How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Cisco CyberOps Associate 200-201 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymulti select

Full question →

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

A
A low level of network utilization on the target server
Why wrong: DoS attacks increase utilization, not decrease.
B
A gradual increase in traffic from multiple geographic locations
Why wrong: This may be normal traffic growth or a marketing campaign.
C
A high number of DNS queries from diverse source IPs
Why wrong: This could be a DDoS, but the question asks for DoS (single source).
D
A sudden increase in traffic from a single source IP address
This indicates a potential DoS attack from that IP.
E
A large number of incomplete TCP connections (SYN packets without ACK)
This is characteristic of a SYN flood DoS attack.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Concepts practice questions

Security Monitoring practice questions

Host-Based Analysis practice questions

Network Intrusion Analysis practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Which TWO types of network traffic should be analyzed to detect a data exfiltration attempt via HTTP? (Choose two.)

Which TWO of the following are valid reasons to create an exception to a security policy? (Choose two.)

Which TWO of the following are typically included in a security policy's scope statement?

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Exhibit

Which TWO of the following are essential components of an effective security policy framework according to Cisco best practices?

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Which TWO are goals of a security operations center (SOC)? (Choose two.)

Which TWO security concepts are fundamental to the principle of least privilege? (Choose two.)

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Which TWO are common indicators of a compromised host? (Choose two.)

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Which THREE are essential components of a security monitoring strategy? (Choose three.)

Which TWO network behaviors suggest an ARP spoofing attack is occurring? (Choose two.)

Which THREE indicators are commonly found in network traffic that suggest a host is part of a botnet? (Choose three.)