Cisco CyberOps Associate 200-201 (200-201) — Questions 376–450

Dynamic analysis involves executing malware in a controlled environment, such as a sandbox, and observing its behavior, including process creation, network traffic, and file system changes. The analyst's observations of mutex creation, outbound connections, and registry modification are classic dynamic indicators. This approach reveals runtime actions that static analysis might miss due to obfuscation or packing.

The signature indicates an active Zeus trojan check-in from internal host 192.168.1.50 to external infrastructure over port 443, confirming likely compromise and command-and-control beaconing. Isolating that host immediately halts exfiltration and lateral movement, the priority containment step before deeper forensic analysis.

NetFlow records capture IP-level flow metadata for every connection traversing the router, letting analysts query 30 days of historical traffic to enumerate all hosts that contacted the malicious IP. This directly satisfies the scope-identification requirement, unlike host-based logs limited to individual endpoints.

The malfind plugin scans process memory regions for injected code by looking for pages marked executable that lack a corresponding mapped file on disk, exposing code injection and hidden payloads. This directly satisfies the stem's requirement to detect hidden or injected code during memory analysis.

A SYN flood is a type of denial-of-service attack where the attacker sends many SYN packets with spoofed source IP addresses. The server allocates resources for each half-open connection, eventually exhausting its connection table and preventing legitimate users from connecting. The scenario matches this exactly: spoofed SYNs, full connection table, and denial of service.

DNS tunnelling encodes stolen data within subdomain labels of queries sent to an attacker-controlled authoritative nameserver. Zeek's `service` field identifying DNS, combined with an abnormally long, high-entropy subdomain, satisfies the exfiltration indicator: legitimate DNS labels are short and structured, whereas tunnelled payloads appear random to evade signature matching.

STIX provides the structured, machine-readable schema for describing indicators, threat actors and campaigns, while TAXII defines the transport protocol for exchanging that content between parties. Together they satisfy the requirement for standardised, automated threat-intelligence sharing.

Worms self-replicate and propagate across networks by exploiting vulnerabilities in services and protocols, requiring no user action such as opening attachments or clicking links. This autonomous spreading mechanism directly satisfies the stem's constraint of automatic network-wide distribution without interaction.

Chain of custody requires an unbroken record proving who held the evidence, when, and for what purpose. Documenting date, time, and handler creates this auditable trail, ensuring the drive's integrity can be attested in court and any tampering or gaps are detectable.

The ss command with -tlnp lists TCP sockets in listening state, numeric ports, and the owning process. It reads kernel socket tables directly, making it faster than netstat and satisfying the requirement to show listening TCP ports with associated processes.

Multifactor authentication satisfies the remote access policy by requiring a second verification factor beyond a password, defeating credential theft and replay attacks. Combined with conditional access in Microsoft Entra ID, it enforces sign-in risk evaluation, ensuring only verified identities reach corporate resources over untrusted networks.

The /proc/<PID>/exe symlink points to the actual executable file. For a legitimate kernel worker, this link is typically absent or points to nothing because kernel threads have no user-space executable. If it points to a file in /tmp or another suspicious location, it indicates a masquerading process. This is a quick and effective check.

A digital signature uses the sender's private key to sign a message hash, letting the recipient verify integrity via the public key and providing non-repudiation, since only the sender could have produced that signature. This satisfies both the tamper-detection and non-deniability requirements.

The one-hour reporting mandate applies from discovery, and uncertainty about classification does not justify delay. Reporting the suspicious activity immediately lets the security team triage whether it qualifies as an incident, satisfying the policy's timeframe while preserving evidence and enabling containment.

IKE phase 1 negotiates the ISAKMP security association: encryption and hashing algorithms, authentication method, Diffie-Hellman group and lifetime. Those parameters, shown in the exhibit, establish the secure management tunnel before phase 2 builds the IPsec data SAs.

NIST SP 800-61 Rev. 2 defines exactly these four phases in this order, beginning with preparation before an incident occurs, then detection and analysis, then containment, eradication, and recovery, and finally post-incident activity. Adopting this structure gives the SOC manager a recognized framework that auditors can map to, and it ensures lessons learned feed back into preparation for continuous improvement.

When a hostname resolves to an IP inconsistent with the DHCP lease and SMB traffic then reaches an attacker server, the name resolution itself has been manipulated. DNS spoofing or rogue responses inject false A records so clients connect to the attacker. This directly accounts for the mismatched resolution and the redirected SMB sessions, making it the best explanation for the observed behavior.

