Cisco CyberOps Associate 200-201 (200-201) — Questions 526–600

Remote-access trojans install a backdoor that grants the attacker interactive control of the workstation, satisfying the stem's "allows remote control" constraint. This unauthorised access is the defining behavioural characteristic distinguishing a RAT from payloads that merely download or self-replicate, so it matches the classification requirement directly.

A man-in-the-middle attack satisfies the interception-and-modification constraint: the adversary covertly relays traffic between two endpoints, terminating each side's session so both devices believe they communicate directly. Sitting inline on the path, the attacker can read and alter data in transit undetected, matching the stem's silent modification of communications.

This is correct because monitoring is legally defensible when employees are clearly informed that corporate systems are subject to monitoring and that they should not expect privacy. This notice, often included in an Acceptable Use Policy or employee handbook, establishes consent and reduces legal risk. Without it, monitoring during an investigation could violate privacy laws or employment agreements.

PCI DSS applies because the stem specifies credit card payments and cardholder data protection. It is the payment card industry standard that mandates controls such as encryption, access restriction and network monitoring for any entity storing, processing or transmitting cardholder data, directly satisfying the stated compliance requirement.

Encrypted cloud backup in a separate region satisfies the geographic separation requirement without building a second physical site. Encryption preserves confidentiality while the offsite copy survives a local disaster, directly meeting the policy's mandate for backups stored in a geographically distinct location.

lsof with -i lists open Internet sockets, -P suppresses port-name resolution, and -n suppresses hostname resolution. The output shows the owning process name, PID, user, and the remote endpoint, which is exactly what is needed to tie a suspicious outbound connection to a user and process. It complements ss by showing file descriptors and the process that opened each socket.

DNS tunnelling hides stolen data inside query payloads, so unusually large or frequent queries to one domain expose it. Monitoring query size and frequency detects this anomaly at the resolver, satisfying the requirement to identify exfiltration without blocking legitimate DNS traffic.

Heap spray describes shellcode placed repeatedly across heap memory to land at a predictable address during exploitation. The PDF object carries that sprayed payload, which is why the IDS signature names heap spray rather than a buffer overflow or denial-of-service technique.

Periodic, low-volume fan-out to many distinct external hosts on a single common port is a classic beaconing signature, especially outside business hours. Because NetFlow records only metadata, the analyst cannot see payload, so the correct next step is to correlate the flows with endpoint telemetry and DNS logs before concluding compromise, but escalation is warranted.

Deprovisioning is the lifecycle stage that removes or disables access when a user leaves the organization. The account should have been disabled on the employee's last day, but it remained active for 45 days and was used to reach a file server. This directly indicates a breakdown in the termination workflow, such as missing HR-to-IT notifications or absent automated account-disable rules tied to HR status changes.

Periodic outbound HTTPS traffic combined with rotating IP resolutions points to domain generation algorithms, where malware cycles through algorithmically generated domains for command-and-control. The regular interval satisfies the beaconing constraint, while the shifting IP addresses reflect DGA domains resolving to changing infrastructure, distinguishing it from static command-and-control.

The security policy mandates proxy filtering, so bypassing it is not permitted. A documented exception based on verified business need preserves the policy while allowing the legitimate tools on their custom ports, satisfying the requirement to align with policy.

The /proc/1234/exe link points to the executable file of the process. A root-owned process running from /tmp/.hidden/backdoor is highly suspicious because /tmp is commonly used by attackers to drop and execute malware, and the hidden directory name suggests an attempt to avoid casual observation. This is a clear indicator of compromise.

Filtering and correlation rules suppress or group low-priority events and link related indicators into single meaningful alerts, directly reducing false positives. This raises the proportion of actionable alerts, so analysts can identify genuine threats instead of being overwhelmed by noise.

Encrypted IRC on port 6667 to a known malicious address indicates command-and-control beaconing. Legitimate IRC is rarely encrypted on that port, so the internal host is most likely a botnet member receiving instructions from its controller.

schtasks with /query lists scheduled tasks, /fo LIST selects a list format, and /v adds verbose details such as the task's action, trigger, author, and run-as account. This gives the analyst the full configuration needed to spot a malicious recurring task offline without clicking through the GUI.

This suppresses the alert for the specific benign traffic without affecting other detections.

Snort signatures are heuristic and prone to false positives, so corroborating with the web server's own access and error logs confirms whether the SQL injection payload actually reached the application and whether it succeeded, validating the alert against the specific external IP named in the stem.

