Cisco CyberOps Associate 200-201 (200-201) — Questions 451–525

Network evidence of a live connection to a threat-intelligence-listed domain, occurring shortly after a user clicked a phishing link, justifies treating the workstation as potentially compromised. Endpoint scans often miss fileless or in-memory activity, so a clean disk does not clear the host. The proportionate response is containment with evidence preservation, followed by correlation across email, DNS, proxy, and endpoint telemetry to establish scope and determine whether credentials or data were affected.

The firewall rule specifically blocks command-and-control (C2) traffic, which is the network communication channel the malware uses to send data or receive instructions. Since the SIEM relies on network-based alerts (e.g., from intrusion detection systems or firewall logs) to detect this traffic, blocking the C2 traffic eliminates those network alerts. However, the malware remains on the endpoints because the firewall does not remove the infection; it only prevents outbound communication, so endpoint scans still detect the malware files or processes.

A vulnerability assessment is a systematic review that identifies, quantifies, and prioritizes security weaknesses in an environment. It differs from a penetration test because it does not exploit flaws or simulate an attacker; instead, it produces a list of vulnerabilities ranked by severity so that remediation efforts can be planned. This makes it a foundational risk management activity.

Successful interactive logons at the console are recorded as Security Event ID 4624 with Logon Type 2. Filtering for that combination and the last 24 hours gives the analyst the specific accounts used for interactive console access on the server, which is exactly the requested scope.

DNS tunneling exploits legitimate DNS protocol behavior by encoding data in query payloads, making it invisible to signature-based detection. By writing custom Snort rules that monitor query size (typically > 255 bytes for TXT records), frequency (abnormally high query rates per domain), and domain name entropy (random-looking subdomains), and using full packet capture to baseline normal DNS traffic, you can detect anomalies indicative of tunneling with high precision and low false positives.

Active reconnaissance involves directly interacting with the target system to gather information, such as port scanning, vulnerability scanning, or banner grabbing. Using a vulnerability scanning tool to identify open ports sends packets to the target and elicits responses, which is the definition of active reconnaissance. This contrasts with passive reconnaissance, which collects information without direct interaction.

STIX is a standardized language for describing threat intelligence, while TAXII is the protocol to share it.

The Protect function of the NIST Cybersecurity Framework involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. It covers access control, awareness training, data security, protective technology, and maintenance. This function limits or contains the impact of a potential cybersecurity event.

A destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. In this scenario, the attacker intercepts and modifies the data in transit, and neither the client nor the server detects the modification, which is the hallmark of a MITM attack. MITM is a broad category that encompasses various techniques, including ARP spoofing and DNS poisoning, but the core definition is the active interception and modification of traffic.

Port 445 is the default port for Microsoft SMB (Server Message Block) over TCP, used for file sharing, printer sharing, and other network services. Communication with a known malicious IP on this port strongly indicates SMB-based activity, such as exploitation of vulnerabilities like EternalBlue (MS17-010) or unauthorized file access.

The principle of least privilege states that users should be granted only the minimum access necessary to perform their job functions, and no more. For a new employee needing database access, the correct action is to grant only the minimum required permissions (A) — scoped to the specific database objects and operations the role demands. This limits the blast radius of compromise or error and satisfies least privilege.

A SIEM correlation rule for brute-force attacks typically triggers when the number of failed login attempts from a single source exceeds a defined threshold within a specific time window. If the threshold is set too high, the rule will not fire even though failed logins are occurring, because the count never reaches the required value. This is the most direct and common cause for a correlation rule not triggering when expected.

The need-to-know principle ensures that access to information is granted only to individuals whose current responsibilities require that specific information. In this scenario, the organization wants to restrict access to intellectual property based on project tasks, which directly reflects need-to-know. Least privilege is about minimum permissions, but need-to-know is more granular and focuses on information relevance to the task.

Creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.

