979 questions total · 14pages · All types, answers revealed
Which NIST Cybersecurity Framework function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?
Protect develops and implements safeguards to ensure service delivery.
Why this answer
The Protect function supports the ability to limit or contain the impact of a potential cybersecurity event.
A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?
Threat intelligence provides direct evidence of malicious intent.
Why this answer
A destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.
Exam trap
Cisco often tests the distinction between generic network behavior (like consistent packet sizes or common port usage) and specific indicators of compromise (like threat intelligence matches or periodic beaconing), trapping candidates who mistake normal traffic patterns for malicious activity.
An organization has implemented a security policy requiring all employees to change their passwords every 90 days. Which security goal does this policy primarily support?
Regular password changes help protect sensitive information from unauthorized access.
Why this answer
Requiring password changes every 90 days primarily supports confidentiality by reducing the window of opportunity for an attacker to use a compromised credential. If a password is stolen or guessed, the mandatory rotation ensures that the stolen credential becomes invalid after 90 days, limiting unauthorized access to sensitive data. This directly aligns with the confidentiality goal of preventing disclosure to unauthorized parties.
Exam trap
Cisco often tests the distinction between confidentiality and integrity by presenting password policies as a control for data modification, when in fact password rotation primarily limits the exposure of stolen credentials, directly supporting confidentiality.
How to eliminate wrong answers
Option A is wrong because accountability refers to the ability to trace actions to a specific user, typically through logging and auditing, not through password expiration policies. Option B is wrong because availability ensures that systems and data are accessible when needed, which is not directly enhanced by password rotation; in fact, frequent changes can sometimes hinder availability if users get locked out. Option D is wrong because integrity focuses on protecting data from unauthorized modification, whereas password rotation primarily protects against unauthorized access (confidentiality), not data tampering.
An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?
MitM attacks intercept and can modify communications between two parties.
Why this answer
Man-in-the-Middle (MitM) attack involves an attacker intercepting and potentially altering communication between two parties without their knowledge.
During an investigation, an analyst finds that an internal host has been communicating with a known malicious IP on port 445. Which protocol is most likely involved?
SMB uses port 445.
Why this answer
Port 445 is the default port for Microsoft SMB (Server Message Block) over TCP, used for file sharing, printer sharing, and other network services. Communication with a known malicious IP on this port strongly indicates SMB-based activity, such as exploitation of vulnerabilities like EternalBlue (MS17-010) or unauthorized file access.
Exam trap
Cisco often tests the association of well-known ports with their protocols, and the trap here is that candidates may confuse port 445 with HTTP (80) or RDP (3389) due to common attack narratives, but the specific port 445 uniquely identifies SMB.
How to eliminate wrong answers
Option A is wrong because SSH (Secure Shell) uses port 22, not 445, and is used for secure remote administration, not file sharing. Option B is wrong because RDP (Remote Desktop Protocol) uses port 3389, not 445, and is used for remote graphical desktop access. Option D is wrong because HTTP uses port 80 (or 443 for HTTPS), not 445, and is used for web traffic, not direct file sharing or SMB operations.
A system administrator needs to grant access to a database for a new employee. According to the principle of least privilege, what should be done?
This is correct. Granting only the minimum required permissions adheres to the principle of least privilege.
Why this answer
(Grant only the minimum required permissions) correctly follows the principle of least privilege, ensuring the employee has access only to what is necessary for their role. Option B (Grant temporary admin access) is excessive, as admin rights are not required for normal database access. Option C (Grant no access until manager approves) is too restrictive and does not directly apply least privilege.
Option D (Grant full access and remove later) violates least privilege by providing more access than needed initially.
A company's endpoint detection and response (EDR) agent is reporting a file that was created with a name matching a known ransomware pattern. The analyst suspects the file is malicious. What is the best first step to contain the threat?
Isolation prevents lateral movement and C2 communication.
Why this answer
Isolating the host from the network is the best first step because it immediately stops the ransomware from communicating with its command-and-control (C2) server and prevents lateral movement to other systems. The EDR agent has already flagged the file as suspicious, so the priority is containment, not further analysis or deletion, which could trigger the ransomware to encrypt data. Network isolation breaks the attack chain at the host level, buying time for forensic analysis and remediation.
Exam trap
Cisco often tests the principle of 'containment before eradication' — the trap here is that candidates choose to delete the file or run a scan, thinking that removing the artifact stops the threat, but they overlook that the ransomware may already be executing in memory or have established persistence.
How to eliminate wrong answers
Option A is wrong because creating a new firewall rule is a network-level control that takes time to implement and may not block all outbound traffic from the already-compromised host, especially if the ransomware uses dynamic ports or encrypted tunnels. Option C is wrong because running a full antivirus scan is a detection and remediation step that occurs after containment; the file is already suspected malicious, and scanning could trigger the ransomware to execute and encrypt files. Option D is wrong because deleting the file without first isolating the host may not stop the ransomware if it is already running in memory, and it could also trigger a failsafe mechanism that encrypts data immediately.
A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?
The number of failed attempts may be below the threshold.
Why this answer
A SIEM correlation rule for brute-force attacks typically triggers when the number of failed login attempts from a single source exceeds a defined threshold within a specific time window. If the threshold is set too high, the rule will not fire even though failed logins are occurring, because the count never reaches the required value. This is the most direct and common cause for a correlation rule not triggering when expected.
Exam trap
Cisco often tests the concept that a correlation rule's threshold is a direct control over its sensitivity, and candidates may mistakenly attribute the issue to data ingestion problems (like dropped logs or misconfigured time zones) rather than the rule's own configuration.
How to eliminate wrong answers
Option A is wrong because while a SIEM can drop events when overwhelmed, this would typically cause incomplete or missing data, not a consistent failure of a specific correlation rule to trigger; the rule would still fire if the threshold were met in the logs that are processed. Option C is wrong because a time zone misconfiguration would cause timestamps to be offset, potentially affecting time-window calculations, but it would not prevent the rule from triggering entirely if the raw count of failed logins still exceeds the threshold within the adjusted window. Option D is wrong because if the log source were not sending syslog data, the SIEM would not receive any failed login events at all, and the question explicitly states that failed logins are occurring, meaning the logs are being received.
Your organization recently deployed a new web application that uses HTTPS. The security team notices that the IDS is generating a large number of alerts for 'SSL/TLS handshake anomalies' and 'self-signed certificates'. After investigating, you find that many of these alerts are coming from a legitimate internal scanning tool that uses a self-signed certificate. The IDS also reports a high rate of 'TLS renegotiation' attempts from the same source. The CISO wants to reduce false positives while maintaining visibility. The IDS is based on Suricata and uses a default rule set. What is the best course of action?
This precisely reduces false positives from a known source while keeping detection for others.
Why this answer
Creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.
Exam trap
Cisco often tests the distinction between a targeted exclusion (like a pass rule for a specific IP) and a broad configuration change (like disabling rules or whitelisting entire categories), where candidates mistakenly choose the latter because they think it is simpler, not realizing it sacrifices security visibility.
How to eliminate wrong answers
Option B is wrong because whitelisting any traffic from hosts using self-signed certificates would broadly disable alerts for all self-signed certificate traffic, including potential malicious activity, thereby creating a significant security blind spot. Option C is wrong because disabling the Suricata rules for self-signed certificates and TLS renegotiation would globally remove detection for these events across all traffic, not just the scanning tool, which undermines the CISO's requirement to maintain visibility. Option D is wrong because removing the scanning tool is an unnecessary operational change; the tool is legitimate and can be safely excluded via a targeted pass rule, preserving both security and functionality.
A security policy requires that all remote access be authenticated using a one-time password (OTP) token. Which technology should be implemented?
RADIUS can authenticate users against an OTP token server, meeting the requirement.
Match each network device to its primary function.
Drag a concept onto its matching description — or click a concept then click the description.
Filters traffic based on security rules
Detects suspicious activity and alerts
Detects and blocks malicious traffic inline
Forwards packets between networks
Forwards frames within a LAN
Based on the exhibit, what condition triggers an alert?
This matches typical DNS anomaly detection for excessive queries.
Why this answer
The exhibit shows a rule configured to trigger an alert when the number of DNS queries from a single source IP exceeds 1000 within a 60-second sliding window. This is a rate-based threshold designed to detect DNS amplification or tunneling attacks, where a single host generates an abnormally high volume of DNS requests. Option A correctly describes this condition.
Exam trap
Cisco often tests the distinction between a rate-based threshold (counting events over time) and a signature-based match (single event), leading candidates to confuse a single malicious query with a volumetric anomaly.
How to eliminate wrong answers
Option B is wrong because a single DNS query to a known malicious domain would typically be detected by a signature-based or threat-intelligence rule, not by a rate-based threshold as shown in the exhibit. Option C is wrong because the rule specifically counts DNS queries (typically UDP packets to port 53), not all UDP traffic to port 53; the threshold is based on queries, not raw packets, and the exhibit shows a query count, not a packet-per-second rate. Option D is wrong because the rule counts DNS queries, not UDP connections; DNS queries are typically stateless UDP datagrams, not connections, and the exhibit does not reference connection tracking or a 60-second window for connections.
Which element of the CIA triad is primarily compromised when an attacker successfully intercepts and reads encrypted network traffic without authorization?
Confidentiality prevents unauthorized disclosure; reading encrypted traffic without authorization breaches this.
Why this answer
Confidentiality ensures that data is not disclosed to unauthorized entities. Intercepting and reading traffic violates this principle.
A critical security patch for a widely exploited vulnerability is released. The patch requires a system reboot during business hours. According to change management policy, what is the best procedure?
Emergency change processes are designed for critical security updates.
Why this answer
When a critical security patch addresses a widely exploited vulnerability, the immediate risk to the organization outweighs standard change windows. Change management policy typically includes an emergency change process that bypasses normal scheduling to allow rapid deployment with expedited approval, even if a reboot during business hours is required. This aligns with the principle of prioritizing security over availability in high-severity scenarios.
Exam trap
Cisco often tests the misconception that change management always requires waiting for a scheduled window, but the trap here is that emergency change processes exist specifically to handle critical security patches that cannot wait.
How to eliminate wrong answers
Option A is wrong because delaying deployment until the end of the business day leaves the system exposed to active exploitation for several hours, which is unacceptable for a widely exploited vulnerability. Option B is wrong because waiting for the next scheduled change window could mean days or weeks of exposure, violating the urgency required for critical patches. Option D is wrong because installing the patch without any approval bypasses change management controls entirely, risking unauthorized changes that could lead to compliance violations or operational disruptions.
During a security monitoring exercise, an analyst observes a series of NetFlow records showing a single internal host communicating with multiple external IP addresses on port 445 (SMB) within a short time window. The traffic volumes are small but consistent. Which THREE of the following should the analyst consider as possible explanations? (Choose three.)
Worms that spread via SMB often contact many external IPs to find vulnerable targets.
Why this answer
SMB port 445 is a common vector for worm-like malware such as EternalBlue (MS17-010), which spreads by sending crafted SMB packets to random external IPs. The small, consistent traffic volumes and multiple external destinations match the behavior of a host scanning or propagating to new targets rather than normal file transfers.
Exam trap
Cisco often tests the distinction between normal SMB file sharing (which involves larger, sustained transfers to known hosts) and the pattern of small, consistent flows to many random IPs, which indicates scanning or propagation activity.
A large enterprise has a security policy that mandates data classification and strict access controls. An IT administrator, John, has been granted temporary administrative privileges to resolve a server issue. During the maintenance window, John accesses a file server and downloads a spreadsheet containing customer PII (Personally Identifiable Information) classified as 'Confidential'. John then emails the spreadsheet to his personal email account to work from home. The security team receives an alert from the DLP system indicating the email transmission. According to the company's incident response policy, which of the following is the FIRST action the security team should take?
This aligns with standard incident response procedures: first preserve evidence, then initiate the formal process.
Why this answer
The correct first action is to preserve evidence, isolate affected systems, and initiate the incident response process. This aligns with NIST SP 800-61 and ISO 27035, which mandate that containment and evidence preservation precede any investigative or disciplinary steps. Jumping to revocation or interviews risks spoliation of logs, email metadata, and forensic artifacts critical to determining the scope of the data exfiltration.
Exam trap
Cisco often tests the distinction between reactive containment (e.g., blocking/revoking) and the mandated first step of evidence preservation and incident initiation, causing candidates to confuse operational urgency with proper forensic procedure.
How to eliminate wrong answers
Option A is wrong because blocking the email and restoring from backup is a containment step that should occur only after evidence is preserved and the incident response plan is formally activated; premature blocking may destroy forensic data (e.g., email headers, DLP logs). Option B is wrong because revoking network access and escalating to HR before evidence preservation violates the incident response chain of custody and could alert the insider, leading to data destruction or tampering. Option C is wrong because interviewing John before preserving evidence risks contaminating the investigation and is not the first action per standard incident response frameworks; intent is determined after forensic analysis.
An analyst is investigating a potential data exfiltration. The logs show a series of DNS queries with subdomains that appear to be base64-encoded strings. Which technique is likely being used?
DNS tunneling encapsulates data in DNS queries to exfiltrate information.
Why this answer
DNS tunneling encodes data (e.g., exfiltrated files) into subdomains of DNS queries, which are then sent to a malicious authoritative DNS server controlled by the attacker. The base64-encoded subdomains in the logs are a classic indicator of this technique, as the attacker uses the DNS protocol to bypass network security controls and covertly transmit data.
Exam trap
Cisco often tests the distinction between DNS tunneling (data exfiltration via subdomain encoding) and DNS amplification (a volumetric DDoS attack), so candidates must recognize that base64-encoded subdomains point to tunneling, not amplification.
How to eliminate wrong answers
Option B is wrong because DNS amplification is a reflection-based DDoS attack that uses open resolvers to flood a victim with large DNS responses, not a data exfiltration technique. Option C is wrong because fast flux uses rapid changes in DNS A records to hide the IP addresses of malicious servers, not to encode data in subdomains. Option D is wrong because a domain generation algorithm (DGA) is used to periodically generate random domain names for command-and-control communication, not to encode exfiltrated data in subdomain labels.
An analyst runs Volatility's pstree plugin on a memory dump. The output shows that a process 'svchost.exe' is the child of 'explorer.exe'. What is suspicious about this?
svchost.exe is a service host process; its parent should be services.exe.
Why this answer
In a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.
Exam trap
Cisco often tests the misconception that svchost.exe can be a child of any process because it is a common system process, but the trap is that candidates forget the strict parent-child relationship enforced by the Service Control Manager in Windows.
How to eliminate wrong answers
Option A is wrong because explorer.exe can and does have legitimate child processes, such as when a user launches an application from the Start menu or desktop; the statement that it should have no child processes is false. Option B is wrong because svchost.exe should never be a child of any arbitrary process; it must be a direct child of services.exe to be legitimate, as the SCM is the only authorized parent for service host processes. Option D is wrong because the pstree plugin from Volatility is a reliable tool for reconstructing process parent-child relationships from memory dumps; its output is trustworthy when the memory image is intact and properly analyzed.
A company's incident response policy defines four phases: Preparation, Detection & Analysis, Containment Eradication & Recovery, and Post-Incident Activity. During an active ransomware outbreak, the IR team is unable to contain the spread because the containment plan did not account for the malware's use of PowerShell for lateral movement. Which phase had a deficiency?
Preparation must anticipate attack vectors.
Why this answer
The deficiency lies in the Preparation phase. The incident response policy's Preparation phase should include threat modeling, playbooks, and planning for common attacker TTPs, such as PowerShell-based lateral movement. Since the containment plan did not account for this specific technique, the preparation was inadequate.
Options A, D, and E represent later phases that depend on effective preparation; they are not the source of the deficiency.
A security analyst is reviewing IDS alerts and notices multiple TCP resets sent from an internal host with IP 10.10.10.25 to various external IPs on port 443. The alerts indicate that these resets occur immediately after the corresponding SYN-ACK from the external server, before any data exchange. The analyst suspects a TCP reset attack. Which action is most likely occurring?
This is a classic TCP reset attack where the attacker spoofs the client's IP to terminate a connection.
Why this answer
The described behavior—TCP RST packets sent immediately after the SYN-ACK, before any data exchange, from an internal host to multiple external IPs on port 443—is characteristic of a TCP reset attack. In this attack, an adversary spoofs the source IP of the legitimate client (10.10.10.25) and sends forged RST segments to the external servers, causing them to abort the TCP handshake prematurely. This prevents the completion of the three-way handshake and disrupts the connection before any application data can be exchanged.
Exam trap
Cisco often tests the distinction between a legitimate RST (sent by a host to abort a connection due to an error or policy) and a spoofed RST (sent by an attacker to disrupt a connection), and the trap here is that candidates may assume the RST is from a firewall or a normal closure without considering the timing and source IP spoofing.
How to eliminate wrong answers
Option A is wrong because a firewall sending RST packets to block outbound traffic would typically do so in response to a policy violation, not immediately after every SYN-ACK from external servers, and the RST would originate from the firewall's IP, not from the internal host's IP. Option B is wrong because a client properly closing a session after receiving data would send a FIN packet, not a RST, and the RSTs here occur before any data exchange, which is not a normal closure. Option C is wrong because retransmitting lost TCP segments involves sending data packets (with sequence numbers), not RST packets; RST is used to abort a connection, not to retransmit data.
A financial institution is evaluating risk treatment options for a newly identified vulnerability in its online banking platform. The vulnerability has a high likelihood of exploitation but low business impact. Which risk treatment option is most appropriate?
Mitigation through controls reduces the risk to an acceptable level.
Why this answer
Mitigate is appropriate when risk is high likelihood but low impact; controls can reduce likelihood further.
A SOC analyst sees an alert for 'Possible SQL Injection' on a web server. Reviewing the PCAP, the analyst finds the parameter 'id=1 OR 1=1' in the HTTP request. However, the web server returns a normal page with no signs of compromise. What is the correct classification?
The alert triggered but no real attack took place.
Why this answer
The alert fired on a pattern that resembles SQL injection, but the server was not vulnerable or the input was sanitized; thus no actual attack occurred.
A security analyst is reviewing the company's incident response plan. The plan states that 'all incidents must be contained within 30 minutes.' During a recent ransomware incident, the analyst identified the affected systems but could not contain them because the containment procedures required manual steps that took over an hour. What is the most likely gap in the plan?
The manual procedures are too slow to meet the 30-minute goal; automation or simpler steps are needed.
Why this answer
The plan's requirement to contain incidents within 30 minutes is unachievable because the containment procedures rely solely on manual steps that take over an hour. The most likely gap is the absence of automated containment options, such as pre-configured firewall ACLs, host-based IPS policies, or SOAR playbooks that can isolate affected systems in seconds. Without automation, the response time objective (RTO) for containment is fundamentally mismatched with the procedural capability.
Exam trap
Cisco often tests the distinction between a plan's stated objective and the operational capability to achieve it, trapping candidates who blame the analyst's performance or the threat's complexity instead of recognizing the missing automation in the procedures.
How to eliminate wrong answers
Option A is wrong because the sophistication of the ransomware is irrelevant to the plan's procedural gap; the issue is that the plan lacks automated containment mechanisms, not that the malware was too advanced to contain. Option C is wrong because the analyst correctly identified the affected systems, indicating adequate training; the failure was in the plan's reliance on slow manual steps, not in the analyst's skill. Option D is wrong because authorization is not the bottleneck—the analyst had the authority to execute the manual steps, but those steps themselves were too slow to meet the 30-minute containment window.
An analyst is reviewing DNS logs and sees a high volume of NXDOMAIN responses for a specific domain. Which TWO scenarios could this indicate?
Attackers send queries that return large responses, causing NXDOMAIN.
Which cryptographic technique uses a public and private key pair to provide non-repudiation?
Digital signatures provide non-repudiation by using the signer's private key.
Why this answer
Digital signatures use asymmetric cryptography to provide authentication and non-repudiation, as only the signer's private key can create the signature.
Which THREE are principles of the CIA triad? (Select three.)
Confidentiality is a core principle of the CIA triad.
Why this answer
The CIA triad is the foundational security model consisting of Confidentiality, Integrity, and Availability. Option B (Confidentiality) is correct because it ensures that data is accessible only to authorized users, typically enforced through encryption (e.g., AES-256) and access control lists (ACLs).
Exam trap
Cisco often tests the distinction between the CIA triad and other security principles like non-repudiation or accountability, leading candidates to mistakenly include them as part of the triad when they are separate concepts.
An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?
MitM attacks intercept and can modify communications.
Why this answer
A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.
Exam trap
Cisco often tests the distinction between the attack type (MITM) and the technique used to achieve it (ARP spoofing), causing candidates to confuse the method with the overarching attack category.
How to eliminate wrong answers
Option B (DNS poisoning) is wrong because it involves corrupting a DNS resolver's cache to redirect traffic to a malicious site, not intercepting and modifying an existing communication stream. Option C (Replay attack) is wrong because it captures valid data and retransmits it later, but does not involve modifying the data before forwarding. Option D (ARP spoofing) is wrong because it is a specific technique used to facilitate MITM attacks by linking the attacker's MAC address to a legitimate IP address, but it is not the attack itself—it is a method to achieve a MITM position.
A forensic analyst uses Volatility on a memory dump and runs the 'malfind' plugin. The output shows a process with a VAD region that has PAGE_EXECUTE_READWRITE protection and contains the pattern 'MZ'. What does this indicate?
Malfind detects injected code by finding executable regions with PE headers.
Why this answer
PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.
A security analyst needs to ensure data integrity. Which control best achieves this?
Hashing produces a unique hash that changes if data is altered, ensuring integrity.
Why this answer
Hashing is the correct control for ensuring data integrity because it produces a fixed-length digest (e.g., SHA-256) from the original data. Any change to the data, even a single bit, results in a completely different hash value, allowing the analyst to detect tampering or corruption. Unlike encryption, hashing is a one-way function that does not conceal the data but verifies its unchanged state.
Exam trap
Cisco often tests the distinction between confidentiality (encryption) and integrity (hashing), so the trap here is that candidates confuse encryption's ability to hide data with the ability to detect tampering, leading them to select encryption instead of hashing.
How to eliminate wrong answers
Option A is wrong because logging records events and provides an audit trail, but it does not verify that the data itself has not been altered. Option B is wrong because encryption protects confidentiality by transforming data into ciphertext, but it does not detect changes to the plaintext; a modified ciphertext may still decrypt to a different plaintext without alerting the analyst. Option C is wrong because access control restricts who can read or write data, but it does not provide a mechanism to verify that the data has remained unchanged after authorized access.
According to the principles of least privilege, which THREE of the following access controls should be implemented for a typical user account? (Choose three.)
Users need to manage their own passwords.
Why this answer
The principle of least privilege dictates that users should have only the permissions necessary to perform their job functions. Allowing a user to change their own password is a standard self-service capability that does not grant elevated privileges, as it only affects their own account and is typically enforced through password policy controls like minimum length and complexity.
Exam trap
Cisco often tests the misconception that 'typical users need administrative rights for productivity,' but the trap here is that candidates confuse convenience with necessity, overlooking that tasks like password changes and home directory access are sufficient for daily work without compromising security.
Monitors traffic to web servers after firewall filtering, reducing noise.
Why this answer
Placing the IDS/IPS inside the firewall on the DMZ allows it to inspect traffic that has already passed the firewall's initial access controls but is still destined for the web servers. SQL injection attacks target application-layer vulnerabilities in web services, and the DMZ is the network segment where these servers reside. This placement ensures the sensor can analyze decrypted HTTP/HTTPS payloads for malicious SQL patterns without being overwhelmed by general internet noise, while the firewall provides a first line of defense against non-web threats.
Exam trap
Cisco often tests the misconception that placing the IDS/IPS outside the firewall provides the best visibility, but the trap is that this ignores the need to filter out irrelevant traffic and focus on the specific segment (DMZ) where the targeted servers and their application-layer vulnerabilities exist.
How to eliminate wrong answers
Option A is wrong because placing the IDS/IPS outside the firewall exposes it to unprocessed internet traffic, including floods, scans, and encrypted noise, which can cause false positives and resource exhaustion before the firewall filters legitimate traffic. Option B is wrong because the core switch handles internal VLAN routing and high-speed backbone traffic; placing a sensor there would miss the specific HTTP/HTTPS traffic to web servers in the DMZ and could introduce latency in critical switching paths. Option C is wrong because the internal network is typically for trusted users and internal resources; SQL injection attacks originate from external or untrusted sources targeting web servers, so a sensor on the internal network would not see the attack traffic unless it has already passed through the DMZ and been redirected, which is inefficient and misses the point of early detection.
An analyst discovers that an employee has been using company-issued laptops to run a personal cryptocurrency mining software. Which policy violation has occurred?
AUP defines permitted use of company assets; mining is unauthorized.
Why this answer
Cryptocurrency mining on company assets violates the Acceptable Use Policy (AUP), which governs the proper use of company resources. Option C is correct. Option A (Incident Response Policy) deals with responding to security incidents.
Option B (Change Management Policy) controls changes to systems. Option D (Data Classification Policy) addresses how data is labeled and handled.
An organization wants to ensure that a message has not been altered during transmission. Which cryptographic technique should be used?
Hashing produces a unique hash; comparing hashes detects alterations.
Why this answer
Hashing creates a fixed-size digest; any change in data changes the hash, verifying integrity.
An analyst is using Volatility's 'pslist' and 'pstree' commands on a memory dump. The output shows a process named 'lsass.exe' with a PID of 1024. However, the usual PID for lsass.exe on this system is 512. What does this discrepancy likely indicate?
Correct. Anomalous PID for lsass is suspicious.
Why this answer
The 'lsass.exe' process (Local Security Authority Subsystem Service) is a critical Windows system process responsible for enforcing security policies and handling authentication. Under normal conditions, lsass.exe runs as a child of 'winlogon.exe' or 'services.exe' with a consistent PID (often 512 or 528) across boots on a given system. A PID of 1024, especially when the known baseline is 512, strongly suggests that a malicious actor has spawned a fake 'lsass.exe' process via process hollowing (replacing the legitimate process's memory with malicious code) or masquerading (naming a malicious binary to mimic the legitimate one) to evade detection.
Exam trap
Cisco often tests the misconception that PIDs are random or always change between boots, but in reality, critical system processes like lsass.exe have predictable PIDs due to their fixed boot order, making any significant deviation a clear sign of compromise.
How to eliminate wrong answers
Option B is wrong because having multiple instances of lsass.exe is not normal; Windows typically runs only one instance of lsass.exe at a time, and multiple instances would indicate either a misconfiguration or malicious activity, but the question focuses on the PID discrepancy, not the count. Option C is wrong because while PIDs can vary between boots, the PID for lsass.exe on a given system is usually consistent (e.g., 512 or 528) due to its early boot-time launch order; a significant deviation like 1024 is abnormal and a red flag. Option D is wrong because lsass.exe is indeed a legitimate child of services.exe (or winlogon.exe) in normal operation, but the PID discrepancy itself is the anomaly; the statement does not explain why the PID is different, and a legitimate child would still have the expected PID.
A security analyst is analyzing a memory dump from a compromised Windows system using Volatility. Which command would best reveal hidden or injected code within a process?
malfind identifies suspicious memory protections and injected code.
Why this answer
The 'malfind' command scans for anomalous memory regions that often indicate code injection, such as executable pages not backed by a file on disk.
Layer 7 is the application layer, where user-facing protocols operate.
Why this answer
HTTP, FTP, and SMTP are application-layer protocols that operate at Layer 7 of the OSI model. Application-layer attacks target this layer by exploiting vulnerabilities in the application logic, input validation, or protocol implementation, such as SQL injection, cross-site scripting (XSS), or buffer overflows in web servers.
How to eliminate wrong answers
Option A is wrong because Layer 2 (Data Link) handles MAC addressing and frame switching, not application protocols like HTTP or FTP. Option C is wrong because Layer 4 (Transport) manages end-to-end communication with protocols like TCP and UDP, not application-specific protocols. Option D is wrong because Layer 3 (Network) is responsible for IP addressing and routing, not the application-layer services targeted by attacks.
Which Windows Event ID corresponds to a successful user logon?
4624 is the event ID for successful logon.
Why this answer
Event ID 4624 is logged when a user successfully logs on to a system.
Tuning allows the signature to still detect malicious usage while ignoring benign occurrences.
