child is explorer.exe
E.A child process spawned by a document reader (e.g., winword.exe spawning cmd.exe)
AnswersB, E

Correct. Random names in Temp folders are often malicious.

Why this answer

Malware often spawns child processes from unusual parents (e.g., Microsoft Word spawning cmd.exe) and may have suspicious command-line arguments.

Full explanation →
333
MCQmedium

During an incident, an analyst captures network traffic. Which field in a TCP header is used to reassemble fragmented packets?

A.Flags
B.Window size
C.Acknowledgment number
D.Sequence number
AnswerD

Correct. The sequence number indicates the order of bytes for reassembly.

Why this answer

The Sequence Number field in the TCP header is used to reassemble the original data stream from received TCP segments. It indicates the byte offset of the segment's data within the overall stream, allowing the receiver to order segments correctly. Note that IP fragmentation (splitting packets at the network layer) relies on the Identification field and Fragment Offset in the IP header, not the TCP Sequence Number.

Exam trap

Cisco often tests the distinction between IP fragmentation (handled by the Identification field and fragment offset in the IP header) and TCP reassembly (handled by the Sequence Number), causing candidates to confuse the two layers.

How to eliminate wrong answers

Option A is wrong because the Flags field in the TCP header (e.g., SYN, ACK, FIN) controls connection state and segment behavior, not packet reassembly. Option B is wrong because the Window Size field indicates the amount of data the receiver is willing to accept for flow control, not for reassembly ordering. Option C is wrong because the Acknowledgment Number field confirms receipt of data up to a certain sequence number, but it does not provide the ordering information needed to reassemble fragmented packets.

Full explanation →
334
MCQmedium

While analyzing a PCAP file in Wireshark, an analyst sees multiple GET requests to /login.php with different usernames in the URL parameters, all from the same source IP: 192.168.1.100 to 10.0.0.1. The HTTP response codes are mostly 200 OK. This pattern suggests which attack?

A.SQL injection
B.Cross-site scripting (XSS)
C.Brute force attack
D.Directory traversal
AnswerC

Multiple login attempts from one IP with varying usernames is typical of credential brute forcing.

Why this answer

Repeated login attempts with different usernames from the same IP is typical of a brute force attack against the login page.

Full explanation →
335
MCQhard

During a forensic investigation, an analyst acquires a hard drive image using dd. What must be done to ensure the evidence is admissible in court?

A.Encrypt the image
B.Use a write blocker
C.Compress the image
D.Store the image in a shared folder
AnswerB

Write blockers prevent modification of the original evidence.

Why this answer

Using a write blocker ensures that the hard drive is not modified during acquisition, preserving the original data's integrity. This is critical for maintaining the chain of custody and demonstrating that the evidence has not been tampered with, which is a fundamental requirement for admissibility in court. The dd command itself does not prevent writes; a hardware or software write blocker must be used to guarantee read-only access.

Exam trap

Cisco often tests the distinction between integrity preservation (write blocker) and other security goals like confidentiality (encryption) or storage efficiency (compression), leading candidates to confuse admissibility requirements with general best practices.

How to eliminate wrong answers

Option A is wrong because encrypting the image protects confidentiality but does not preserve integrity or prevent modification during acquisition; it could even complicate verification of the original data. Option C is wrong because compressing the image reduces storage size but does not ensure the evidence was collected without alteration; compression may also introduce potential data integrity issues if not done correctly. Option D is wrong because storing the image in a shared folder increases the risk of unauthorized access or modification, which could break the chain of custody and make the evidence inadmissible.

Full explanation →
336
MCQhard

During a security assessment, a SOC analyst notices an IDS/IPS alert with a severity of 'High' for a signature named 'ET TROJAN Win32.Vobfus Checkin'. The alert shows source IP 10.0.0.5 and destination IP 203.0.113.50 on port 443. What is the most likely interpretation of this alert?

A.A compromised host attempting to communicate with a command-and-control server over encrypted traffic
B.A false positive due to a web browser accessing a secure site
C.An attacker scanning for open HTTPS ports on the internal network
D.A benign HTTPS connection to a legitimate website
AnswerA

The signature and destination IP suggest C2 communication over HTTPS.

Why this answer

The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

Exam trap

Cisco often tests the distinction between generic HTTPS traffic and signature-specific malware detection, trapping candidates who assume all encrypted traffic is benign or that high-severity alerts are automatically false positives.

How to eliminate wrong answers

Option B is wrong because a false positive from a web browser accessing a secure site would not match a specific trojan signature like 'ET TROJAN Win32.Vobfus Checkin'—that signature is tuned to detect malware-specific behaviors, not generic HTTPS traffic. Option C is wrong because an attacker scanning for open HTTPS ports would generate a different signature (e.g., port scan or brute-force attempt), not a trojan checkin signature that implies established C2 communication. Option D is wrong because a benign HTTPS connection to a legitimate website would not trigger a high-severity trojan signature; the IDS/IPS would only alert on such a signature if the traffic matches known malicious patterns (e.g., specific SNI, certificate fingerprints, or JA3 hashes) associated with Vobfus.

Full explanation →
337
MCQeasy

A security administrator needs to verify that a downloaded file has not been altered during transit. Which cryptographic technique should be used?

A.Public key encryption
B.Symmetric encryption
C.Hashing
D.Digital signature
AnswerC

Hashing ensures data integrity by comparing hash values.

