How many Troubleshooting Scenario Questions questions are on this page?

This page has 13 Troubleshooting Scenario Questions scenario questions for the 200-201 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 200-201 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco CyberOps Associate 200-201 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Cisco CyberOps Associate 200-201 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

200-201

exam code

Cisco

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Full question →

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediummultiple choice

Full question →

Based on the exhibit, what action should the analyst take to further investigate this alert?

Exhibit

Refer to the exhibit.

[**] [1:2000002:3] ET MALWARE Possible Malicious Download [**]
[Priority: 2]
12/10/2023-10:45:23.456789 192.168.1.10:45678 -> 203.0.113.5:80
TCP TTL:64 TOS:0x0 ID:12345 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x12345678  Ack: 0x9ABCDEF0  Win: 0x2000  TcpLen: 20
[Xref => http://malware.example.com/samples/abc123]

A
Extract the URL from the alert and check the file hash.
The reference URL provides direct access to potential malware.
B
Search the PCAP for the same signature ID.
Why wrong: Searching for the same signature ID may not provide new information.
C
Perform a DNS lookup on the destination IP.
Why wrong: DNS lookup may not reveal malicious intent without additional context.
D
Check the firewall logs for any blocked connections.
Why wrong: Firewall logs may not contain the specific URL context.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?

A
Chain of Custody Procedure
Why wrong: Chain of custody documents evidence handling, not collection order.
B
Incident Response Procedure for evidence preservation
Immediate disconnection prevented capture of volatile data.
C
Forensic Analysis Procedure
Why wrong: Forensic analysis happens after acquisition.
D
Escalation Procedure
Why wrong: Escalation is about notifying stakeholders.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full NAT/PAT explanation →

MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?

A
Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process
This ensures integrity, authenticity, and proper chain of custody.
B
Export the logs to a CSV file and email them to the security team
Why wrong: Exporting may alter metadata and fails to preserve integrity.
C
Use a write-blocker to create a forensic image of the entire hard drive
Why wrong: While forensic, it's excessive for log collection and time-consuming.
D
Copy the audit logs to a USB drive and store it in a locked drawer
Why wrong: No integrity verification or chain of custody documentation.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A company's incident response policy defines four phases: Preparation, Detection & Analysis, Containment Eradication & Recovery, and Post-Incident Activity. During an active ransomware outbreak, the IR team is unable to contain the spread because the containment plan did not account for the malware's use of PowerShell for lateral movement. Which phase had a deficiency?

A
Containment Eradication & Recovery
Why wrong: The failure is due to lack of preparation.
B
None of the above
Why wrong: There is a clear deficiency.
C
Preparation
Preparation must anticipate attack vectors.
D
Post-Incident Activity
Why wrong: Not applicable during active incident.
E
Detection & Analysis
Why wrong: Detection may have worked, but containment failed.

Full breakdown with real-world context →

Question 6hardmulti select

Full question →

An analyst is examining the Windows Registry on a host suspected of persistence via a malicious service. Which two registry keys are most relevant to investigate?

A
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
This key lists all system services.
B
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Why wrong: RunOnce runs only once and is less common for persistent services.
C
HKEY_CLASSES_ROOT\exefile\shell\open\command
Why wrong: This key defines file associations, not service persistence.
D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
This key specifies programs that run at logon.
E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Why wrong: This key contains Windows NT settings, not directly service persistence.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

An analyst uses Wireshark to investigate a suspicious download. The TCP stream shows a GET request for a .exe file from an external IP, followed by a 200 OK response. The response contains the file but the last packet in the stream has a FIN flag set from the server. The client sends an ACK but then immediately sends a RST. What does this behavior suggest?

A
The client application crashed after receiving the file
Why wrong: Crash would likely not send a clean ACK then RST.
B
Normal completion of download
Why wrong: Normal completion does not include a RST after ACK.
C
The server is performing a delayed response
Why wrong: Server is not initiating the RST.
D
The client intentionally terminated the connection to evade detection
RST after receiving data can be used to avoid logging.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full NAT/PAT explanation →

A network analyst is troubleshooting a false positive alert from an IPS that blocks traffic to a legitimate database server. The alert signature is triggered by the pattern 'OR 1=1'. The analyst determines that the traffic is from a web application that uses dynamic SQL queries. Which action best reduces false positives while maintaining security?

A
Increase the sensitivity of the signature
Why wrong: Increasing sensitivity would cause more false positives.
B
Add the database server IP to an exception list
Whitelisting known good traffic reduces false positives.
C
Change the signature to alert-only mode
Why wrong: Alert-only stops blocking but still generates unnecessary alerts.
D
Disable the signature entirely
Why wrong: Disabling removes protection against real SQL injection.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full network assurance explanation →

A company uses syslog for logging from all network devices. The SOC notices that logs from a critical router are not appearing in the SIEM for the past hour, but other devices are sending logs normally. Which step should the analyst take FIRST to troubleshoot?

