200-201 practice questions
Cisco · 200-201 · 300 questions
Original practice questions for the Understanding Cisco Cybersecurity Operations Fundamentals exam, covering every domain of the official exam objectives.
This course contains the use of artificial intelligence.
About the 200-201 exam
- Questions
- not published
- Passing score
- not published
- Format
- 120 minutes, English. Question count and passing score are not published.
Schedule this exam The certification this earns
Exam details published by the vendor, checked 8 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Security Concepts (20%) · 60 questions
- A university security team inventories laptop software by logging in remotely and looking around the host. Laptops that stay off campus for weeks never appear in those results. What deployment gap explains the missing laptops?
- At a SaaS company, a SQL injection reaches the billing application even though the network firewall allows only HTTPS to that host. Which deployment would see the injection in the request?
- At a retailer, the team encrypts card files at rest and also stores a separate hash of each file. What is that separate hash for?
- At a hospital, a shared clinic PC still shows the previous patient's full chart when the next clinician sits down. Nothing in the chart was rewritten, and the chart system answers normally. Which CIA pillar failed?
- At a bank, a wire file arrives with a hash that no longer matches the hash the sender published, and the transfer service is still accepting files. Which CIA pillar failed?
- At a manufacturer, the plant historian is powered on, yet operators cannot open it during the shift because the service refuses connections. Which CIA pillar failed?
- At a retailer, one store server is mining while it exchanges traffic only with a second store server. That east-west conversation stays on the store LAN and never crosses the internet firewall. Which deployment can still observe that pair?
- An agency SOC is comparing products that keep logs searchable, correlate events into alerts, or execute response steps. Which description is the SIEM?
- At a SaaS company, the cloud console records who called the storage API, and a guest agent shows a process reading files inside a workload. Which record shows who changed a bucket policy?
- At a hotel, classic antivirus quarantines a file whose hash sits on a known-bad list and stays silent when a trusted admin tool starts behaving like a stealer. What is that classic product doing?
- A manufacturer threat report names a criminal group, the malware family that group sends, and the servers that group rents, and it lists the plant public website as a targeted asset. Which element is the threat actor?
- Analysts at an MSSP want a stored playbook to enrich an alert, open a ticket, and block an address without a person clicking each step. Which platform runs that playbook?
- At a logistics hub, a documented set of steps disables a stolen account and notifies the warehouse lead, and a tool executes those steps without an analyst typing each one. Which term names that arrangement?
- A university researcher disassembles a malware sample to learn how one function decrypts the sample configuration. Which term names that work?
- At a bank, a container that handled one payment was gone before the nightly host scan, and its overlay traffic never appeared on the physical switch. What visibility problem does that show?
- A criminal crew is known to send password-reset lures to a bank's staff, and no such lure has arrived today. What is that crew in this description?
- An MSSP decorates customer alerts with a feed of adversary addresses and malware hashes. Which term names that feed and the way it is being used?
- At a bank, no alert has fired, yet an analyst searches authentication logs for a rare remote tool that recently compromised a peer institution. Which term names that search?
- At a hospital, a suspicious email attachment is opened inside a disposable virtual machine so the analyst can watch the files it creates and the connections it makes. Which term names that work?
- At a hotel, one team reads an external report about a campaign while another team searches hotel logs for the behavior described in that report. Which team is threat hunting?
- At a manufacturer, an internet-facing historian still runs a service the vendor no longer fixes, and nobody has attacked that service this week. What is that unfixed service?
- At an agency, the team interviews system owners, lists weaknesses, and rates those weaknesses before anyone buys a tool. What is that activity called?
- At a hospital, the perimeter firewall blocked a network scan, yet ransomware still started from a phishing attachment opened on a ward PC. What does defense in depth say about that outcome?
- At a bank, the edge firewall, the mail filter, the endpoint agent, and the offline backups are all in place so one miss is not the whole loss. Which principle does that arrangement illustrate?
- A retailer compares the last hour of DNS query volume at one store with the previous hour at that same store, rather than with one fixed count. Which term names that comparison?
- Before a SaaS company builds a new billing feature, the team lists ways an attacker could tamper with the payment call. Which term names that design-time work?
- At a bank, dependency checks and secret checks run in the build pipeline and block the deploy whenever a check fails. What term names that practice?
- At an agency, a file carries a sensitivity label, and the system refuses a copy onto a lower label even after the file owner requests the copy. Which access model enforces the refusal?
- At a bank, tellers cannot grant one another wire-transfer rights, and only a central policy tied to the job grants those rights. Which access-model family is in use?
