How many Troubleshooting Scenario Questions questions are on this page?

This page has 9 Troubleshooting Scenario Questions scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Cisco CyberOps Associate 200-201 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

A
Manually check each file for suspicious extensions.
Why wrong: Manual inspection is not a substitute for automated scanning.
B
Remove the USB drive and use a different approved method of file transfer.
This complies with policy by avoiding an unscanned medium.
C
Disable write protection and rescan.
Why wrong: Write protection may be there for a reason; disabling it could allow malware to infect the USB.
D
Proceed with the file transfer since the scan failed due to hardware issue.
Why wrong: This directly violates the policy.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)

A
Investigate alerts in the order they were received.
Why wrong: This is inefficient; priority should be based on risk, not chronological order.
B
Prioritize alerts based on severity and asset criticality.
High-severity alerts on critical assets should be investigated first.
C
Correlate alerts with known threat intelligence feeds to identify true positives.
Threat intel helps validate whether an alert matches known malicious activity.
D
Automatically close all low-severity alerts without review.
Why wrong: Low-severity alerts can still indicate lateral movement or recon; they should be reviewed periodically.
E
Group alerts by source IP to identify patterns like brute force or port scans.
Aggregating by source IP can reveal coordinated attacks from a single host.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?

A
ARP spoofing
Why wrong: ARP spoofing involves falsified MAC addresses, not traffic floods.
B
DoS
Why wrong: DoS comes from a single source, not multiple.
C
DNS poisoning
Why wrong: DNS poisoning corrupts DNS records, not direct flooding.
D
DDoS
Distributed Denial of Service uses many compromised devices.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

You are a security analyst at a medium-sized company. The company uses a SIEM that collects logs from firewalls, IDS/IPS, and endpoint detection and response (EDR) agents. You receive an alert that a user's workstation (IP 10.0.1.25) has been making outbound connections to an IP address (198.51.100.10) on port 4444 (commonly used by malware). The alert includes a SIEM correlation rule that triggered when three or more connections to that IP occurred within 5 minutes. You check the EDR logs and see that the workstation is running a process named 'svchost.exe' that is connecting to that IP. The process path is C:\Windows\system32\svchost.exe, which is legitimate. However, you notice that the process has a digital signature from 'Microsoft Corporation', but the signature date is from 2021. The workstation's operating system is Windows 10 22H2, fully patched as of last month. The user reports that they have been experiencing slow performance and occasional pop-ups. Which action should you take FIRST to investigate this potential compromise?

A
Perform a full system reimage of the workstation to ensure the malware is removed.
Why wrong: Reimaging should be a last resort after evidence collection; you need to confirm compromise first.
B
Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.
This can detect DLL sideloading or injection, which is a common technique.
C
Immediately block the outbound connection to 198.51.100.10 at the firewall and isolate the workstation from the network.
Why wrong: Isolation may be needed later, but first you should gather more evidence to confirm compromise.
D
Verify the digital signature of svchost.exe with Microsoft to ensure it has not been revoked.
Why wrong: The signature is valid and not revoked; but malware can use a legitimate signed file.

Full breakdown with real-world context →

Question 5easymulti select

Full question →

A Windows analyst uses Process Explorer to investigate parent-child relationships. Which TWO characteristics are commonly associated with malicious processes?

A
A parent process with a valid digital signature
Why wrong: Valid signatures are not malicious by themselves.
B
A process running from a user's Temp folder with a random name
Correct. Random names in Temp folders are often malicious.
C
A process with a long uptime and low CPU usage
Why wrong: This is not inherently suspicious.
D
A process chain where the parent is svchost.exe and child is explorer.exe
Why wrong: This is normal Windows behavior.
E
A child process spawned by a document reader (e.g., winword.exe spawning cmd.exe)
Correct. This is a common technique for code execution.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?

A
Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process
This ensures integrity, authenticity, and proper chain of custody.
B
Export the logs to a CSV file and email them to the security team
Why wrong: Exporting may alter metadata and fails to preserve integrity.
C
Use a write-blocker to create a forensic image of the entire hard drive
Why wrong: While forensic, it's excessive for log collection and time-consuming.
D
Copy the audit logs to a USB drive and store it in a locked drawer
Why wrong: No integrity verification or chain of custody documentation.

Full breakdown with real-world context →

Question 7hardmulti select

Full question →

An analyst is examining the Windows Registry on a host suspected of persistence via a malicious service. Which two registry keys are most relevant to investigate?

A
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
This key lists all system services.
B
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Why wrong: RunOnce runs only once and is less common for persistent services.
C
HKEY_CLASSES_ROOT\exefile\shell\open\command
Why wrong: This key defines file associations, not service persistence.
D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
This key specifies programs that run at logon.
E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Why wrong: This key contains Windows NT settings, not directly service persistence.

Full breakdown with real-world context →

Question 8mediumdrag order

Full question →

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

A
Step 1: Identify, Step 2: Collect, Step 3: Analyze, Step 4: Contain, Step 5: Document
This order follows the standard incident response process: first identify the incident, then collect relevant data, analyze the data to understand the scope, contain the threat to prevent further damage, and finally document everything for future reference and compliance.
B
Step 1: Collect, Step 2: Identify, Step 3: Analyze, Step 4: Contain, Step 5: Document
Why wrong: Collecting data before identifying the incident is inefficient and may lead to collecting irrelevant data, wasting time and resources. Identification must come first to focus the investigation.
C
Step 1: Identify, Step 2: Analyze, Step 3: Collect, Step 4: Contain, Step 5: Document
Why wrong: Analyzing before collecting data is impossible because analysis requires data to examine. Data must be collected before it can be analyzed.
D
Step 1: Identify, Step 2: Collect, Step 3: Contain, Step 4: Analyze, Step 5: Document
Why wrong: Containing the threat before analyzing it may cause premature actions that miss important evidence or worsen the incident. Analysis should occur before containment to make informed decisions.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

Based on the exhibit, what action should the analyst take to further investigate this alert?

Exhibit

Refer to the exhibit.

[**] [1:2000002:3] ET MALWARE Possible Malicious Download [**]
[Priority: 2]
12/10/2023-10:45:23.456789 192.168.1.10:45678 -> 203.0.113.5:80
TCP TTL:64 TOS:0x0 ID:12345 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x12345678  Ack: 0x9ABCDEF0  Win: 0x2000  TcpLen: 20
[Xref => http://malware.example.com/samples/abc123]

A
Extract the URL from the alert and check the file hash.
The reference URL provides direct access to potential malware.
B
Search the PCAP for the same signature ID.
Why wrong: Searching for the same signature ID may not provide new information.
C
Perform a DNS lookup on the destination IP.
Why wrong: DNS lookup may not reveal malicious intent without additional context.
D
Check the firewall logs for any blocked connections.
Why wrong: Firewall logs may not contain the specific URL context.

Full breakdown with real-world context →

These 200-201 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-201 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Monitoring practice questions

Network Intrusion Analysis practice questions

Host-Based Analysis practice questions

Security Concepts practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)

A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?

A Windows analyst uses Process Explorer to investigate parent-child relationships. Which TWO characteristics are commonly associated with malicious processes?

An analyst is examining the Windows Registry on a host suspected of persistence via a malicious service. Which two registry keys are most relevant to investigate?

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Based on the exhibit, what action should the analyst take to further investigate this alert?

Exhibit