How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Cisco CyberOps Associate 200-201 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

A
Successful authentication event
The success after failures indicates the attacker gained access.
B
Privilege escalation event
Escalation after login is a common step to gain higher privileges.
C
Failed authentication events
Multiple failures suggest a brute-force attempt.
D
Network share access event
Why wrong: Share access may be lateral movement but not directly correlated with the initial compromise.
E
Account creation event
Why wrong: Account creation is for persistence, not necessarily part of the initial compromise sequence.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Monitoring practice questions

Network Intrusion Analysis practice questions

Host-Based Analysis practice questions

Security Concepts practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

A security analyst is investigating a PCAP that shows multiple failed SMB authentication attempts from a single host to different IP addresses, followed by a successful authentication. Which TWO techniques are likely being used?

A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)

Which TWO of the following are key components of a security policy? (Choose two.)

Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?

An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Which two Sysmon Event IDs are most commonly associated with code injection techniques?

An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)

A security analyst is creating a network baseline for normal traffic patterns. Which TWO metrics should be included to detect anomalies?

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Which THREE factors should be considered when tuning an IPS signature? (Choose three.)

Which THREE of the following are indicators that a network may be compromised by a botnet?

Which TWO of the following are typically included in a security policy's scope statement?

Which TWO of the following are best practices when configuring a SIEM for security monitoring?

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Which THREE of the following are key elements of a security monitoring and analysis strategy? (Choose three.)

A security analyst is examining system logs for signs of privilege escalation. Which THREE events are most relevant to detect such activity?

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)