Match each Cisco CyberOps concept to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Security Operations Center
Confidentiality, Integrity, Availability
Indicator of Compromise
Tactics, Techniques, and Procedures
Adversary, Capability, Infrastructure, Victim
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
IoC: Evidence that suggests a potential security incident or intrusion.
The correct matches are: IoC = evidence of intrusion, SIEM = log aggregation and analysis system, IPS = traffic monitoring and blocking device. Common confusions include swapping definitions between similar-sounding terms or confusing tools with indicators.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
IoC: Evidence that suggests a potential security incident or intrusion.
Why this is correct
Indicators of Compromise (IoCs) are pieces of evidence that indicate a security breach has occurred or is in progress.
SIEM: A system that collects and analyzes log data from multiple sources to detect security events.
Why this is correct
Security Information and Event Management (SIEM) systems aggregate logs from various devices and applications to provide real-time analysis and alerting.
IPS: A device that monitors network traffic for malicious activity and can block it in real-time.
Why this is correct
An Intrusion Prevention System (IPS) actively inspects traffic and can drop or block packets that match known attack signatures.
IoC: A system that aggregates logs for analysis.
Why it's wrong here
This describes a SIEM, not an IoC. IoCs are indicators, not systems.
SIEM: Evidence of compromise.
Why it's wrong here
Evidence of compromise is an IoC, not a SIEM. SIEM is a tool that processes logs.
IPS: A device that translates private IP addresses to public.
Why it's wrong here
This describes Network Address Translation (NAT), not an IPS. IPS focuses on threat prevention.
Go deeper
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.