ROP gadgets chained in a decoded payload indicate memory-corruption exploitation, where an attacker hijacks control flow to bypass DEP and execute code. The POST delivers the crafted chain, so the payload's purpose is exploitation rather than reconnaissance or exfiltration.

Normal ping payloads are typically small (e.g., 32 or 64 bytes) and often consist of a repeating pattern or timestamp. Large, varying payloads suggest that actual data is being carried inside the ICMP packets, which is the essence of ICMP tunneling. The consistent size and non-repetitive content further indicate a structured data transfer, supporting the conclusion of tunneling.

DDoS attacks aggregate traffic from many distributed hosts, often a botnet, to overwhelm the target's bandwidth or resources. This satisfies the volumetric constraint because the combined traffic from numerous sources exceeds what a single origin could generate.

HIPAA, the Health Insurance Portability and Accountability Act, sets the US legal requirements for safeguarding protected health information held by covered entities and their business associates. Its Privacy and Security Rules specifically govern electronic health records, matching the scenario's demand for a US health-data framework.

Checking whether the user has a legitimate business need directly addresses the low-reputation, newly registered domain indicator, which alone cannot confirm malicious intent. Frequent connections may reflect a compromised host or genuine research. Validating the requirement distinguishes true positives from benign activity before escalation, satisfying the need to confirm intent prior to containment.

Parameterized queries, also called prepared statements, separate SQL code from data by sending the query structure and parameters separately. The database treats parameters as data, not executable code, which prevents SQL injection even if the input contains malicious characters. This directly meets the requirement.

Correlating the alert against logs, endpoint telemetry and threat intelligence confirms whether the detection reflects genuine malicious activity or a false positive, preventing wasted escalation effort and establishing the factual basis needed before containment decisions.

Brute-force attacks generate many authentication failures across varied usernames and passwords within a short window, as the attacker guesses credentials. This volume and variety of failed SSH logins distinguishes it from a single mistyped password.

A worm self-replicates and propagates across networks autonomously, requiring no user interaction or host file, unlike viruses that need a carrier. This satisfies the stem's constraint of spreading without user action, and its rapid, uncontrolled replication consumes bandwidth, directly causing the network congestion described.

Pass-the-hash exploits the NTLM challenge-response protocol: the attacker captures the static NT hash and replays it directly, authenticating without ever cracking it to plaintext. This matches the stem's constraint of authentication using a hashed password rather than the cleartext credential.

DNS tunneling frequently uses TXT records because they can carry arbitrary data and are often permitted through firewalls. Long base64-encoded strings in TXT responses indicate that the DNS channel is transporting encoded payloads, which is a strong signal of command-and-control or exfiltration. Combined with the random subdomain pattern, this artifact directly confirms that data is being moved over DNS rather than merely resolved. Legitimate TXT records, such as SPF or DKIM, have structured formats and predictable lengths.

System authentication logs record login attempts against the underlying operating system, revealing repeated failed credential submissions from a single source. Correlating these timestamps with web activity exposes brute-force patterns targeting application accounts, satisfying the stem's requirement to identify the attack across multiple log sources.

Tier 1 analysts perform initial triage and basic investigation, validating the alert, gathering preliminary data, and escalating confirmed incidents. This matches the primary responsibility for a potential malware infection, as deeper forensics and remediation belong to Tier 2 or Tier 3.

More than ten failed logins from one source IP within a minute is rapid, repeated authentication failure, the defining pattern of brute-force attacks. The threshold and time window distinguish it from occasional user error or password spraying across many accounts.

Zeek's file extraction framework reconstructs files from HTTP sessions by reassembling stream data and writing payloads to disk, satisfying the requirement to extract transferred files from captured traffic. It handles MIME types and connection tracking natively, so no packet-level manual carving is needed.

A file hash such as MD5 is a concrete, machine-checkable artefact uniquely identifying known malicious files, making it a valid IoC. It satisfies the indicator requirement because hashes are observable, shareable and directly matchable against endpoint or sandbox telemetry.

Connections to IPs outside the CRM's known ranges break the expected traffic baseline, indicating command-and-control or exfiltration rather than legitimate cloud access. The periodic five-minute spikes already suggest beaconing, so unmatched destinations confirm compromise rather than benign CRM synchronisation.

A security baseline specifies the minimum acceptable security posture, giving a documented configuration standard against which systems are hardened and audited. This matches the stem's request for the baseline's purpose rather than a risk assessment or incident response function.