Why this answer
The IDS signature triggered on the presence of 'cmd.exe' in the URI, but the actual traffic was 'cmd.exe?help', which is a legitimate help request and not an exploitation attempt. Tuning the signature to account for the query string reduces false positives without losing detection capability for actual attacks. This aligns with best practices for IDS management, where signatures are adjusted to match real threat patterns rather than exact strings.
Exam trap
Cisco often tests the distinction between a false positive and a true positive, and the trap here is that candidates may assume any match for 'cmd.exe' is malicious, leading them to choose escalation or blocking instead of recognizing the need for signature tuning.
How to eliminate wrong answers
Option A is wrong because blocking the source IP would be an overreaction to a false positive; the traffic is benign and does not indicate malicious intent. Option C is wrong because disabling the signature entirely would remove detection for actual 'cmd.exe' exploitation attempts, leaving the network vulnerable. Option D is wrong because escalating to incident response is unnecessary for a confirmed false positive; incident response is reserved for verified security incidents, not benign traffic that triggered a signature.
A vendor security policy requires that all third-party remote access be limited to specific IP addresses and use multi-factor authentication. During an audit, it is discovered that a vendor's entire office subnet is allowed instead of individual IPs. The vendor argues that the broader range is necessary for redundancy. What is the best way to handle this from a policy perspective?
This balances security requirements with operational needs and ensures policy compliance.
Why this answer
It balances the security policy requirement for specific IPs with the vendor's need for redundancy by collaboratively defining a list of specific IPs that meet both objectives. Option A weakens policy by allowing entire subnets, Option B accepts non-compliance, and Option C is overly rigid and may disrupt operations without addressing the vendor's valid concern.
Which THREE types of network traffic anomalies are strong indicators of a data exfiltration attempt?
Unusual port usage can indicate covert channels.
Why this answer
Data exfiltration often involves tunneling covert traffic over non-standard ports to bypass firewall rules. For example, using SSH on TCP port 80 (HTTP) allows an attacker to hide command-and-control or file transfer traffic within allowed web traffic, making it difficult for basic port-based ACLs to detect.
Exam trap
Cisco often tests the distinction between network anomalies that indicate data exfiltration versus those that indicate denial-of-service or reconnaissance; the trap here is confusing a SYN flood (Option D) with a covert channel, when exfiltration requires established, often stealthy, outbound connections.
An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?
Correct. UNION SELECT is a classic SQL injection technique.
Why this answer
The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.
Exam trap
Cisco often tests the distinction between injection types by using specific payload strings; the trap here is confusing SQL injection with command injection because both involve 'injection', but the 'UNION SELECT' syntax is unique to SQL and not used in command injection or other attacks.
How to eliminate wrong answers
Option B is wrong because command injection involves executing system commands (e.g., via shell metacharacters like ';' or '|') rather than SQL statements like 'UNION SELECT'. Option C is wrong because cross-site scripting (XSS) typically injects client-side scripts (e.g., JavaScript) into web pages, not SQL syntax in URI parameters. Option D is wrong because directory traversal exploits path traversal sequences (e.g., '../') to access restricted files, not SQL query manipulation.
An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?
This stops malicious activity while preserving the script and other evidence on disk for later analysis.
Why this answer
The immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.
Exam trap
Cisco often tests the distinction between containment (stopping the active threat) and eradication (removing files), where candidates mistakenly choose to delete artifacts immediately (Option C) instead of first containing the process and preserving evidence for analysis.
How to eliminate wrong answers
Option A is wrong because relying solely on an antivirus scan is insufficient; the process 'svch0st.exe' mimics legitimate 'svchost.exe' and may evade signature-based detection, and ignoring the alert could allow persistent access. Option B is wrong because immediately disconnecting and restoring from backup destroys volatile evidence (e.g., running processes, memory contents, and scheduled task details) needed for forensic analysis, and may not remove the threat if the backup is also compromised. Option C is wrong because deleting the scheduled task and script without first containing the active process (svch0st.exe) allows the malware to continue running and potentially re-establish persistence or exfiltrate data; also, rebooting may destroy evidence in memory.
You are monitoring network traffic and notice a sudden spike in outbound UDP traffic from a single internal host to various external IPs on port 123 (NTP). The traffic pattern shows a high volume of small packets. The host in question is a Linux server that does not run any NTP services. The IDS does not generate any alerts for this traffic. Which type of attack is most likely occurring?
NTP amplification uses small queries to generate large responses; the outbound traffic is the queries.
Why this answer
The sudden spike in outbound UDP traffic from a single internal host to multiple external IPs on port 123 (NTP) with small packets indicates the host is being used as a reflector in an NTP amplification DDoS attack. The attacker spoofs the victim's IP address and sends small queries to open NTP servers, which respond with large replies directed at the victim, but in this scenario the internal host is the one sending the queries (likely due to malware or misconfiguration), making it the amplifier. The lack of IDS alerts suggests the traffic matches normal NTP patterns, but the volume and destination diversity confirm the attack.
Exam trap
Cisco often tests the distinction between being a victim of amplification (receiving large responses) versus being the amplifier (sending queries), and candidates mistakenly assume the host is the victim when the outbound traffic indicates it is the source of the queries.
How to eliminate wrong answers
Option B is wrong because scanning for open NTP servers would involve sending probes to multiple hosts and analyzing responses, not generating a high volume of outbound traffic from a single host to many external IPs; the pattern described is characteristic of an amplification attack, not a scan. Option C is wrong because data exfiltration via NTP tunneling would require encapsulating data in NTP packets, which typically results in irregular packet sizes or timing, not a high volume of small packets to many external IPs; the described pattern lacks the stealth and consistency of tunneling. Option D is wrong because an NTP time synchronization query would involve a small number of packets to a few NTP servers (e.g., pool.ntp.org), not a high volume of small packets to numerous external IPs; the host does not run NTP services, making this behavior anomalous.
Which TWO are examples of risk treatment options? (Select two.)
Implementing controls to reduce risk.
Why this answer
Mitigate and accept are common risk treatment options; avoid and transfer are others, but avoid is not listed as a standard option here; the correct ones are mitigate and accept.
Refer to the exhibit. An analyst sees repeated ICMP echo requests from a host to the broadcast address. What is this an example of?
Smurf attack uses broadcast ICMP to amplify traffic.
Why this answer
A Smurf attack sends ICMP echo requests to a network broadcast address with the source IP spoofed to the victim's address. All hosts on the network reply to the victim, overwhelming it with traffic. This is a classic amplification-based denial-of-service attack.
Exam trap
Cisco often tests the distinction between a generic DoS and a specific named attack (Smurf) to see if candidates recognize the unique broadcast amplification mechanism rather than just the outcome of service disruption.
How to eliminate wrong answers
Option A is wrong because a ping sweep sends ICMP echo requests to multiple individual hosts to map live systems, not to a broadcast address. Option C is wrong because ICMP tunneling encapsulates non-ICMP data (e.g., DNS, HTTP) inside ICMP packets to bypass firewalls, not to flood a victim via broadcast amplification. Option D is wrong because while a Smurf attack results in denial of service, the specific technique described (ICMP echo requests to a broadcast address) is the Smurf attack, not a generic DoS; Cisco expects the precise attack name.
A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?
Distributed Denial of Service uses many compromised devices.
Why this answer
A DDoS uses multiple sources to flood a target, making it unavailable.
A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains a sense of urgency. Which type of attack is this?
This is a classic phishing attempt.
Why this answer
Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.
Match each Linux command to its function.
Drag a concept onto its matching description — or click a concept then click the description.
Search text using patterns
Capture and analyze network packets
Display network connections and statistics
Configure firewall rules
Change file permissions
Why these pairings
These commands are essential for Linux system administration and security analysis.
An analyst uses Volatility's 'netscan' on a memory dump and finds an established connection to an external IP on port 4444. Which type of activity is this commonly associated with?
Port 4444 is commonly used for reverse shells.
Why this answer
Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.
Investigation helps determine the nature of the failed attempts before taking action.
Why this answer
The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.
Exam trap
Cisco often tests the principle that investigation must precede action, tempting candidates to choose immediate blocking (Option B) because it seems proactive, but the correct first step is always to gather context to avoid disrupting legitimate traffic.
How to eliminate wrong answers
Option A is wrong because escalating to the incident response team immediately without investigation is premature; the analyst must first confirm malicious intent to avoid unnecessary escalation. Option B is wrong because blocking the IP at the firewall immediately could deny service to a legitimate user if the IP is shared (e.g., NAT) or if the attempts are due to a forgotten password, and it bypasses the required investigative step. Option D is wrong because ignoring the activity violates security monitoring best practices; repeated failed login attempts are a common indicator of brute-force attacks and must be investigated, not dismissed as user error.
A PCAP contains an HTTP POST request with a parameter containing "UNION SELECT username, password FROM users". This is evidence of:
UNION SELECT in a parameter is classic SQL injection.
Why this answer
SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.
A security analyst needs to filter packets in Wireshark to capture only traffic on port 443. Which filter should be used?
This is a valid capture filter syntax for port 443.
Why this answer
When capturing packets in Wireshark, a capture filter must be used. Capture filters use Berkeley Packet Filter (BPF) syntax. The filter 'tcp port 443' is the correct BPF syntax to capture only TCP traffic on port 443 (HTTPS).
Option A uses Wireshark's display filter syntax, which is not used for capturing. Options B and C are also capture filters but B captures only destination port 443, and C captures both TCP and UDP on port 443, which is less specific.
Exam trap
Cisco often tests the distinction between Wireshark display filters and capture filters, trapping candidates who confuse the two syntaxes (e.g., using BPF-style 'port 443' in the display filter bar).
How to eliminate wrong answers
Option A is wrong because 'tcp.port == 443' is the correct Wireshark display filter syntax, but it is not listed as the correct answer; the question asks for the filter to use, and D is the exact match. Option B is wrong because 'dst port 443' uses capture filter syntax (tcpdump-style) which is not valid in Wireshark's display filter bar; it would be used in the capture filter field instead. Option C is wrong because 'port 443' is ambiguous and incomplete in Wireshark display filter syntax; it lacks the protocol qualifier (e.g., 'tcp.port') and would not be accepted as a valid filter.
Refer to the exhibit. An analyst examines the port security status on a switch interface. What action should the analyst take to restore connectivity to the device connected to this port?
Re-enabling the interface after a shutdown clears the errdisable state.
Why this answer
When a port security violation occurs (e.g., a MAC address limit is exceeded or a sticky MAC changes), the switch can be configured to err-disable the interface. The standard remediation is to administratively shut down the interface (shutdown) and then re-enable it (no shutdown), which clears the error condition and restores connectivity. This is the only action that directly addresses the err-disable state caused by the security violation.
Exam trap
Cisco often tests the misconception that clearing the MAC address table or adjusting the MAC limit will restore connectivity, but the trap here is that the interface is in an err-disabled state, which requires a manual or automatic interface reset, not a table or configuration change.
How to eliminate wrong answers
Option A is wrong because removing the port from the VLAN does not clear the err-disable state or the security violation; it would only isolate the port from the network without resolving the underlying issue. Option B is wrong because clearing the MAC address table on the switch removes all dynamically learned MAC entries across all interfaces, but it does not clear the specific port security violation or the err-disable state on the affected interface. Option D is wrong because increasing the maximum number of MAC addresses allowed does not fix the current violation; it only prevents future violations if the current number of MACs is below the new limit, but the port remains err-disabled until it is manually or automatically recovered.
A network engineer is configuring a Cisco Firepower IPS. To reduce false positives from legitimate updates, which action should be taken?
Adaptive profiles adjust detection based on baseline traffic, reducing false positives.
Why this answer
Enabling adaptive profile allows the IPS to learn normal traffic patterns and reduce false positives. Whitelisting is also useful but adaptive profiles are specifically designed to reduce false positives dynamically.
A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?
Contains the threat and prevents spread.
Why this answer
The correct first step is to isolate the host from the network (C) because the alert indicates active malware ('invoice.exe' in Downloads). Containment is the immediate priority in incident response to prevent lateral movement and data exfiltration. Isolating the host stops any ongoing C2 communication or propagation over the network, aligning with the NIST SP 800-61 containment strategy.
Exam trap
Cisco often tests the incident response priority of containment over eradication or escalation, and the trap here is that candidates may choose to delete the file (D) or run a scan (B) first, mistaking remediation for the initial response step.
How to eliminate wrong answers
Option A is wrong because escalation to a senior analyst should occur after initial containment, not before; the SOC analyst has the authority and responsibility to isolate the host first. Option B is wrong because running a full antivirus scan is a secondary step that could alert the malware or consume time while the threat remains active on the network. Option D is wrong because deleting the file immediately destroys forensic evidence and does not stop potential in-memory or persistence mechanisms that may already be active.
An analyst uses Wireshark to examine network traffic and wants to see only packets that contain the string 'password'. Which type of filter should be applied?
Display filters can search for strings in packet payloads.
Why this answer
Display filters in Wireshark allow filtering of already captured packets based on criteria like packet content.
An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?
Typo-squatting domain indicates phishing.
Why this answer
The most definitive indicator of a phishing attempt is a spoofed sender domain that mimics a legitimate company (e.g., 'arnazon.com' instead of 'amazon.com'). This is a classic typosquatting technique used to deceive users into trusting the email's origin. While other elements like logos or PDF attachments can be part of a phishing campaign, they are not inherently malicious and are commonly used in legitimate business communications.
Exam trap
Cisco often tests the distinction between a suspicious element (like a PDF attachment) and a definitive indicator of phishing (like a spoofed domain), leading candidates to incorrectly choose the attachment type as the answer.
How to eliminate wrong answers
Option A is wrong because a company logo can be easily copied and embedded in any email; its presence does not confirm phishing and is often used in both legitimate and malicious emails. Option C is wrong because PDF files are a standard, legitimate file format used for invoices; the attachment type alone is not an indicator of phishing. Option D is wrong because phishing emails can be sent at any time, including business hours, to blend in with normal traffic; timing is not a reliable indicator of malicious intent.
An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?
Beaconing is a hallmark of C2.
Why this answer
The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.
Exam trap
Cisco often tests the distinction between beaconing (C2) and data exfiltration (Actions on Objectives), where candidates mistakenly associate any external HTTP POST with data theft rather than recognizing the periodic pattern as command-and-control signaling.