Why this answer

Hashing produces a fixed-size hash that changes if the file is modified, allowing integrity verification.

Full explanation →
338
Multi-Selecteasy

Which TWO of the following are key components of a security policy? (Choose two.)

Select 2 answers
A.Incident response procedures
B.Policy statement
C.Enforcement and compliance guidelines
D.Password complexity requirements
E.Network topology diagrams
AnswersB, C

The policy statement defines the purpose and scope of the policy.

Why this answer

A security policy is a high-level document that defines an organization's overall security posture, objectives, and guiding principles. The policy statement (B) is the core component that articulates management's commitment and the policy's scope, while enforcement and compliance guidelines (C) specify how the policy will be implemented and what consequences exist for violations. These two elements are fundamental to any security policy framework.

Exam trap

Cisco often tests the distinction between a security policy (high-level, principle-based) and operational procedures or technical standards, causing candidates to mistake detailed implementation steps like incident response or password rules as policy components.

Full explanation →
339
MCQmedium

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

A.Rootkit
B.Worm
C.Trojan horse
D.Ransomware
AnswerD

Ransomware encrypts data and demands payment.

Why this answer

Ransomware is the correct answer because it is specifically designed to encrypt files on a victim's system using a symmetric or asymmetric encryption algorithm (e.g., AES-256, RSA-2048) and then demand a ransom payment, typically in cryptocurrency, in exchange for the decryption key. This type of malware directly targets data availability, a core component of the CIA triad, by rendering files inaccessible until the ransom is paid.

Exam trap

Cisco often tests the distinction between ransomware and Trojan horses, where candidates mistakenly choose Trojan horse because they associate it with malicious software that tricks users, but the key differentiator is that ransomware specifically encrypts files for extortion, whereas a Trojan horse may have various payloads like backdoors or keyloggers.

How to eliminate wrong answers

Option A is wrong because a rootkit is designed to hide the presence of other malware or processes by modifying the operating system kernel or system calls, not to encrypt files for ransom. Option B is wrong because a worm is a self-replicating malware that spreads across networks without user interaction, often consuming bandwidth or delivering payloads, but it does not inherently encrypt files for extortion. Option C is wrong because a Trojan horse disguises itself as legitimate software to trick users into installing it, but its primary purpose is to provide unauthorized remote access or steal data, not to encrypt files and demand payment.

Full explanation →
340
MCQmedium

An analyst is reviewing Windows Security Event Logs and finds Event ID 4648. What does this event indicate?

A.A logon attempt using explicit credentials was attempted.
B.A service was installed.
C.A user account was created.
D.A scheduled task was created.
AnswerA

4648 is explicit credentials logon.

Why this answer

Event ID 4648 indicates explicit credentials were used to log on, such as running a program as a different user or using secondary logon. It is distinct from interactive logon (4624) or failed logon (4625).

Full explanation →
341
MCQeasy

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

A.Manually check each file for suspicious extensions.
B.Remove the USB drive and use a different approved method of file transfer.
C.Disable write protection and rescan.
D.Proceed with the file transfer since the scan failed due to hardware issue.
AnswerB

This complies with policy by avoiding an unscanned medium.

Why this answer

The security policy mandates scanning all external media before use. Because the USB drive has hardware write-protect, the antivirus scan cannot complete. Therefore, the employee should not use this USB drive and should instead use an alternative approved method (e.g., network share, email, or cloud storage) to transfer the file.

This ensures compliance with the policy. Option A is incorrect because manually checking file extensions does not replace a proper malware scan. Option C is incorrect because disabling write protection may compromise security and the scan still might not be reliable.

Option D is incorrect because bypassing the scan violates the policy.

Full explanation →
342
MCQmedium

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

A.HR
B.Legal counsel
C.Incident handler
D.CISO
AnswerD

The CISO is accountable for security strategy and decisions affecting business impact.

Why this answer

The CISO is the decision-maker who evaluates business impact and approves major actions.

Full explanation →
343
MCQhard

A company implements a policy where users must authenticate with a password and a one-time code from a token. Which AAA component is strengthened by this policy?

A.Authentication
B.Accounting
C.Auditing
D.Authorization
AnswerA

Multi-factor authentication strengthens the authentication component of AAA.

Why this answer

Authentication is the AAA component that verifies the identity of a user. By requiring both a password (something you know) and a one-time code from a token (something you have), the policy implements multi-factor authentication (MFA), which directly strengthens the authentication process. This ensures that even if a password is compromised, an attacker cannot authenticate without the token.

Exam trap

Cisco often tests the distinction between authentication and authorization, where candidates mistakenly think that adding a token strengthens authorization (access control) rather than the identity verification step.

How to eliminate wrong answers

Option B (Accounting) is wrong because accounting tracks user activities and resource consumption (e.g., login/logout times, data transferred) for auditing or billing, not the verification of identity. Option C (Auditing) is wrong because auditing is a separate process of reviewing logs and records to detect security events or compliance violations, not a core AAA component that handles identity verification. Option D (Authorization) is wrong because authorization determines what resources or actions an authenticated user is permitted to access, not the method of proving identity.

Full explanation →
344
MCQeasy

Which of the following is an example of an Indicator of Compromise (IoC)?

A.A file hash (SHA-256)
B.A SIEM dashboard
C.A firewall rule
D.A network baseline
AnswerA

File hashes uniquely identify malware samples.