Slow scans spread probes over extended periods, keeping packet rates below threshold-based IDS and firewall detection windows. This low-and-slow timing evades signature and rate triggers, satisfying the evasion constraint by avoiding the volume spikes that perimeter monitoring relies on.

Memory contents — running processes, network connections, encryption keys — are volatile and lost on power-off. Capturing a live memory image preserves that evidence for analysis, whereas shutting the server down destroys it irrecoverably, so imaging should precede containment.

A high volume of DNS queries to one unusual domain signals tunnelling, where data is encoded into query names and smuggled out through the resolver. This satisfies the stem's DNS-based exfiltration indicator, since legitimate DNS traffic rarely concentrates on a single unfamiliar domain at volume.

Vulnerability scanning actively probes target systems with crafted packets to identify known weaknesses, generating detectable traffic that a firewall can block. This satisfies the stem's requirement to prevent active reconnaissance, since scanning directly interacts with the target rather than gathering data passively from public sources.

ICMP tunneling encapsulates data within ICMP echo request and reply packets, often using large payloads with high entropy to hide exfiltration or command-and-control traffic. The scenario describes large, non-ASCII, high-entropy payloads in both directions, which is a classic indicator. Normal ping traffic uses small, predictable payloads, so the unusual size and content strongly suggest tunneling.

The logs show the internal server initiating HTTP access to the router's management address, and the ACL denies it. That matches a blocked attempt to reach the router's web interface, not traffic passing through the router.

Sysinternals strings.exe is a widely used tool that extracts ASCII and Unicode strings from binary files. Running it from Command Prompt and searching for domain patterns is a standard, effective method for initial triage of a suspicious executable on Windows.

C&C communication is a hallmark of botnet activity.

A Data Protection Policy directly mandates encryption controls for sensitive customer data, covering both at-rest and in-transit states. It satisfies the stem's requirement by defining cryptographic safeguards as organisational policy, unlike access control or acceptable use policies that address authorisation and behaviour rather than encryption.

Full disk encryption renders the laptop's stored data unreadable without the decryption key, so a thief cannot extract files from the stolen drive. It satisfies the data-at-rest encryption requirement directly, unlike access controls or network-based protections that the attacker bypasses by possessing the device.

A dropper is code whose purpose is to install or download malware onto a target. The macro document fits this role: it executes on open and fetches a second-stage payload, establishing the infection. Classifying it as a dropper correctly describes its function in the attack chain rather than the payload it delivers.

Legacy applications lacking MFA support cannot enforce the policy directly, so a distinct policy with compensating controls—such as IP restrictions, conditional access in Microsoft Entra ID, or monitored app passwords—isolates their risk without weakening MFA enforcement elsewhere. This satisfies the audit finding while maintaining the remote-access security requirement.

This is correct because volatile data such as RAM contents and running processes are lost on reboot, so capturing memory and disk images first preserves critical evidence. Documenting the sequence maintains chain of custody. This approach balances the need to restore services with the legal requirement to preserve evidence, which the current policy fails to address.

Signatures with the 'OS-COMMAND' prefix in Cisco Firepower/SNORT rule sets are designed to detect attempts to execute operating system commands through an application, commonly via web request parameters. The traffic targeting port 80 on a web server strongly supports a command injection attempt, where an attacker tries to pass shell commands through an HTTP request to gain execution on the host.

This is the correct first action. The analyst should collect additional evidence (e.g., process lists, network connections, file system changes) to confirm the incident. Only after validation should escalation and containment occur, following the incident response plan.

Whitelisting known good traffic reduces false positives.

Volatile data such as active sockets, process listings, and loaded modules exists only while the system runs, so it must be captured first and written to external media to avoid altering the disk. Order of volatility dictates collecting the most perishable evidence earliest. Documenting the commands and timestamps maintains forensic integrity and supports later analysis.

ARP spoofing sends forged Address Resolution Protocol replies, binding the attacker's MAC address to a legitimate user's IP address within the victim's cache. This satisfies the stem's requirement for both MAC and IP impersonation, enabling traffic interception or man-in-the-middle positioning on the local subnet.

On Linux, user-specific cron jobs are stored per-account in /var/spool/cron/crontabs/, with one file per user. Inspecting this directory reveals unauthorised scheduled tasks created by individual accounts, which is exactly what the analyst needs to check.