How to eliminate wrong answers
Option A is wrong because the Delivery phase involves the initial transmission of the exploit or payload to the target (e.g., via phishing email or malicious download), not periodic beaconing after compromise. Option C is wrong because Actions on Objectives refers to the final goal, such as data exfiltration or system destruction, which would show larger or irregular data transfers, not consistent small beacons. Option D is wrong because Installation is the phase where malware is placed on the system (e.g., writing to disk or registry), which occurs before C2 and does not involve periodic network traffic.
A SIEM correlation rule triggers when more than 10 failed login attempts from a single source IP occur within 1 minute. This rule is designed to detect:
Failed login rate threshold detects brute force attempts.
Why this answer
A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.
Exam trap
Cisco often tests the distinction between a brute force attack (repeated failed logins) and a DDoS attack (high traffic volume), so candidates may confuse the two because both involve high event counts from a single source.
How to eliminate wrong answers
Option A is wrong because privilege escalation involves gaining higher-level access after initial compromise, not repeated failed logins. Option B is wrong because malware infection typically involves payload delivery or execution, not a high volume of failed authentication attempts. Option D is wrong because a DDoS attack aims to overwhelm resources with traffic volume, not to guess credentials via repeated login failures.
In Snort, a rule is written as: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"SMB exploit attempt"; flow:to_server; content:"|ff|SMB"; nocase;). What does the 'flow:to_server' option indicate?
'to_server' matches client-to-server direction.
Why this answer
In Snort, the 'flow:to_server' option directs the rule to match only traffic traveling from the client to the server, based on the direction specified in the rule header. Since the rule header defines the source as $EXTERNAL_NET and destination as $HOME_NET, 'to_server' evaluates traffic flowing from the external network (client) to the home network (server), which is the correct direction for detecting an inbound SMB exploit attempt.
Exam trap
Cisco often tests the distinction between 'to_server' and 'from_server' in the 'flow' keyword, where candidates mistakenly think 'to_server' applies to any traffic involving the server, rather than specifically traffic directed toward the server from the client.
How to eliminate wrong answers
Option A is wrong because 'flow:to_server' does not apply to bidirectional traffic; that would require 'flow:established' or 'flow:both'. Option C is wrong because 'to_server' explicitly matches traffic from client to server, not from server to client; the opposite direction would be 'flow:from_server'. Option D is wrong because 'flow:to_server' does not ignore direction; it enforces a specific direction based on the rule header's source and destination.
A SOC analyst is reviewing a NetFlow record and sees that a single internal IP has communicated with multiple external IPs on port 445 (SMB) within a short time frame. Which type of activity is most likely indicated?
Multiple SMB connections to different IPs suggest scanning or worm activity.
Why this answer
Port 445 is used by SMB for file sharing, but a single internal IP communicating with many external IPs in a short time frame is characteristic of scanning or worm propagation. Worms like EternalBlue exploit SMB vulnerabilities to spread rapidly, generating many outbound connections to random or sequential external IPs on port 445. This pattern is not typical of normal file sharing, which involves sustained connections to known servers.
Exam trap
Cisco often tests the distinction between normal traffic patterns and malicious scanning by using a single internal IP connecting to many external IPs on a specific port, where candidates may mistakenly associate SMB only with legitimate file sharing (Option A) rather than recognizing the scanning behavior.
How to eliminate wrong answers
Option A is wrong because normal file sharing activity involves consistent connections to a limited set of known file servers, not a burst of connections to many different external IPs. Option B is wrong because data exfiltration over SMB would typically involve large data transfers to a single or few external IPs, not a broad scan pattern; exfiltration focuses on stealthy extraction, not rapid propagation. Option D is wrong because DNS tunneling uses DNS queries (port 53) to encapsulate data, not SMB on port 445; the protocol and port mismatch makes this option irrelevant.
An organization uses Cisco AMP for Endpoints. A file with a low prevalence score is executed on multiple endpoints, and AMP identifies it as malicious after behavioral analysis. The analyst needs to ensure that all endpoints are protected from this file. Which action should be taken?
Outbreak policy blocks the file across all endpoints.
Why this answer
Creating a custom IOC for the file hash and applying it to an outbreak policy is correct because Cisco AMP for Endpoints uses outbreak policies to rapidly deploy protections across all endpoints. Once behavioral analysis identifies the file as malicious, the IOC (based on the file's SHA-256 hash) can be pushed via an outbreak policy to block execution, quarantine, or remediate the file on every endpoint, regardless of prior prevalence. This ensures immediate, global protection without waiting for cloud signature updates.
Exam trap
Cisco often tests the distinction between reactive containment (isolation) and proactive prevention (outbreak policies), leading candidates to choose isolation because it seems immediate, but the question asks for ensuring all endpoints are protected, which requires a policy-based push, not just isolating affected systems.
How to eliminate wrong answers
Option B is wrong because isolating all endpoints that executed the file is a reactive containment step that does not prevent the file from executing on other endpoints that have not yet encountered it; it also disrupts user productivity unnecessarily. Option C is wrong because disabling cloud connectivity for AMP would prevent the endpoints from receiving real-time threat intelligence and outbreak policies, leaving them vulnerable to new threats and defeating the purpose of AMP's cloud-based analysis. Option D is wrong because running a local scan using the AMP engine only checks for known signatures already present on the endpoint; it cannot detect or remediate a file that was just identified as malicious via behavioral analysis unless the local signatures are updated, which is slower and less reliable than an outbreak policy.
An analyst is reviewing a PCAP and sees multiple HTTP requests with the parameter 'id=1 UNION SELECT username,password FROM users'. What type of attack is being attempted?
Correct. UNION SELECT is classic SQL injection payload.
Why this answer
The SQL keywords UNION and SELECT in a parameter indicate a SQL injection attempt to extract data from the database.
Drag and drop the steps for the DHCP DORA process (dynamic host configuration) into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The DHCP DORA process stands for Discover, Offer, Request, Acknowledge. It begins with the client broadcasting a Discover message to find DHCP servers. Servers respond with an Offer of an available IP address.
The client then sends a Request to accept one of the offers. Finally, the server sends an Acknowledge to confirm the lease, completing the process. This sequence ensures proper assignment of IP addresses and avoids conflicts.
Which THREE of the following are common types of security policies that organizations typically implement?
Categorizes data based on sensitivity and handling requirements.
Why this answer
The correct answers are B, C, and E. Data Classification Policy (B), Password Policy (C), and Acceptable Use Policy (E) are common types of security policies. ISO 27001 Standard (A) is a framework, not a policy.
Patch Management Procedure (D) is a procedure, not a policy.
An analyst is investigating a malware infection on a workstation. The malware appears to be a trojan that downloads additional payloads and allows remote control. The analyst needs to classify the malware based on its behavior. Which THREE characteristics match this description? (Choose three.)
Remote control is a backdoor characteristic.
Why this answer
A is correct because a trojan is a type of malware that disguises itself as legitimate software to trick users into installing it, and once executed, it often provides unauthorized remote access to the system, commonly through a backdoor. This matches the description of allowing remote control, which is a core characteristic of Remote Access Trojans (RATs).
Exam trap
Cisco often tests the distinction between trojans and worms by emphasizing that trojans require user interaction to execute, whereas worms self-replicate and spread automatically without user action.