RADIUS with a token server is the correct choice because RADIUS is the standard protocol for carrying authentication requests from network access devices to an authentication server, and integrating a token server (e.g., RSA SecurID, Duo) enables one-time password validation. The token server generates or validates the OTP, and RADIUS relays the credentials, satisfying the policy requirement for OTP-based remote access authentication.

The traffic pattern of many TCP SYN packets to numerous destination addresses on a single port, with no completed handshakes, is the signature of TCP SYN scanning. This is a reconnaissance technique used to identify live hosts and open services, commonly on port 445 for SMB. A SYN flood would focus on one target, and brute-force or man-in-the-middle activity would require established connections.

The `-enc` parameter in PowerShell stands for `-EncodedCommand`, which accepts a Base64-encoded string representing the actual command. Attackers use it to obfuscate malicious scripts and bypass simple command-line logging. An analyst should decode the Base64 string to reveal the true intent, such as downloading a payload or establishing persistence.

Effective log retention ties each source to a defined period justified by regulation and business need, then centralizes storage with integrity protection so logs remain available and trustworthy. Indefinite retention on source systems, extremely short deletion windows, or keeping only correlated alerts all undermine investigations and compliance. The chosen approach supports both retrospective hunting and evidentiary requirements.

The exhibit shows a rule configured to trigger an alert when the number of DNS queries from a single source IP exceeds 1000 within a 60-second sliding window. This is a rate-based threshold designed to detect DNS amplification or tunneling attacks, where a single host generates an abnormally high volume of DNS requests. Option A correctly describes this condition.

Confidentiality ensures data is not disclosed to unauthorized parties. When an attacker intercepts and reads encrypted traffic, the confidentiality of that data is breached because the adversary gains access to information they were not authorized to see. Integrity concerns unauthorized modification, and availability concerns disruption of access, neither of which is the primary impact of a read-only interception.

When a critical security patch addresses a widely exploited vulnerability, the immediate risk to the organization outweighs standard change windows. Change management policy typically includes an emergency change process that bypasses normal scheduling to allow rapid deployment with expedited approval, even if a reboot during business hours is required. This aligns with the principle of prioritizing security over availability in high-severity scenarios.

DNS tunneling encodes data (e.g., exfiltrated files) into subdomains of DNS queries, which are then sent to a malicious authoritative DNS server controlled by the attacker. The base64-encoded subdomains in the logs are a classic indicator of this technique, as the attacker uses the DNS protocol to bypass network security controls and covertly transmit data.

In a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

The Preparation phase involves creating and maintaining the incident response plan, including playbooks and procedures. If the containment plan did not account for PowerShell-based lateral movement, that is a gap in the planning and preparation stage. The actual containment failure during the incident is a symptom of inadequate preparation, not a deficiency in the Containment phase itself, which is about executing the plan.

The high volume of unique, random-looking domain queries with short TTLs from a single host is a classic indicator of a domain generation algorithm. Malware uses DGA to periodically generate many domain names and attempt to resolve them, hoping to find the one registered by the attacker for command and control. This evades static domain blocklists and makes takedown difficult.

A false positive occurs when a security tool raises an alert for activity that is not actually malicious or successful. Here, the SQL injection payload 'id=1 OR 1=1' was detected in the request, but the server returned a normal page with no signs of compromise, meaning the attack did not succeed and the alert was triggered on suspicious input rather than actual exploitation. Therefore, the alert is a false positive.

A digital signature is created by hashing the message and encrypting that hash with the sender's private key. Anyone can verify it using the sender's public key, and because only the sender possesses the private key, the sender cannot later deny having signed it — this is non-repudiation. Symmetric encryption, certificates, and hashing alone do not provide that property.

A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

PAGE_EXECUTE_READWRITE protection combined with 'MZ' header suggests code injection, where a malicious executable has been written into the process memory.

Hashing is the correct control for ensuring data integrity because it produces a fixed-length digest (e.g., SHA-256) from the original data. Any change to the data, even a single bit, results in a completely different hash value, allowing the analyst to detect tampering or corruption. Unlike encryption, hashing is a one-way function that does not conceal the data but verifies its unchanged state.

