How should I use these Network Intrusion Analysis practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Network Intrusion Analysis questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Network Intrusion Analysis domain.

200-201 · topic practice

Network Intrusion Analysis practice questions

Practise Cisco CyberOps Associate 200-201 Network Intrusion Analysis practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Network Intrusion Analysis

Practice 10 questions Browse domain →

What the exam tests

What to know about Network Intrusion Analysis

Network Intrusion Analysis questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Network Intrusion Analysis exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Network Intrusion Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Network Intrusion Analysis explanation →

An analyst identifies an alert for 'ET TROJAN Win32/DarkComet RAT Beacon'. The analyst confirms the host is infected. Which THREE phases of the Cyber Kill Chain have been completed prior to this C2 beacon? (Choose three.)

Trap 1: Weaponisation

Weaponization occurs before Delivery, but the question asks for phases completed prior to C2 beacon, and Weaponization is typically earlier. While it is completed, it is not one of the two specifically identified as correct here.

Trap 2: Reconnaissance

Reconnaissance is an earlier phase, but it is not one of the phases directly preceding C2 in the context of this question.

Study all Network Intrusion Analysis common traps →

A
Installation
Installation is a distinct phase that occurs after Exploitation and before C2. The attacker installs the malware on the target system, which is necessary for establishing C2.
B
Weaponisation
Why wrong: Weaponization occurs before Delivery, but the question asks for phases completed prior to C2 beacon, and Weaponization is typically earlier. While it is completed, it is not one of the two specifically identified as correct here.
C
Reconnaissance
Why wrong: Reconnaissance is an earlier phase, but it is not one of the phases directly preceding C2 in the context of this question.
D
Exploitation
Exploitation is the phase where the vulnerability is triggered to deliver the malware, and it is necessary before installation and C2.
E
Delivery
Delivery is the phase where the malware is transferred to the target, which is essential before exploitation and installation.

Network Intrusion Analysis practice questions

What to know about Network Intrusion Analysis

Common Network Intrusion Analysis exam traps

Network Intrusion Analysis questions

An analyst identifies an alert for 'ET TROJAN Win32/DarkComet RAT Beacon'. The analyst confirms the host is infected. Which THREE phases of the Cyber Kill Chain have been completed prior to this C2 beacon? (Choose three.)

During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?

During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?

An analyst is investigating lateral movement and observes SMB authentication attempts from host A to multiple other hosts using NTLM authentication with a hash value instead of a password. Which attack technique is most likely being used?

A network analyst is examining a PCAP file and applies the Wireshark display filter 'http.request'. The results show several POST requests to '/login.php' with parameters containing 'username=admin&password=secret'. What type of attack is indicated?

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

An analyst detects a large outbound FTP transfer from a sensitive server to an external IP address not previously seen. The file being transferred is a compressed archive containing database dumps. Which Cyber Kill Chain phase is most directly indicated?

A security analyst is reviewing PCAP data and sees a TCP stream with interactive shell commands such as 'whoami', 'ls -la', and 'cat /etc/passwd'. The session appears to be bidirectional with a remote IP. Which type of attack is most likely occurring?

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

A security analyst is investigating a suspected data exfiltration incident. Which TWO of the following indicators are most consistent with exfiltration over DNS?

An analyst is analyzing a PCAP from a compromised host. Which THREE of the following are common indicators of exploitation attempts in network traffic?

An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?

A security analyst observes repeated ICMP port unreachable responses from a target host. The source IP is sending packets to multiple UDP ports. Which type of scan is most likely being performed?

During an intrusion analysis, a SOC analyst reviews logs showing an outbound connection from an internal host to an external IP at 03:00 AM every 60 seconds. The traffic is HTTPS to a suspicious domain with a high entropy name. Which phase of the Cyber Kill Chain does this activity represent?

An analyst is reviewing alerts from an IDS. A signature matched 'script' and 'alert' in HTTP request parameters. The analyst inspects the packet and sees <script>alert('XSS')</script> in the URI. What is the most accurate classification of this alert?

In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?

Track your progress over time

Start a Network Intrusion Analysis only practice session

Related 200-201 topic practice pages

Security Policies and Procedures practice questions

Security Monitoring practice questions

Network Intrusion Analysis practice questions

Host-Based Analysis practice questions

Security Concepts practice questions

200-201 fundamentals practice questions

200-201 scenario practice questions

200-201 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid