Courseiva
← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Cisco CyberOps Associate 200-201 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
200-201
exam code
Cisco
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related 200-201 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Security Policies and Procedures practice questions

Security Policies and Procedures practice questions for 200-201.

Security Monitoring practice questions

Sharpen your 200-201 knowledge of Security Monitoring.

Network Intrusion Analysis practice questions

Practise 200-201 questions linked to Network Intrusion Analysis.

Host-Based Analysis practice questions

Work through 200-201 questions on Host-Based Analysis.

Security Concepts practice questions

Work through 200-201 questions on Security Concepts.

200-201 fundamentals practice questions

Sharpen your 200-201 knowledge of 200-201 fundamentals.

200-201 scenario practice questions

Practise 200-201 questions linked to 200-201 scenario.

200-201 troubleshooting practice questions

Targeted 200-201 practice covering 200-201 troubleshooting.

Practice set

Practice scenarios

Question 1hardmultiple choice
Full question →

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Exhibit

Refer to the exhibit.

C:\Users\Admin> tasklist /svc
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                    1236 BrokerInfrastructure, DcomLaunch, PlugPlay
svchost.exe                    1420 RpcSs, LanmanWorkstation, Dhcp, NlaSvc
svchost.exe                    1508 WpnService, WpnUserService
notepad.exe                    2344 N/A
cmd.exe                        2568 N/A
powershell.exe                 2792 N/A

C:\Users\Admin> netstat -anob | findstr 192.168.1.50
  TCP    192.168.1.100:49152    192.168.1.50:443    ESTABLISHED     2792
  TCP    192.168.1.100:49153    192.168.1.50:80     ESTABLISHED     1420
Question 2hardmultiple choice
Study the full ACL explanation →

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Exhibit

Refer to the exhibit.

```
Router# show ip access-list EXTENDED_FILTER
Extended IP access list EXTENDED_FILTER
    10 permit tcp 10.1.1.0 0.0.0.255 any eq 22
    20 permit tcp 10.1.2.0 0.0.0.255 any eq 22
    30 deny tcp any any eq 22
    40 permit ip any any
```
Question 3mediummultiple choice
Review the full routing breakdown →

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Exhibit

Building configuration...
Current configuration : 2345 bytes
!
interface GigabitEthernet0/1
 description Internal Network
 ip address 192.168.1.1 255.255.255.0
 no ip redirects
 no ip proxy-arp
 ip access-group INBOUND in
!
ip access-list extended INBOUND
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any
Question 4mediummultiple choice
Full question →

Based on the exhibit, what is the most likely conclusion about the host's security state?

Exhibit

Refer to the exhibit.

From a Windows host, the analyst runs:
C:\> netstat -ano | findstr 4444

Output:
TCP    192.168.1.100:49201    203.0.113.5:4444      ESTABLISHED     1234
UDP    0.0.0.0:4444            *:*                                    5678

The analyst also runs:
C:\> tasklist | findstr 1234
cmd.exe                      1234 Console                 1     2,048 K
C:\> tasklist | findstr 5678
svchost.exe                  5678 Services                0     1,024 K
Question 5easymultiple choice
Full question →

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Exhibit

Refer to the exhibit.
```
{
  "event": "Process Creation",
  "timestamp": "2024-08-01T10:00:00Z",
  "hostname": "DESKTOP-ABC123",
  "user": "jsmith",
  "process": "C:\\Users\\jsmith\\Downloads\\invoice.exe",
  "parent_process": "C:\\Windows\\explorer.exe"
}
```
Question 6easymultiple choice
Full question →

A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.

Question 7easymultiple choice
Full question →

Refer to the exhibit. An ASA security policy is configured as shown. A user from the internet tries to access 192.168.1.5 via HTTP. What will happen?