When process creation auditing is enabled, Windows logs Security Event ID 4688 for each new process, and the event includes the subject user name that initiated it. Correlating the process name and timestamp in 4688 with the alert time lets the analyst attribute the suspicious process to a specific user account, which is exactly what is needed here.

The HIPAA Security Rule groups safeguards into administrative, physical, and technical categories. Encryption, access controls, and audit logging are technology-based protections applied to electronic protected health information, which places them squarely in the technical safeguards category. Administrative safeguards involve policies and workforce management, while physical safeguards involve facility and device protections, so neither fits the described controls.

An Acceptable Use Policy (AUP) defines how company-owned assets and networks may be used, and typically prohibits personal or unauthorized activities such as cryptocurrency mining on corporate laptops. Running mining software on company hardware violates the AUP because it misuses corporate resources for personal gain and can degrade performance or introduce security risk. The other policies address incident handling, change control, and data handling — none of which directly govern employee use of company devices.

The vol.py malfind command in Volatility scans process memory for hidden or injected code by looking for memory regions with suspicious characteristics, such as executable permissions and no corresponding file on disk. It is specifically designed to detect code injection and rootkit-like behavior. This makes it the best choice for revealing hidden or injected code within a process.

HTTP, FTP, and SMTP are application-layer protocols that operate at Layer 7 of the OSI model. Application-layer attacks target this layer by exploiting vulnerabilities in the application logic, input validation, or protocol implementation, such as SQL injection, cross-site scripting (XSS), or buffer overflows in web servers.

Event ID 4624 is correct because Windows Security auditing logs 4624 for a successful account logon, including the logon type (interactive, network, service, etc.) and the account and workstation involved. It is the canonical event analysts filter on to confirm successful authentication.

The genuine lsass.exe runs from C:\Windows\System32 and is spawned by wininit.exe. A process named lsass.exe running from C:\Users\Public with cmd.exe as its parent is a strong indicator of process masquerading, where malware mimics a legitimate process name to evade detection. This technique is commonly used by attackers to blend in with normal system activity.

Oversized ICMP echo packets carrying encoded, non-standard payloads in both directions strongly indicate ICMP tunneling, a common method for covert data transfer and exfiltration. Because many networks permit ping for troubleshooting, attackers abuse it to move data past controls that do not inspect ICMP payloads. The other options describe different ICMP-based behaviors that do not involve encoded data in echo payloads.

The pattern of SYN, SYN-ACK, then RST indicates a half-open TCP scan, commonly known as a SYN stealth scan. The attacker sends a SYN, receives a SYN-ACK if the port is open, but resets the connection instead of completing the handshake. This avoids establishing a full connection and is often used to evade detection while enumerating open ports.

The IDS signature triggered on the presence of 'cmd.exe' in the URI, but the actual traffic was 'cmd.exe?help', which is a legitimate help request and not an exploitation attempt. Tuning the signature to account for the query string reduces false positives without losing detection capability for actual attacks. This aligns with best practices for IDS management, where signatures are adjusted to match real threat patterns rather than exact strings.

The correct approach is to work with the vendor to define specific IPs that satisfy their redundancy needs while still complying with the policy's intent. This preserves the security control (limiting access to known, specific addresses) without simply weakening the policy or ignoring the violation. It balances operational flexibility with the vendor security requirement.

The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.

The immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.

A DDoS (Distributed Denial of Service) attack uses many compromised devices — often a botnet — to flood a target with traffic, overwhelming its resources so legitimate users cannot connect. The key distinguishing factor in the question is 'many compromised devices,' which indicates distribution across multiple sources rather than a single attacking host. This matches the definition of DDoS and differentiates it from a single-source DoS attack.

Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

These commands are essential for Linux system administration and security analysis.

Port 4444 is commonly used by Metasploit and other remote access tools for reverse shells. An established connection to an external IP on this port is indicative of a backdoor or command-and-control communication.