Why this answer

An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Exam trap

Cisco often tests the distinction between an IoC (a specific artifact like a hash, IP, or domain) and a security tool or process (like a SIEM, firewall rule, or baseline), so candidates mistakenly classify operational components as IoCs.

How to eliminate wrong answers

Option B is wrong because a SIEM dashboard is a visualization tool that aggregates and displays security events, not a specific artifact of compromise. Option C is wrong because a firewall rule is a policy definition for permitting or denying traffic, not an evidence of a past or ongoing intrusion. Option D is wrong because a network baseline is a reference of normal traffic patterns used for anomaly detection, not a direct indicator of a specific malicious event.

Full explanation →
345
Multi-Selecthard

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Select 3 answers
A./var/log/auth.log
B./etc/systemd/system/
C./etc/rc.local
D.~/.bash_history
E./etc/crontab
AnswersB, C, E

Systemd service unit files can enable services at boot.

Why this answer

Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Full explanation →
346
MCQhard

You are a security analyst at a multinational corporation. The company has implemented a security policy that requires all employees to use company-issued laptops with full disk encryption. During a routine audit, you discover that a senior executive's laptop is not encrypted. The executive claims that IT support had disabled encryption because the laptop was running slowly. The current policy does not allow exceptions without management approval. The executive's laptop contains sensitive client data. What should you do?

A.Report the violation to the security manager and advise that the laptop remain in use but monitored closely until encryption can be applied during next maintenance window.
B.Accept the executive's explanation and document it as an informal exception.
C.Escalate to the incident response team to treat this as a data breach because data may have been exposed.
D.Immediately re-enable encryption on the laptop and submit an exception request after the fact.
AnswerA

This ensures compliance while minimizing business disruption and follows proper escalation.

Why this answer

It follows the security policy by reporting the violation to the security manager and proposing a monitored approach until encryption can be applied during the next maintenance window, balancing security and operational continuity. Option B is insufficient as it creates an informal exception without proper authorization. Option C is an overreaction without evidence of data exposure.

Option D violates policy by taking unauthorized action.

Full explanation →
347
MCQhard

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

A.The process may be running obfuscated malicious code
B.The process is benign and the string is a normal parameter
C.The string is a hash for integrity verification
D.The process is using encryption
AnswerA

Attackers often use base64 to hide commands.

Why this answer

The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Exam trap

Cisco often tests the distinction between encoding and encryption, where candidates mistakenly think base64 is encryption or a hash, when it is actually a reversible encoding used for obfuscation.

How to eliminate wrong answers

Option B is wrong because a long base64-encoded string is not a normal parameter for legitimate processes; typical benign parameters are short, human-readable, and do not require encoding. Option C is wrong because a hash for integrity verification (e.g., SHA256, MD5) is a fixed-length hexadecimal string, not a variable-length base64-encoded string; base64 encoding is used for data, not hashes. Option D is wrong because encryption produces ciphertext that is not base64-encoded by default; base64 is an encoding scheme, not an encryption algorithm, and the string is obfuscated, not encrypted.

Full explanation →
348
MCQeasy

A security analyst discovers that an employee's computer is infected with malware that encrypts files and demands payment. What type of malware is this?

A.Spyware
B.Worm
C.Ransomware
D.Rootkit
AnswerC

Ransomware encrypts files and demands payment.

Why this answer

Ransomware encrypts files and demands a ransom for decryption.

Full explanation →
349
MCQeasy

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

A.A vulnerability is a potential danger; a threat is a weakness; risk is the impact.
B.A vulnerability is a potential attack; a threat is a weakness.
C.Risk is eliminated when a vulnerability is patched.
D.A threat exploits a vulnerability, resulting in risk.
AnswerD

Risk = likelihood of threat exploiting vulnerability * impact.

Why this answer

In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Exam trap

Cisco often tests the precise definitions of vulnerability, threat, and risk, and the trap here is confusing the terms (e.g., thinking a vulnerability is a threat or that risk disappears after patching) rather than recognizing the causal chain where a threat exploits a vulnerability to create risk.

How to eliminate wrong answers

Option A is wrong because it reverses the definitions: a vulnerability is a weakness (e.g., an open port or missing patch), not a potential danger; a threat is a potential danger (e.g., a hacker or malware), not a weakness; and risk is not simply the impact but the combination of likelihood and impact. Option B is wrong because a vulnerability is not a potential attack (an attack is an action), and a threat is not a weakness (a weakness is a vulnerability). Option C is wrong because patching a vulnerability reduces risk but does not eliminate it entirely; residual risk remains due to other vulnerabilities, threats, or incomplete coverage (e.g., a patched system may still be vulnerable to zero-day exploits or misconfigurations).

Full explanation →
350
MCQmedium

During a network intrusion investigation, an analyst notices repeated SMB authentication attempts from a single host to multiple other hosts using different usernames. Which type of activity does this pattern suggest?

A.Pass-the-hash attack
B.Lateral movement
C.SMB relay attack
D.Brute-force attack on SMB
AnswerB

Correct. Attempting to authenticate to multiple hosts indicates lateral movement.

Why this answer

Lateral movement via SMB involves authenticating to multiple hosts, often with different credentials, to move across the network.

Full explanation →
351
MCQhard

A security analyst is reviewing NetFlow records and notices a host sending data to an external IP at regular intervals during non-business hours. Which flow characteristic is most indicative of data exfiltration?

A.Random destination ports.
B.High number of small packets.
C.Low number of bytes per flow.
D.Constant bit rate and consistent packet size.
AnswerD

Data exfiltration tools often send data at a steady rate to avoid suspicion.

Why this answer

Data exfiltration often uses a steady, low-and-slow approach to evade detection. A constant bit rate and consistent packet size indicate a scripted, automated transfer, such as a beacon or a covert channel, which is highly suspicious during non-business hours. This pattern contrasts with legitimate traffic, which typically shows variable packet sizes and bursty behavior.

Exam trap

Cisco often tests the misconception that data exfiltration always involves large volumes of data or many small packets, when in fact the hallmark of stealthy exfiltration is consistency and regularity to blend in with normal traffic patterns.

How to eliminate wrong answers

Option A is wrong because random destination ports are more indicative of port scanning or malware trying to find an open service, not a sustained data transfer. Option B is wrong because a high number of small packets is characteristic of VoIP, DNS queries, or DDoS attacks, not the steady, consistent flow of exfiltrated data. Option C is wrong because a low number of bytes per flow suggests minimal data transfer, which is the opposite of what you would expect from a successful exfiltration of significant data.

Full explanation →
352
MCQmedium

A security analyst is examining web server logs and finds an entry with method 'POST', URL '/login.php', response code '200', and user-agent 'Mozilla/5.0'. The log shows 100 similar entries from the same IP within 5 seconds. What is the most likely activity?

A.A brute-force attack on the login form
B.A SQL injection attempt on the login page
C.A DDoS attack targeting the web server
D.A user repeatedly clicking the login button due to a slow connection
AnswerA

High frequency POSTs to login indicate brute-force.

Why this answer

Multiple POST requests to a login page from a single IP in a short time suggests a brute-force password guessing attack.

Full explanation →
353
Multi-Selecthard

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Select 3 answers
A.Frequent use of TXT record type in DNS queries
B.DNS response sizes larger than typical A record responses
C.DNS queries with TTL values greater than 86400
D.DNS queries for multiple well-known domains
E.High volume of DNS queries from a single host to a single domain
AnswersA, B, E

TXT records are commonly used to carry data in tunneling.

Why this answer

DNS tunneling often uses high query volumes, TXT records to encode data, and large response sizes.

Full explanation →
354
MCQhard

A security analyst is reviewing Snort IDS alerts and sees the following rule triggered: alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:'Possible SQL Injection'; content:'UNION'; nocase; sid:1000001;). Which action will Snort take when it detects matching traffic?

A.Generate an alert
B.Log the packet only
C.Drop the packet
D.Reject the connection
AnswerA

The 'alert' action generates an alert when the rule matches.

Why this answer

The rule uses the Snort 'alert' action, which instructs Snort to generate an alert when the traffic matches the specified conditions (TCP traffic from any port on the home network to port 80 on an external network, with the string 'UNION' present in the payload, case-insensitive). Snort's default behavior for an 'alert' action is to log the packet and generate an alert, but it does not drop or reject the traffic because Snort is an IDS (Intrusion Detection System) by default, not an IPS (Intrusion Prevention System).

Exam trap

Cisco often tests the distinction between Snort's 'alert' action (IDS behavior: alert and log) versus 'drop' or 'reject' actions (IPS behavior: block or reset), and candidates mistakenly assume any triggered rule will block traffic.

How to eliminate wrong answers

Option B is wrong because logging the packet only is the behavior of the 'log' action, not the 'alert' action; the 'alert' action generates an alert in addition to logging. Option C is wrong because dropping the packet requires an IPS mode or a 'drop' rule action (e.g., 'drop tcp ...'), and this rule uses 'alert', which does not drop traffic. Option D is wrong because rejecting the connection (sending a TCP RST) is done by the 'reject' action in Snort, not by the 'alert' action.

Full explanation →
355
MCQeasy

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

A.Enable port security on all switches.
B.Use VLAN segmentation.
C.Deploy a Wireless Intrusion Prevention System (WIPS).
D.Implement 802.1X authentication.
AnswerC

Designed to detect rogue APs and wireless threats.

Why this answer

A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Exam trap

Cisco often tests the distinction between wired security controls (port security, VLANs, 802.1X) and wireless-specific monitoring (WIPS), trapping candidates who assume that any network security measure can detect unauthorized wireless devices.

How to eliminate wrong answers

Option A is wrong because port security is a wired switch feature that limits the number of MAC addresses per port and does not monitor or detect wireless rogue access points. Option B is wrong because VLAN segmentation logically separates network traffic but provides no mechanism to discover or prevent unauthorized wireless devices from operating. Option D is wrong because 802.1X authentication controls network access for wired and wireless clients via RADIUS, but it does not actively scan for or block rogue access points that are not part of the authentication domain.

Full explanation →
356
Multi-Selecthard

During an incident, an analyst observes the following in PCAP: (1) DNS queries with random-looking subdomains to a known malicious domain, (2) large outbound FTP transfers of .zip files, (3) HTTP POST requests with Base64-encoded data in the body. Which THREE exfiltration techniques are being used? (Select 3)

Select 3 answers
A.ICMP exfiltration
B.FTP exfiltration
C.DNS tunneling
D.Steganography
E.HTTP exfiltration (POST)
AnswersB, C, E

Large FTP transfers.