The query string passes 'cmd=id' to a PHP script, indicating the attacker is attempting to execute the shell command 'id' via an unsanitised parameter. A 200 response suggests the command injection succeeded, satisfying the log evidence for this attack type.

Extracting a PE executable from the PCAP shows the malicious file being transferred to the target host, which is the Delivery phase of the Cyber Kill Chain. Delivery covers transmission of the weaponised payload via email, web, or USB, satisfying the scenario's file-transfer constraint.

Modifying system files alters their contents without authorisation, violating integrity, which ensures data remains accurate and unaltered. Confidentiality concerns disclosure and availability concerns access, so integrity is the principle primarily breached by the attacker's file modifications.

An Acceptable Use Policy defines permitted employee use of company systems and networks, explicitly prohibiting access to inappropriate websites. It directly governs the behaviour described, making it the policy that addresses misuse of company resources for browsing inappropriate content.

Searching LinkedIn for employee information gathers publicly available data without directly touching the target's systems, so no traffic reaches company infrastructure. This indirect, non-intrusive collection is passive reconnaissance, unlike active scanning or enumeration, which would interact with and potentially alert the target.

Legal counsel advises on legal obligations to notify affected parties.

Windows writes a .pf Prefetch file into C:\Windows\Prefetch each time an executable launches, recording the binary name, run count and timestamps. Its presence therefore proves execution, unlike .lnk shortcuts or registry keys, which merely evidence access or configuration.

Contacting the bank immediately maximises the chance of recalling the wire before funds leave the recipient's account, directly addressing the $50,000 loss the incident response plan requires reporting to the board within 24 hours. Containment of financial impact takes precedence over notification, which follows once recovery is attempted.

The /var/spool/cron/crontabs/ directory holds per-user cron schedules on Linux, so any malicious job an attacker added for persistence appears here as a readable file. This directly satisfies the stem's requirement for evidence of attacker activity, revealing scheduled commands that re-establish access or execute payloads after reboot.

Correct. Shows command-line arguments for the process.

The first step in phishing response is to preserve the email as evidence and analyze its headers, URLs, and attachments to confirm malicious intent and identify indicators. This analysis informs subsequent actions such as blocking senders, quarantining similar emails, and notifying affected users. It aligns with standard incident response procedures that prioritize identification and containment planning.

A DDoS attack floods the web server with traffic from many compromised hosts, exhausting its resources so legitimate users cannot connect. This matches the scenario's constraint of multiple compromised systems overwhelming one target, distinguishing it from a single-source DoS attack.

When SQL injection is attempted, malformed queries can cause the database to return error messages. These errors, such as syntax errors or unclosed quotation marks, often appear in HTTP responses and reveal that the input affected the SQL query, confirming an injection attempt.

SSH authentication attempts may originate from sanctioned administrators, so the analyst must first establish whether the source addresses and accounts are authorised. Confirming legitimacy distinguishes routine remote administration from brute-force or intrusion activity before escalation or blocking.

Entropy near 7.8 approaches the theoretical maximum for byte data, indicating compressed or encrypted content rather than readable code. Packers and obfuscators compress or encrypt the payload, so high entropy in a PE file suggests packing.

The audit log, when auditd is configured, records detailed system call and command execution events, including the user ID (UID) and effective user ID (EUID) of the process that executed the command. This provides direct evidence of which user account was used to run the command, making it the most reliable source for this scenario.

With the alert confirmed as a false positive from an outdated signature, no genuine incident exists, so the analyst closes it and documents the finding. This preserves the audit trail and supports later tuning of the detection signature.

Integrity ensures that data is not modified by unauthorized parties. TLS uses message authentication codes and encryption to detect tampering, thereby preserving integrity of data in transit. The scenario explicitly states the requirement to prevent unauthorized alteration, which directly maps to the integrity principle of the CIA triad.

Regular, small, consistent beaconing to an external domain indicates an implanted host checking in with its controller. That recurring channel is the Command and Control phase, where the adversary maintains remote direction of compromised systems after exploitation.

Large, fixed-size ICMP payloads with repeating patterns and matching replies indicate data being encapsulated inside ICMP Echo packets. Normal ping payloads are small (often 32-64 bytes) and random. The consistent size and pattern suggest a covert channel using ICMP tunneling tools like ptunnel or icmpsh to exfiltrate or communicate stealthily.