Refer to the exhibit. An analyst runs the command 'tasklist /svc /fi "PID eq 1234"' on a Windows host and receives the output shown. Which conclusion can the analyst draw from this output?
svchost.exe is a legitimate Windows process that hosts multiple system services.
Why this answer
The 'tasklist /svc /fi "PID eq 1234"' command filters for a specific PID and displays the associated services. The output shows 'svchost.exe' with the service 'DcomLaunch', which is a core Windows component responsible for launching COM and DCOM services. This confirms the process is a legitimate Windows service host, not a third-party application or malware.
Exam trap
Cisco often tests the misconception that any svchost.exe process is suspicious or malware, but the key is to recognize that legitimate svchost.exe instances host specific Windows services and are identified by their associated service names and standard system paths.
How to eliminate wrong answers
Option A is wrong because the output shows 'svchost.exe', which is a native Windows system binary, not a third-party application. Option B is wrong because the 'tasklist /svc' command does not display CPU usage; it only shows process name, PID, and associated services, so no conclusion about CPU resource consumption can be drawn. Option D is wrong because while malware can masquerade as svchost.exe, the presence of the legitimate 'DcomLaunch' service and the process running from the standard 'C:\Windows\System32' directory (implied by the output) strongly indicates it is not masquerading; a masquerading process would typically not have the correct service association or path.
A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices without their knowledge. Which type of attack is this?
MitM involves interception and alteration of communications.
Why this answer
This scenario describes an attacker intercepting and modifying communications between two devices without their knowledge, which is the defining characteristic of a Man-in-the-Middle (MitM) attack. In a MitM attack, the attacker positions themselves between the two communicating parties, allowing them to eavesdrop, capture, and alter data in transit while both endpoints believe they are communicating directly with each other.
Exam trap
The trap here is that Cisco often tests the distinction between the attack technique (e.g., ARP spoofing) and the broader attack category (MitM), leading candidates to confuse a specific method with the overall attack type described in the question.
How to eliminate wrong answers
Option A is wrong because ARP spoofing is a specific technique used to associate an attacker's MAC address with the IP address of a legitimate device on a local network, enabling traffic interception; however, it is a method to facilitate an attack, not the attack itself described in the question. Option B is wrong because DNS poisoning corrupts the DNS resolver cache to redirect users to malicious sites by altering DNS records, but it does not inherently involve intercepting and modifying communications between two specific devices in real time. Option C is wrong because a Denial of Service (DoS) attack aims to overwhelm a target with traffic to disrupt service availability, not to intercept or modify communications between two devices.
An analyst is verifying a VPN configuration. Which of the following is true about this configuration?
Correct interpretation of transform set.
Why this answer
The configuration shown in the exhibit (not provided here) specifies AES-256 as the encryption algorithm and SHA-1 as the authentication (integrity) algorithm. AES-256 provides a 256-bit key for strong encryption, while SHA-1 produces a 160-bit hash for data integrity. Although SHA-1 is considered cryptographically weaker than SHA-2, it is still commonly used in legacy or compatibility-focused VPN configurations, making option C the correct match for the given settings.
Exam trap
Cisco often tests the ability to read a configuration snippet accurately, where candidates confuse AES key lengths (128 vs. 256) or authentication algorithms (SHA-1 vs. SHA-2) because the numbers look similar, leading them to pick a plausible but incorrect option like B or A.
How to eliminate wrong answers
Option A is wrong because it states AES-128 encryption and SHA-1 authentication, but the configuration uses AES-256, not AES-128. Option B is wrong because it claims SHA-2 authentication, but the configuration specifies SHA-1, not SHA-2. Option D is wrong because it lists 3DES encryption and SHA-256 authentication; 3DES is a block cipher with 168-bit effective key length, not AES-256, and SHA-256 is a SHA-2 variant, not SHA-1.
Option E is wrong because it mentions DES encryption (56-bit key, considered very weak) and MD5 authentication (128-bit hash, deprecated due to collision vulnerabilities), neither of which matches the AES-256 and SHA-1 in the configuration.
A company processes credit card payments and must comply with a framework that mandates specific security controls for protecting cardholder data. Which compliance framework applies?
PCI DSS is the standard for protecting cardholder data.
Why this answer
PCI DSS is the Payment Card Industry Data Security Standard, mandatory for entities handling credit card information.
An security auditor finds that the company's backup policy does not include offsite storage. The security policy requires that backups be stored in a geographically separate location. What should the company do?
Encrypted cloud backup in a different region meets the requirement for geographically separate storage.
Why this answer
Encrypted offsite cloud storage satisfies the geographical separation requirement. Option A is wrong because onsite storage is not geographically separate. Option B is wrong because increasing retention does not change location.
Option C is wrong because RAID provides redundancy but not offsite storage.
A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)
Unusually large or frequent queries may indicate tunneling.
Why this answer
DNS tunneling often involves unusually large query sizes (e.g., encoded data in subdomains) and abnormal query frequencies (e.g., thousands of requests per minute). Monitoring these metrics allows analysts to spot deviations from baseline behavior, which is a key detection technique for exfiltration via DNS. Option B is correct because a DNS sinkhole redirects malicious or suspicious DNS queries to a controlled IP address, effectively blocking the resolution of domains used for tunneling and preventing data from reaching the attacker's command-and-control server.
Exam trap
Cisco often tests the misconception that DNSSEC or disabling recursion can stop DNS tunneling, but DNSSEC only signs records and does not inspect payloads, while disabling recursion breaks internal resolution without affecting external tunneling via forwarders.
During incident response, an analyst extracts files from a PCAP using Wireshark's Export Objects feature. One extracted file is a PDF that triggers an IDS alert for 'Exploit:PDF/HeapSpray'. Which technique does this alert describe?
Heap spray loads shellcode into heap memory to hijack execution.
Why this answer
Heap spray is a memory corruption technique where an attacker fills heap memory with shellcode to increase the chance of code execution, often used in PDF exploits.
A security analyst observes periodic outbound HTTPS connections to an unusual domain that resolves to different IP addresses each time. This behavior is most indicative of:
Periodic HTTPS connections to DGA domains indicate C2 beaconing.
You are the cybersecurity analyst for a small business that has a security policy requiring all network traffic to pass through a proxy server for content filtering. Recently, employees have been complaining that some websites are not loading correctly. You check the proxy logs and see that the proxy is blocking traffic that appears to be from non-standard ports. However, upon investigation, you find that the blocked sites are legitimate business tools that use custom ports. Which action aligns with the security policy?
This balances security and usability while maintaining audit trail.
Why this answer
Creating a documented security exception for the legitimate business tools allows them to function while maintaining the security policy's intent. The policy requires traffic to pass through the proxy for content filtering, but legitimate business needs may necessitate exceptions. Documenting the exception ensures auditability and control.
Option A is incorrect because instructing employees to use HTTP instead of the custom ports may not be possible if the tools require specific protocols, and it could introduce security risks. Option B is incorrect because configuring the proxy to allow all traffic on custom ports broadly would bypass content filtering for those ports, potentially allowing malicious traffic. Option C is incorrect because disabling content filtering for affected employees removes the security control entirely, violating the policy.
Practice 200-201 by domain
Target a specific domain to shore up weak areas.