Why this answer

DNS queries with encoded subdomains indicate DNS tunneling. FTP transfers indicate FTP exfiltration. HTTP POST with Base64 indicates HTTP exfiltration.

Full explanation →
357
MCQmedium

A security analyst observes a large number of SYN packets sent to various ports on a target host, receiving RST responses for closed ports and no response for open ports. Which phase of the Cyber Kill Chain does this activity represent?

A.Reconnaissance
B.Weaponisation
C.Exploitation
D.Delivery
AnswerA

Port scanning is a reconnaissance technique to identify vulnerabilities.

Why this answer

The observed behavior—sending a large number of SYN packets to various ports and analyzing RST responses (closed ports) versus no response (open ports)—is a classic port scan, specifically a SYN scan. This activity maps the target's attack surface by identifying live hosts and open ports, which aligns with the Reconnaissance phase of the Cyber Kill Chain, where the adversary gathers information to plan an attack.

Exam trap

Cisco often tests the distinction between Reconnaissance and Weaponisation, where candidates mistakenly think that sending crafted packets (SYN) is part of weaponisation, but weaponisation specifically involves creating the exploit or payload, not the scanning activity.

How to eliminate wrong answers

Option B (Weaponisation) is wrong because weaponisation involves coupling a payload with a delivery mechanism (e.g., creating a malicious document or exploit kit), not scanning for open ports. Option C (Exploitation) is wrong because exploitation requires actively leveraging a vulnerability to gain unauthorized access, whereas a SYN scan only identifies potential targets without attempting to compromise them. Option D (Delivery) is wrong because delivery refers to transmitting the weaponized payload to the target (e.g., via email or USB), not the pre-attack reconnaissance of scanning ports.

Full explanation →
358
MCQeasy

An analyst is monitoring network traffic and observes a large number of TCP SYN packets sent to a single host on various ports with no corresponding SYN-ACK replies. This behavior is most indicative of which type of attack?

A.ARP spoofing
B.DNS amplification attack
C.ICMP flood attack
D.SYN flood attack
AnswerD

The scenario matches a SYN flood: many SYN packets, no SYN-ACK replies, indicating resource exhaustion.

Why this answer

A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting resources. The lack of SYN-ACK replies indicates the target is overwhelmed.

Full explanation →
359
Multi-Selectmedium

Which TWO are common indicators of a phishing email? (Select two.)

Select 2 answers
A.Urgent call to action
B.Personal salutation
C.Generic greeting
D.Proper spelling and grammar
E.Matching sender domain
AnswersA, C

Phishing creates urgency to trick victims into acting quickly.

Why this answer

Phishing emails often create a false sense of urgency to pressure recipients into acting without verifying the source. An urgent call to action, such as 'Your account will be suspended in 24 hours,' is a classic social engineering tactic that exploits fear or time pressure to bypass rational scrutiny.

Exam trap

Cisco often tests the distinction between generic phishing (mass, untargeted) and spear phishing (targeted, personalized), so candidates mistakenly select 'Personal salutation' as a common indicator when it actually indicates a more advanced attack, not a typical phishing email.

Full explanation →
360
MCQeasy

In the NIST SP 800-61 Rev 2 incident response process, which phase involves activities such as performing lessons learned and updating the incident response plan?

A.Preparation
B.Containment, Eradication, and Recovery
C.Detection and Analysis
D.Post-Incident Activity
AnswerD

This phase includes lessons learned and updates.

Why this answer

Post-Incident Activity includes lessons learned, updating plans, and metrics.

Full explanation →
361
MCQmedium

Based on the exhibit, what is the most likely conclusion about the host's security state?

A.The svchost.exe process on UDP port 4444 indicates a Windows service that should be monitored.
B.The established TCP connection to 203.0.113.5 indicates data exfiltration to a known malicious IP.
C.The host is running a legitimate remote administration tool on port 4444.
D.The host has a backdoor listening on UDP port 4444, and the established connection suggests an active command session via cmd.exe.
AnswerD

The combination of UDP listener and cmd.exe connection to external IP is highly suspicious.

Why this answer

The exhibit shows svchost.exe listening on UDP port 4444, which is abnormal because svchost.exe typically hosts Windows services over TCP or named pipes, not raw UDP. Additionally, an established TCP connection to 203.0.113.5 with cmd.exe as the associated process indicates an active command shell session, which is a classic sign of a backdoor. Therefore, option D is correct.

Option A is incorrect because UDP port 4444 is not a standard Windows service port. Option B is incorrect because there is no direct evidence of data exfiltration; the connection is consistent with a remote shell. Option C is incorrect because legitimate remote admin tools do not typically use svchost.exe on UDP port 4444 with cmd.exe.

Exam trap

Cisco often tests the misconception that svchost.exe is always legitimate, but the trap here is that a UDP listener on port 4444 combined with an established cmd.exe connection is a definitive indicator of a backdoor, not a normal Windows service or remote admin tool.

How to eliminate wrong answers

Option A is wrong because svchost.exe does not natively listen on UDP port 4444; legitimate Windows services use well-known ports (e.g., 135, 445) over TCP, and a UDP listener on 4444 is anomalous and indicative of malware masquerading as a system process. Option B is wrong because while the TCP connection to 203.0.113.5 is suspicious, the exhibit does not provide evidence that this IP is known malicious or that data exfiltration is occurring; the primary indicator is the cmd.exe process tied to the connection, suggesting an interactive shell rather than bulk data transfer. Option C is wrong because legitimate remote administration tools (e.g., RDP on 3389, SSH on 22) do not use UDP port 4444, and svchost.exe is not a legitimate remote administration binary; the presence of cmd.exe on the established connection confirms an unauthorized command session.

Full explanation →
362
MCQmedium

A firewall log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443 with action 'deny'. What does this indicate?

A.The connection was successfully encrypted.
B.The firewall allowed the connection.
C.The external host attempted to access the internal host.
D.The internal host attempted to access a secure web server but was blocked.
AnswerD

Port 443 is HTTPS; the attempt was denied.

Why this answer

The log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443, with the action 'deny'. Port 443 is the default port for HTTPS (HTTP over TLS), which is used for secure web server access. The 'deny' action indicates the firewall blocked this outbound connection, meaning the internal host attempted to reach a secure web server but was prevented by the firewall policy.

Exam trap

Cisco often tests the distinction between source and destination IPs in firewall logs, where candidates mistakenly assume the external IP is the initiator (Option C) because they focus on the 'deny' action rather than the direction of the connection.

How to eliminate wrong answers

Option A is wrong because the connection was denied, so no encryption handshake (TLS) could occur; a successful encryption would require the firewall to allow the connection first. Option B is wrong because the action 'deny' explicitly means the firewall blocked the connection, not allowed it. Option C is wrong because the source IP is internal (192.168.1.100) and the destination is external (203.0.113.5), indicating the internal host initiated the connection to the external host, not the reverse.

Full explanation →
363
Multi-Selecthard

Which THREE factors should be considered when tuning an IPS signature? (Choose three.)

Select 3 answers
A.Time of day
B.Application protocol
C.Source and destination IPs
D.Signature severity
E.Packet length
AnswersB, C, D

Signatures should match the intended protocol to reduce false positives.

Why this answer

Application protocol (B) is critical because IPS signatures are protocol-aware and must match the specific protocol context (e.g., HTTP, SMTP, DNS) to avoid false positives. Tuning based on the protocol ensures the signature only inspects traffic where the vulnerability or exploit is relevant, such as applying a SQL injection signature only to HTTP traffic.

Exam trap

Cisco often tests the misconception that time-based or packet-length parameters are valid tuning options, when in fact IPS tuning focuses on protocol context, IP addresses, and severity to balance detection accuracy and performance.

Full explanation →
364
MCQhard

An analyst examines a PCAP file and sees a series of HTTP POST requests to an external server with Base64-encoded payloads in the request body. The payloads decode to small text strings. Which type of data exfiltration technique is being used?

A.Session hijacking
B.DNS exfiltration
C.HTTP data exfiltration
D.HTTP tunneling
AnswerC

Data hidden in HTTP POST requests is a typical exfiltration technique.

Why this answer

The analyst observes HTTP POST requests carrying Base64-encoded payloads in the request body that decode to small text strings. This is a classic indicator of HTTP data exfiltration, where sensitive data is encoded and sent over HTTP to an external server, bypassing security controls by blending with normal web traffic.

Exam trap

Cisco often tests the distinction between HTTP data exfiltration and HTTP tunneling, where the trap is that candidates confuse encapsulating another protocol (tunneling) with simply sending encoded data over HTTP (exfiltration).

How to eliminate wrong answers

Option A is wrong because session hijacking involves stealing a valid session token (e.g., via XSS or packet sniffing) to impersonate a user, not exfiltrating data via HTTP POST bodies. Option B is wrong because DNS exfiltration encodes data in DNS queries (e.g., subdomains or TXT records) and uses UDP port 53, not HTTP POST requests. Option D is wrong because HTTP tunneling encapsulates non-HTTP protocols (e.g., SSH, RDP) inside HTTP to bypass firewalls, whereas here the payloads are directly Base64-encoded text strings in the POST body, not a tunnel for another protocol.

Full explanation →
365
MCQeasy

Which security policy defines acceptable use of an organization's IT resources, including internet browsing and email?

A.Password Policy
B.Information Security Policy
C.Remote Access Policy
D.Acceptable Use Policy (AUP)
AnswerD

Correct: AUP sets rules for using IT resources.

Why this answer

AUP specifies what is acceptable and unacceptable use of IT resources.

Full explanation →
366
MCQeasy

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

A./etc/passwd
B./proc/net/tcp
C./var/log/auth.log
D./home/user/.bash_history
AnswerD

The .bash_history file stores the command history for that user.

Why this answer

Bash history is stored in ~/.bash_history for each user.

Full explanation →
367
MCQeasy

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

A.The user is 'jsmith'.
B.The parent process is explorer.exe.
C.The process path is in the Downloads folder.
D.The event type is 'Process Creation'.
AnswerC

Common location for malware delivered via email or web.

Why this answer

The process path in the Downloads folder is the most significant indicator because it suggests the executable was downloaded from the internet, a common vector for malware delivery. Attackers frequently use social engineering to trick users into saving malicious files to the Downloads folder, which then execute and initiate infection chains. In EDR analysis, execution from user-writable directories like Downloads is a high-fidelity alert, as legitimate software is rarely launched from this location.