The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.

SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.

When a port security violation occurs (e.g., a MAC address limit is exceeded or a sticky MAC changes), the switch can be configured to err-disable the interface. The standard remediation is to administratively shut down the interface (shutdown) and then re-enable it (no shutdown), which clears the error condition and restores connectivity. This is the only action that directly addresses the err-disable state caused by the security violation.

The combination of small payloads, PSH flag, and regular intervals is indicative of an interactive command-and-control channel. Attackers often use such channels to maintain stealth, sending commands and receiving responses in small packets to avoid detection by volume-based monitoring. This pattern is distinct from bulk transfers or DoS attacks.

The correct first step is to isolate the host from the network (C) because the alert indicates active malware ('invoice.exe' in Downloads). Containment is the immediate priority in incident response to prevent lateral movement and data exfiltration. Isolating the host stops any ongoing C2 communication or propagation over the network, aligning with the NIST SP 800-61 containment strategy.

Windows Security event logs on the workstation capture logon events, including network logons to remote shares. Events like 4624 with logon type 3 show that an account authenticated over the network. This is the most direct evidence of an authentication attempt to a file share.

A Wireshark display filter is applied after capture to narrow what is shown from already-captured packets, and it supports string matching operators like contains. The filter frame contains "password" (or tcp contains "password") is a display filter that shows only packets whose payload includes that string. Capture filters use BPF syntax and cannot perform arbitrary string matching on payload content.

The most definitive indicator of a phishing attempt is a spoofed sender domain that mimics a legitimate company (e.g., 'arnazon.com' instead of 'amazon.com'). This is a classic typosquatting technique used to deceive users into trusting the email's origin. While other elements like logos or PDF attachments can be part of a phishing campaign, they are not inherently malicious and are commonly used in legitimate business communications.

The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Registry modification for persistence is part of the Installation stage of the cyber kill chain, where the attacker ensures the malware survives reboots. The other stages such as Delivery, Exploitation, and Command and Control occur at different points. The sandbox observation of registry changes indicates the malware is establishing a foothold.

A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.

Port 445 is used by SMB for file sharing, but a single internal IP communicating with many external IPs in a short time frame is characteristic of scanning or worm propagation. Worms like EternalBlue exploit SMB vulnerabilities to spread rapidly, generating many outbound connections to random or sequential external IPs on port 445. This pattern is not typical of normal file sharing, which involves sustained connections to known servers.

A SYN scan is proven by the combination of incomplete handshakes across many destination ports and deliberate header variation. The scanner never finishes the three-way handshake, and it randomizes source ports and window sizes to evade detection. Target responses such as RST or SYN-ACK merely reflect normal TCP behavior, a completed handshake indicates legitimate client activity, and historical firewall blocks are reputation context rather than packet-level confirmation.

Creating a custom IOC for the file hash and applying it to an outbreak policy is correct because Cisco AMP for Endpoints uses outbreak policies to rapidly deploy protections across all endpoints. Once behavioral analysis identifies the file as malicious, the IOC (based on the file's SHA-256 hash) can be pushed via an outbreak policy to block execution, quarantine, or remediate the file on every endpoint, regardless of prior prevalence. This ensures immediate, global protection without waiting for cloud signature updates.

To confirm exfiltration, the analyst must determine what data is leaving, not just how much. Full packet capture with content inspection, or decrypted proxy and TLS logs where available, reveals file types, protocols, and payloads. NetFlow establishes the anomaly—large volume, unusual destination, off-hours timing—but content-level visibility converts suspicion into confirmation and supports incident response decisions.

The SQL keywords UNION and SELECT in a parameter indicate a SQL injection attempt to extract data from the database.

The unpatched Apache Struts issue is a software flaw that can be leveraged by an attacker, making it a vulnerability. Understanding this distinction is crucial for risk assessment: vulnerabilities are weaknesses, threats are actors or events that can exploit them, and risk is the potential impact. Correctly identifying the vulnerability helps prioritize remediation such as patching.