Exhibit

Refer to the exhibit.
```
object network INSIDE_SUBNET
 subnet 192.168.1.0 255.255.255.0
object network WEB_SERVER
 host 10.0.0.10
access-list OUTSIDE_IN extended permit tcp any object WEB_SERVER eq 80
access-list OUTSIDE_IN extended deny ip any any
```
Question 8hardmultiple choice
Full question →

Refer to the exhibit. Based on the intrusion event, what is the likely intent of the traffic?

Exhibit

Event: 1
Timestamp: 2023-04-10 14:23:45
Source IP: 10.0.1.5
Destination IP: 192.168.1.100
Signature: "SHELLCODE x86 NOOP Unspecified"
Classification: Attempted Administrator Privilege Gain
Priority: 1
Action: Alert
Question 9easymultiple choice
Full question →

Refer to the exhibit. An analyst sees repeated ICMP echo requests from a host to the broadcast address. What is this an example of?

Exhibit

Refer to the exhibit.

Event: 1
Timestamp: 2023-10-01 08:00:00
Src IP: 10.0.0.1 -> Dst IP: 10.0.0.255
Protocol: ICMP
Type: 8 (Echo Request)

Event: 2
Timestamp: 2023-10-01 08:00:01
Src IP: 10.0.0.1 -> Dst IP: 10.0.0.255
Protocol: ICMP
Type: 8 (Echo Request)

Event: 3
Timestamp: 2023-10-01 08:00:02
Src IP: 10.0.0.1 -> Dst IP: 10.0.0.255
Protocol: ICMP
Type: 8 (Echo Request)
Question 10hardmulti select
Full question →

A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?

Exhibit

Refer to the exhibit.

```
Event: Firewall log entry
Time: 2023-10-05 14:23:45
Source IP: 192.168.1.50
Destination IP: 203.0.113.5
Source Port: 49152
Destination Port: 443
Protocol: TCP
Action: ALLOW
Bytes: 1452
Flags: ACK
```
Question 11mediummultiple choice
Study the full AAA explanation →

Refer to the exhibit. An administrator configured AAA on a Cisco router. What is the expected outcome when a user tries to access privileged EXEC mode (enable) with the username 'admin' and password 'cisco123'?

Exhibit

aaa new-model
aaa authentication login default local-case
aaa authentication enable default enable
aaa authorization exec default local
username admin secret cisco123
Question 12mediummultiple choice
Full question →

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Exhibit

Refer to the exhibit.

Mar  1 10:15:22 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49152) -> 10.0.0.1(23), 1 packet
Mar  1 10:15:23 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49153) -> 10.0.0.1(23), 1 packet
Mar  1 10:15:24 host1 syslog: [CISCO] %SEC-6-IPACCESSLOGP: list inbound denied tcp 10.0.0.2(49154) -> 10.0.0.1(23), 1 packet
Question 13easymultiple choice
Full question →

Refer to the exhibit. What type of activity does this log represent?

Exhibit

Sep 10 12:34:56: %SEC-6-IPACCESSLOGP: list 100 denied tcp 10.0.0.1(1234) -> 192.168.1.1(22), 1 packet
Sep 10 12:34:57: %SEC-6-IPACCESSLOGP: list 100 denied tcp 10.0.0.1(1235) -> 192.168.1.1(22), 1 packet
Sep 10 12:34:58: %SEC-6-IPACCESSLOGP: list 100 denied tcp 10.0.0.1(1236) -> 192.168.1.1(22), 1 packet
Question 14easymultiple choice
Study the full ACL explanation →

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Exhibit

Refer to the exhibit.

```
interface GigabitEthernet0/0
 ip access-group BLOCK_P2P in
!
ip access-list extended BLOCK_P2P
 deny tcp any any eq 6881 6889
 deny udp any any range 6881 6889
 permit ip any any
```
Question 15hardmultiple choice
Full question →

Based on the exhibit, what condition triggers an alert?

Exhibit

Refer to the exhibit.
{
  "policy": "DNS Anomaly Detection",
  "rule": {
    "protocol": "udp",
    "port": 53,
    "threshold": 1000,
    "window": 60,
    "action": "alert"
  }
}

These 200-201 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-201 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.