Exam trap

Cisco often tests the distinction between benign system behavior (like explorer.exe as a parent process) and high-risk execution paths (like the Downloads folder), tricking candidates into focusing on the user or event type rather than the contextual risk of the file's origin.

How to eliminate wrong answers

Option A is wrong because the username 'jsmith' alone is not an indicator of compromise; it only identifies the user context and does not provide evidence of malicious activity. Option B is wrong because explorer.exe is a legitimate Windows shell process that commonly spawns child processes when users interact with the system, so it is not inherently suspicious. Option D is wrong because 'Process Creation' is a standard event type in Windows ETW and Sysmon logs; it is the specific attributes of the process (such as its path) that indicate potential malware, not the event type itself.

Full explanation →
368
MCQeasy

Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?

A.Yes, because it denies RDP and Telnet.
B.Yes, because it denies TCP ports 3389 and 23.
C.No, because it permits all other traffic.
D.No, because it should deny HTTP traffic as well.
AnswerA

The ACL denies both services required by policy.

Why this answer

The access-list explicitly denies TCP port 3389 (RDP) and TCP port 23 (Telnet), which matches the security policy requirement to block all remote desktop and Telnet access from external networks. The implicit deny at the end of the access-list ensures that any traffic not explicitly permitted is blocked, so the policy is fully enforced.

Exam trap

Cisco often tests the implicit deny any at the end of an ACL, tricking candidates into thinking that only explicitly denied traffic is blocked and all other traffic is permitted, when in fact the implicit deny blocks everything else.

How to eliminate wrong answers

Option B is wrong because it states 'Yes, because it denies TCP ports 3389 and 23' — this is technically accurate but does not match the answer choice; the correct answer is A, which is the same reasoning but phrased as 'denies RDP and Telnet.' Option C is wrong because it claims the access-list permits all other traffic, but standard ACLs have an implicit deny all at the end, so only the explicitly denied RDP and Telnet are blocked and all other traffic is implicitly denied, not permitted. Option D is wrong because the policy does not require blocking HTTP traffic; it only specifies RDP and Telnet, and the access-list correctly focuses on those protocols without needing to deny HTTP.

Full explanation →
369
Multi-Selecthard

Which THREE of the following are valid techniques to detect a compromised host using network monitoring?

Select 3 answers
A.Identifying periodic outbound connections to an unknown IP at regular intervals (beaconing).
B.Watching for ICMP echo requests from internal hosts to external hosts.
C.Observing DNS queries for domains that are known to be malicious from threat intelligence.
D.Detecting a host that is sending SMTP traffic to a server not authorized as a mail relay.
E.Monitoring for high volumes of HTTP traffic to a known CDN.
AnswersA, C, D

Beaconing is a common C2 technique.

Why this answer

Beaconing is a classic indicator of a compromised host establishing a command-and-control (C2) channel. The host periodically sends outbound connections to an unknown IP at regular intervals, which is a behavior that network monitoring tools can detect as anomalous traffic patterns, often used by malware to maintain persistence and receive instructions.

Exam trap

Cisco often tests the distinction between normal network behavior (like ICMP pings or CDN traffic) and actual malicious indicators, so candidates may mistake common but benign traffic for signs of compromise.

Full explanation →
370
MCQmedium

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

A.Disconnect the server from the network immediately to contain the threat.
B.Escalate the incident to Tier 3 for advanced malware analysis.
C.Perform initial triage and prioritize the incident based on severity and impact.
D.Notify legal counsel and PR to prepare for potential data breach.
AnswerC

Triage is the first step to assess the incident's scope and urgency.

Why this answer

According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Exam trap

Cisco often tests the misconception that immediate containment (disconnecting the network) is the first action, but NIST explicitly prioritizes triage and prioritization to avoid destroying evidence or overreacting.

How to eliminate wrong answers

Option A is wrong because disconnecting the server immediately may destroy volatile evidence (e.g., running processes, network connections) and could be premature without first assessing the incident's severity and impact. Option B is wrong because escalation to Tier 3 should occur only after initial triage confirms the need for advanced analysis; skipping triage risks misallocating expert resources. Option D is wrong because notifying legal and PR is a post-escalation step that occurs after the incident is confirmed and prioritized, not during initial detection.

Full explanation →
371
MCQmedium

A security analyst discovers that an employee has been sharing login credentials with coworkers. Which policy violation is this?

A.Remote Access Policy violation
B.Incident Response Policy violation
C.Data Classification Policy violation
D.Acceptable Use Policy violation
AnswerD

Sharing credentials is a misuse of company resources, violating the Acceptable Use Policy.

Why this answer

Sharing login credentials violates the Acceptable Use Policy (AUP), which defines how employees may use company systems and data. The AUP typically prohibits password sharing because it undermines non-repudiation and access control, as each user should have unique credentials for accountability. This is a direct breach of acceptable behavior, not a failure of remote access, incident response, or data classification procedures.

Exam trap

Cisco often tests the distinction between policies by making candidates confuse a data classification violation (handling sensitive data incorrectly) with an acceptable use violation (improper use of credentials or systems).

How to eliminate wrong answers

Option A is wrong because a Remote Access Policy governs how external connections (e.g., VPN, RDP) are established and secured, not the internal sharing of credentials among coworkers. Option B is wrong because an Incident Response Policy outlines the steps to detect, contain, and remediate security incidents, not the prohibition of password sharing. Option C is wrong because a Data Classification Policy defines how data is categorized (e.g., public, confidential) and handled based on sensitivity, but does not address user authentication practices like credential sharing.