TAXII defines the application-layer protocol and services for exchanging cyber threat intelligence over HTTPS, carrying STIX-formatted content between parties. It satisfies the ISAC sharing requirement by providing the transport mechanism, whereas STIX supplies the structured data format itself.

Multiplying likelihood (0.5) by impact ($200,000) yields $100,000, the quantitative risk value the analyst must report. This satisfies the stem's single-step calculation, giving the expected loss figure that feeds directly into the risk register and subsequent prioritisation decisions.

Task Scheduler exposes each task's triggers, actions, conditions and author, letting the analyst inspect exactly what the PowerShell script runs and when. Other tools show process or file artefacts but not the task definition itself.

ICMP tunneling abuses the data field of Echo Request and Echo Reply packets to carry arbitrary payloads. The non-repeating binary content and command-like strings in the Echo Request payload, combined with empty Echo Replies, indicate the host is sending data or receiving instructions inside ICMP rather than performing normal reachability checks.

The -Y flag applies a Wireshark display filter, which restricts which decoded packets tshark prints without altering what was captured. Capture filters, by contrast, use BPF syntax and discard traffic at collection time, so they cannot be applied to an already-saved pcap.

The pattern matches a SYN scan (also known as half-open scan), where the attacker sends SYN packets to multiple ports and does not complete the three-way handshake, allowing them to probe for open ports without establishing a full connection.

Exfiltration of database records to an external FTP endpoint fulfils the attacker's ultimate goal, so it maps to Actions on Objectives. Earlier phases cover reconnaissance, weaponisation, delivery, exploitation, installation and command-and-control; the actual theft of sensitive data is the final stage.

Lateral movement refers to the techniques an attacker uses to move through a network after initial compromise, seeking additional access and privileges. In this scenario, the attacker moved from the compromised web server to other systems, which is lateral movement. This phase often involves credential dumping, remote execution, and internal reconnaissance.

A high-level security policy articulates management's intent, direction and risk tolerance, giving lower-level standards, procedures and guidelines their authority. Cisco's framework treats this documented senior-management commitment as the foundational component from which all other policy artefacts derive.

Exploitation is the phase where the attacker leverages a vulnerability to gain access, such as exploiting a browser flaw when the user visits a malicious site. In this scenario, the malicious website exploits the browser vulnerability, which is the defining action of the Exploitation phase. This occurs after delivery and before installation of persistent malware.

Repeated DNS queries carrying base64-encoded labels in subdomains indicate data encoded into DNS requests, a hallmark of DNS tunnelling used to exfiltrate data covertly through permitted DNS traffic, bypassing egress controls that block other channels.

The signature fired on a string resembling SQL injection, but investigation confirmed the application is not vulnerable and the traffic was a benign test. The alert therefore correctly identified suspicious syntax yet wrongly indicated an actual attack, which is a false positive.

Risk quantifies the potential for a threat to exploit a vulnerability, combining the likelihood of that exploitation with the resulting business impact. This matches the stem's definition precisely, distinguishing it from a vulnerability or threat in isolation.

A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed sources, without completing the handshake. The server allocates resources for each half-open connection, exhausting its backlog queue. The scenario shows exactly this pattern: many SYNs to multiple ports, no completed handshakes, quickly overwhelming the web server's connection table.

TCP operates at Layer 4, where SYN floods exhaust the connection table by sending numerous half-open handshakes. The attack targets the transport-layer three-way handshake mechanism itself, so Layer 4 is the precise target rather than the application payload or network routing.

A write blocker enforces a hardware or software read-only mount, preventing any modification to the source drive during imaging. This preserves bit-for-bit integrity and maintains the chain of custody, satisfying the legal requirement that evidence remain unaltered and admissible in proceedings.

Fifty failed attempts followed by a success from the same IP indicates the attacker eventually guessed valid credentials, confirming a successful brute force. The preceding failures supply the attack signature, while the success shows compromise, making this entry highly suspicious.

The proxy already logs every outbound connection, so reviewing those records confirms the destination IP, timing, and user agent string associated with the port 443 traffic. This validates the exfiltration suspicion before deeper endpoint or packet analysis.

`tcp.stream eq 0` isolates every packet belonging to stream index 0, letting Wireshark reassemble the full bidirectional conversation regardless of ports or IP addresses. This satisfies the stem's requirement to follow the entire TCP stream, since stream indexing groups related segments that Follow TCP Stream also relies on.