A
Ping the SIEM server from the router
Verifying network connectivity helps isolate if the issue is network or device related.
B
Restart the router syslog service
Why wrong: Restarting without cause may affect production.
C
Check the router logging configuration
Why wrong: Configuration check should follow connectivity verification.
D
Check the SIEM server's log receiver status
Why wrong: Since other devices are sending logs, the SIEM is likely working.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full network assurance explanation →

Refer to the exhibit. This syslog message is generated from a Cisco firewall. According to the security policy, all traffic from the 10.10.10.0/24 network to the internal 192.168.1.0/24 network must be denied except for HTTP traffic from specific IPs. Which of the following should be investigated?

Exhibit

Refer to the exhibit.
%SEC-6-IPACCESSLOGP: list OUTSIDE denied tcp 10.10.10.5(80) -> 192.168.1.10(49152) 1 packet

A
The packet was permitted but logged.
Why wrong: The message clearly says "denied", not permitted.
B
The packet was denied because it was HTTP traffic from 10.10.10.5.
Why wrong: The denial is what triggered the log, but it doesn't indicate an investigation point.
C
The destination IP 192.168.1.10 is compromised.
Why wrong: There is no evidence of compromise from this log.
D
The source IP 10.10.10.5 should be allowed to pass HTTP traffic.
This IP might be one that should be permitted per policy; its denial warrants investigation.

Full breakdown with real-world context →

Question 11easymultiple choice

Full question →

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

A
Manually check each file for suspicious extensions.
Why wrong: Manual inspection is not a substitute for automated scanning.
B
Remove the USB drive and use a different approved method of file transfer.
This complies with policy by avoiding an unscanned medium.
C
Disable write protection and rescan.
Why wrong: Write protection may be there for a reason; disabling it could allow malware to infect the USB.
D
Proceed with the file transfer since the scan failed due to hardware issue.
Why wrong: This directly violates the policy.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full wireless explanation →

A financial services company has a security policy that all remote access must be through VPN with two-factor authentication. An employee on a business trip uses a hotel Wi-Fi to connect to the corporate network but claims the VPN client was not working, so they used RDP directly over the internet to access their desktop. The employee's manager approved this as a temporary measure. The security team discovers this during a log review. The policy has no provision for temporary exceptions. What should be the security team's first action?

A
Investigate whether any data was compromised during the session.
Understanding the risk helps guide subsequent actions appropriately.
B
Report the violation to the security officer and recommend disciplinary action.
Why wrong: Reporting is important, but assessing compromise should come first.
C
Disable RDP access from the internet for all users immediately.
Why wrong: This could be a later step, but first understand the risk and impact.
D
Accept the manager's approval as sufficient authorization.
Why wrong: The policy dictates that no exceptions without formal process; manager approval is not enough.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full VPN explanation →

You are a security analyst at a mid-sized company. The company uses a SIEM to collect logs from firewalls, IDS, and servers. Recently, the SIEM generated an alert for a potential brute-force attack against the company's VPN server. The alert is based on a correlation rule that triggers when more than 30 failed authentication attempts from a single source IP occur within 10 minutes. You investigate and see that the source IP is 203.0.113.50, which is a known IP address of a partner company that uses the VPN for remote access. The failed attempts are all from the same username 'john.doe'. You also notice that the attempts are happening every 5 seconds, exactly 6 attempts per minute. The partner company has a policy that locks accounts after 3 failed attempts. Based on this scenario, what is the most likely cause of the alert?

A
The user 'john.doe' has forgotten his password and is repeatedly trying to log in.
Why wrong: A human would not attempt exactly every 5 seconds for 10 minutes; the regularity suggests automation.
B
A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.
The exact timing and same username point to a script; the lockout policy would lock the account after 3 attempts, but the script may be retrying from the same source, causing the SIEM alert before the lockout.
C
A man-in-the-middle attack is replaying captured authentication packets.
Why wrong: Replay attacks would likely succeed or cause different logs; the failed attempts indicate wrong credentials.
D
The partner's account 'john.doe' has been compromised and an attacker is attempting to gain access.
Why wrong: An attacker would likely try multiple usernames or succeed after a few attempts; the lockout policy would prevent 30 attempts from the same source.

Full breakdown with real-world context →

These 200-201 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 200-201 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Concepts practice questions

Security Monitoring practice questions

Host-Based Analysis practice questions

Network Intrusion Analysis practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Practice scenarios

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Based on the exhibit, what action should the analyst take to further investigate this alert?

Exhibit

During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?

An analyst is examining the Windows Registry on a host suspected of persistence via a malicious service. Which two registry keys are most relevant to investigate?

A company uses syslog for logging from all network devices. The SOC notices that logs from a critical router are not appearing in the SIEM for the past hour, but other devices are sending logs normally. Which step should the analyst take FIRST to troubleshoot?

Refer to the exhibit. This syslog message is generated from a Cisco firewall. According to the security policy, all traffic from the 10.10.10.0/24 network to the internal 192.168.1.0/24 network must be denied except for HTTP traffic from specific IPs. Which of the following should be investigated?

Exhibit