Full explanation →
372
MCQhard

An analyst identifies a PCAP with a reverse shell session. Which characteristic in the traffic would most likely indicate an interactive shell session?

A.Large file transfers over FTP
B.Bidirectional traffic with small packets and command echo patterns
C.Periodic HTTP GET requests at regular intervals
D.Constant stream of UDP packets
AnswerB

Correct. Interactive shells show bidirectional small packets with commands and responses.

Why this answer

Reverse shells often exhibit bidirectional traffic with interactive patterns, such as small irregular packets and commands echoed.

Full explanation →
373
MCQmedium

An analyst receives an IDS alert with signature name 'ET TROJAN Win32.Zeus Checkin' and severity 'high'. The alert shows source IP 192.168.1.50 and destination IP 198.51.100.20 on port 443. Which action should the analyst take FIRST?

A.Isolate the source host from the network to prevent further communication.
B.Check the host's web browsing history for suspicious websites.
C.Immediately block the destination IP on the firewall.
D.Ignore the alert because the traffic is encrypted over port 443.
AnswerA

Isolating the host stops the malicious activity and prevents lateral movement.

Why this answer

The alert indicates a high-severity Zeus Trojan check-in, which is a known malware communicating with a command-and-control (C2) server. The first priority is to contain the threat by isolating the source host (192.168.1.50) to prevent further data exfiltration or lateral movement. Even though the traffic is encrypted over port 443 (HTTPS), the signature confirms malicious activity, so immediate isolation is the correct initial response per incident response best practices.

Exam trap

Cisco often tests the principle that containment (isolating the host) takes precedence over blocking external IPs or performing forensic analysis, and that encryption does not invalidate IDS alerts because signatures can detect malicious patterns in metadata or handshake characteristics.

How to eliminate wrong answers

Option B is wrong because checking web browsing history is a secondary forensic step that delays containment; the immediate priority is to stop active C2 communication. Option C is wrong because blocking the destination IP on the firewall may disrupt the C2 channel but does not prevent the compromised host from communicating with other C2 servers or spreading within the network; isolation of the host is more comprehensive. Option D is wrong because ignoring the alert due to encryption is a dangerous misconception—the IDS signature is based on behavioral or pattern analysis (e.g., JA3 fingerprint, packet timing) that can detect malware even over TLS; encryption does not make the alert invalid.

Full explanation →
374
MCQhard

During an incident response, the SOC needs to determine the scope of a compromise by identifying all hosts that communicated with a known malicious IP in the last 30 days. Which data source would best support this analysis?

A.SNMP traps from routers
B.Syslog from the DHCP server
C.Firewall deny logs
D.NetFlow records from the router
AnswerD

NetFlow captures all traffic flows, allowing historical analysis.

Why this answer

NetFlow records capture metadata about all IP traffic flows traversing a router, including source and destination IP addresses, ports, and timestamps. This allows the SOC to query for any host that communicated with the known malicious IP over the past 30 days, providing a complete picture of the compromise's scope. Unlike logs that only record denied traffic or administrative events, NetFlow records all successful communications, making it the ideal data source for this analysis.

Exam trap

Cisco often tests the distinction between logs that record only denied traffic (firewall deny logs) versus logs that record all traffic (NetFlow), leading candidates to mistakenly choose firewall deny logs because they associate firewalls with security monitoring.

How to eliminate wrong answers

Option A is wrong because SNMP traps from routers are used for network device monitoring and fault management (e.g., link up/down, CPU spikes), not for recording per-flow IP communication history with specific destinations. Option B is wrong because syslog from the DHCP server logs IP address lease assignments and client MAC addresses, but does not log the actual network traffic flows or communications between hosts and external IPs. Option C is wrong because firewall deny logs only record traffic that was blocked, not allowed traffic; since the malicious IP was likely contacted successfully, deny logs would miss the very communications needed to identify compromised hosts.

Full explanation →
375
MCQhard

Refer to the exhibit. A network administrator applied this ACL inbound on the external interface of a firewall. An attacker sends a TCP SYN packet with source IP 192.0.2.1 to destination 10.1.1.100 port 80. Which statement accurately describes the packet's treatment?

A.The packet is permitted because the ACL only denies non-TCP traffic
B.The packet is denied by the implicit deny at the end
C.The packet is denied because there is no permit for source 192.0.2.1
D.The packet is permitted by the first ACE
AnswerD

The first line matches TCP any to host 10.1.1.100 on port 80.

Why this answer

The ACL permits TCP traffic to destination 10.1.1.100 on port 80, so the TCP SYN packet matches the first ACE and is permitted. Therefore, Option D is correct. Option A is incorrect because the ACL does deny certain traffic (e.g., non-matching packets are subject to implicit deny).

Option B is incorrect because the packet matches an explicit permit before the implicit deny is reached. Option C is incorrect because the ACL does not require a source IP permit; the first ACE permits based on destination and protocol.

Full explanation →
Page 4

Page 5 of 14

Page 6

All pages

1234567891011121314

Practice 200-201 by domain

Target a specific domain to shore up weak areas.

Security Policies and ProceduresSecurity MonitoringNetwork Intrusion AnalysisHost-Based AnalysisSecurity Concepts
See all domains with question counts →