Exploiting vulnerabilities lets the worm propagate autonomously across networks, satisfying the stem's requirement for self-replication without user interaction. Unlike viruses, which need a host file or user action to execute, worms spread directly between systems, making this a defining characteristic of worm behaviour during malware analysis.

IP addresses are network-layer artefacts recorded in firewall, IDS and proxy logs, letting analysts block or correlate malicious hosts. They satisfy the IoC requirement because they are observable, machine-readable evidence that a compromise may have occurred.

The sender signs with their private key, so verification requires the mathematically paired public key. This satisfies the authenticity and integrity constraint: only the matching public key validates the signature, confirming the update originated from the holder of the private key and was not altered.

Conducting lessons learned after every incident, even minor ones, helps uncover small gaps or weaknesses that could escalate into major incidents if left unaddressed. This proactive approach improves the overall security posture and prevents future incidents. It also fosters a culture of continuous improvement, where even small incidents are analyzed for root causes and corrective actions.

Account lockout counters track failures per account, so thousands of attempts against many distinct usernames never trip the five-attempt threshold. The alert aggregates by source IP, explaining the discrepancy between the SIEM count and the server's lockout behaviour.

Just-in-Time administration grants elevated rights only for a defined window, then revokes them automatically. This directly enforces least privilege by eliminating standing administrator access, so credentials are not permanently privileged. The temporary elevation satisfies the stem's requirement to minimise exposure whilst still permitting necessary administrative tasks.

RBAC enforces least privilege by assigning permissions to roles, not individuals, and users are granted only the roles needed for their job. This limits access to what is required to perform duties. It is a standard method to implement least privilege in applications. The financial application scenario fits RBAC because access can be tied to job functions like teller, auditor, or manager.

Security Event IDs 4656 and 4663 record handle requests and object access, and when they reference lsass.exe with rights such as PROCESS_VM_READ, they strongly suggest a tool attempted to read credential material from LSASS memory. This is a classic indicator of credential dumping activity on a Windows host.

Because many IDS engines and applications ignore or mishandle the URG flag and urgent pointer, attackers can abuse them as a side channel or to desynchronize inspection. Setting URG with a meaningless urgent pointer while still delivering normal data lets the attacker signal a cooperating peer or confuse the IDS without disrupting the actual TCP stream.

Large outbound transfers from one internal host to an external IP outside business hours, far exceeding baseline, match data exfiltration behaviour. NetFlow records volume and direction, not payload, so the anomaly itself signals possible data theft rather than scanning or denial of service, which produce different traffic patterns.

Systemd services can start automatically on boot.

Smishing uses SMS messages for deception.

A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed source addresses, so the target allocates resources for half-open connections and never receives the final ACK. The scenario describes exactly this: spoofed source IPs, SYN segments to many ports, and no completed handshakes, exhausting the target's connection table.

A SYN flood is a denial-of-service attack where the attacker sends many TCP SYN requests with spoofed source IPs, causing the target to allocate resources for half-open connections. The lack of ACKs and use of spoofed sources match this pattern. The goal is to exhaust the target's connection table, preventing legitimate connections.

Absent malware signatures, the irregular beaconing to a known malicious IP still indicates possible command-and-control or compromised credentials. Escalating to the incident response team brings deeper forensic analysis, such as traffic inspection and endpoint telemetry review, which signature scanning alone cannot provide.

A worm spreading internally replicates autonomously across hosts, so many internal IPs generate identical signature traffic toward the same external server. This satisfies the stem's pattern of multiple alerts for one signature from different internal sources, distinguishing worm propagation from a single compromised host or policy misconfiguration.

The file uses a .docx extension to appear harmless, but its magic number shows it is a Windows Portable Executable. This masquerading technique tricks users into opening what they believe is a document, potentially executing malicious code. The mismatch between the file extension and its actual header is a strong indicator of disguised malware delivered via email attachment.

Legitimate Windows services almost always execute from protected system locations such as C:\Windows\System32, not user-writable directories. C:\Users\Public is world-writable, allowing any local user to replace update.exe and gain persistence with SYSTEM privileges, since the service runs under a privileged account. This path anomaly satisfies the stem's suspicion constraint.

The maximum tolerable downtime (MTD) is the longest period that a system can be unavailable before unacceptable consequences occur. In this scenario, the company will lose a key customer if the system is down for more than 4 hours, so the MTD is 4 hours. This is the threshold beyond which the business impact becomes intolerable.

Event ID 4625 records a failed logon attempt. Many such entries originating from one IP address indicate repeated authentication failures, the signature of a brute-force password guessing attack, rather than a single mistyped password or a successful compromise.

Process Explorer displays a live process tree showing parent-child relationships, and its properties pane exposes full command-line arguments for each process. Task Manager and basic tasklist lack this combined hierarchical and command-line visibility, meeting the analyst's investigative requirement.

The signature name 'ET TROJAN Win.Trojan.Generic' explicitly categorises the traffic as trojan-related, so the alert indicates a host is infected with trojan malware. Snort matches packet patterns against this rule, and the ET prefix confirms it originates from the Emerging Threats ruleset, which targets known malicious trojan behaviour.

Policy mandates immediate reporting of any potential breach involving PHI, regardless of recipient trustworthiness or deletion. The analyst must not self-assess severity; the privacy officer determines notification obligations, so reporting preserves compliance and the audit trail.

Symmetric encryption satisfies the single-key constraint by using one shared secret for both encryption and decryption, as with AES. This contrasts with asymmetric algorithms such as RSA, which employ a public key to encrypt and a mathematically related private key to decrypt, requiring two distinct keys.

Thresholding failed SSH logins by source IP within a one-minute window captures the high-frequency, single-origin pattern characteristic of brute forcing, while the short window and IP grouping suppress unrelated sporadic failures. This matches the stem's SSH brute force scenario.

Attackers frequently abuse HTTP headers such as User-Agent and Cookie to blend C2 traffic with normal web activity. Random alphanumeric User-Agent values and base64-encoded Cookie data indicate obfuscated payloads, while small 200 OK responses represent tasking or acknowledgements. This pattern matches HTTP-based C2 with exfiltration embedded in request headers rather than the body.

Rate limiting caps requests per source within a time window, throttling the high-volume login attempts the stem describes. This directly addresses the brute force constraint by slowing credential guessing, making automated attacks impractical without blocking legitimate users.

Hashing the original drive before imaging creates a verifiable baseline; any later hash mismatch on the copy proves the data was altered. This satisfies the admissibility constraint by demonstrating the evidence remained unmodified from seizure through analysis.

Restricted is the highest sensitivity tier and is appropriate for regulated data such as payment card numbers, which PCI DSS requires to be encrypted and tightly access-controlled. Applying encryption, least-privilege access, and audit logging aligns with both the classification scheme and regulatory expectations. This combination protects the data and provides the accountability needed if a breach occurs.

NetFlow alone shows only metadata; correlating timestamps with DNS logs and endpoint telemetry reveals the process responsible and whether it resolves a suspicious domain. This combination is the most reliable way to confirm beaconing behavior and identify the malware family or C2 infrastructure.

The URI parameter `%27%20UNION%20SELECT%201,2,3%20--` is URL-encoded, where `%27` decodes to a single quote (`'`), `%20` to a space, and `--` to an SQL comment. This payload injects a single quote to break out of a string context, then appends a `UNION SELECT` statement to retrieve arbitrary data, with the comment `--` suppressing the remainder of the original query. This directly satisfies the constraint of manipulating SQL syntax via user-supplied input, confirming SQL injection.

A confirmed hash match establishes the file is malicious, so analysis shifts from identification to impact. Persistence mechanisms such as Run keys and scheduled tasks reveal how the malware survives reboots, satisfying the host-based scope by exposing the adversary's foothold.

A worm self-replicates and propagates across networks autonomously, exploiting vulnerabilities or weak credentials without requiring a user to open a file or click a link. This matches the stem's constraint of spreading without user intervention, unlike viruses, which need host execution.

Non-repudiation uses cryptographic evidence such as digital signatures and audit logs to prove an action originated from a specific party. It prevents that party from later denying having performed the action, which is precisely the guarantee the question describes.

ICMP tunneling for exfiltration often embeds encoded data in the payload, such as base64 strings, which are not present in normal ping requests. The varying length and non-standard content indicate that the ICMP echo requests are carrying hidden data rather than simply testing connectivity. This is a strong indicator of exfiltration or covert channel use.

The log matches UDP from inside to outside port 53.

Successful and failed logon events, including timestamps and account names, are recorded in the Security log, so it is the only log type that reveals whether an account was used to authenticate at an unusual time.