- A retailer tracks two flaws that share one severity label. One is reachable on the card-processing network, and the other sits on a lab PC that stores no payment data. What should change how the team ranks these two findings?
- At a hospital, the clinical VLAN is cut off from guest Wi-Fi. The same unpatched device is still flawed, yet it is much harder to reach from that guest network. What changed?
- At a university, a student signs in with a correct password, the payroll portal still refuses that account, and the identity system records the refusal. Which missing piece of this access sequence is authorization?
- At a university, a public proof-of-concept script gains a shell on an unpatched lab server. What is that script?
- At a SaaS company, the identity system records who connected, the source they used, and the API they called, and it writes that record only after the call has already been allowed. Which AAA function is that record?
- At an agency, the owner of a project folder adds a coworker to the folder, and no central office changes a sensitivity label. Which access model allows that owner decision?
- At a bank, the teller job name is not enough to open a drawer: policy also requires the matching branch attribute, a managed device, and business hours. Which access model is this?
- At a hospital, two clinicians share one role, yet only the clinician who is on the hospital network and also holds a privileged attribute may export records. Why is role-based access alone the wrong description of this rule?
- A planner at a logistics hub wants to purchase a single security product whose brochure calls that product the entire defense-in-depth strategy. What should the security lead say is the accurate correction?
- A retailer stacks three identical firewalls in a row on the path to the internet, and every firewall allows the same outbound port that a known malware family uses. Which statement best explains why this is a weak reading of defense in depth?
- At a hotel, front-desk accounts can open the reservation system during the scheduled shift and are refused when those same accounts try again at midnight. Which access model explains the refusal?
- At a manufacturer, the plant firewall permits a host to reach a port only when the packet matches an if-then list, and the decision does not consult a user role. Which access model is this?
- At a retailer, cashiers receive the register role and nothing beyond it, and moving someone to supervisor replaces that role instead of editing dozens of separate permissions. Which access model is this?
- At a SaaS company, a flaw in a shared library lets an attacker change data outside the vulnerable component. Which CVSS v3.1 base metric names that escape?
- At a retailer, a store-portal flaw does nothing until a clerk clicks a link in a message. Which CVSS v3.1 base metric records that a person must act before the flaw can run?
- At an MSSP, public exploit code appears for a bug whose published CVSS v3.1 base score has not changed. Which metric family is the one that moves with that new code?
- A university lab host that usually makes short DNS lookups starts a long run of queries with high-entropy names. What should the analyst suspect?
- At a bank, one write-up says a bug can be triggered from the internet, and another says the same bug can be triggered only from a local login on the host. Which CVSS v3.1 base metric changed?
- At a university, one bug can be exploited only by an already-logged-in admin, and another bug on the same kind of host needs no account at all. Which CVSS v3.1 metric differs between them?
- At a manufacturer, a bug works only when a rare timing window is hit. Which CVSS v3.1 metric does that rare condition raise?
- At a logistics hub, the label printer normally has a flat small-flow profile and suddenly matches the file server's outbound pattern. Which host should the analyst pull first?
- After closing, a retailer store PC that usually talks only to two payment hosts starts a large steady flow to a new address. What does that traffic profile suggest?
- A hotel has no file hash for a new tool. The front-desk PC starts a process that has never run there and opens a rare outbound port. Which detection fits this lead?
- An agency threat feed publishes a known-bad hash for a loader already seen in the sector. Which detection should the SOC write first for that hash?
- An MSSP customer complains that a new month-end upload tripped a volume alert, and the follow-up found no malware. What tradeoff should the analyst explain to the customer?
- At a bank, a network sensor stores the TLS handshake and the endpoint addresses but cannot read the file that was transferred. Which visibility challenge does that record show?
- A SaaS company can inspect its guest operating systems in the provider cloud but has no access to the hypervisor logs the provider keeps. What visibility gap does that boundary describe?
- At a hotel, a server has no agent, the only clue is a firewall allow, and the process that ran is unknown. Which visibility gap does that leave?
- At a manufacturer, grouped logs show every workstation querying the same internal DNS address. One workstation also opens TCP port 445 to many plant servers. Which set of tuples is the compromise lead?
- At a bank, two recorded flows use the same source IP address and the same destination IP address. One flow is TCP to port 443 and the other is TCP to port 22. Which 5-tuple field separates the two flows?
- Hospital connection logs show many lines that share one source address, use varying destinations, destination port 443, and TCP, while other sources appear once. How does the 5-tuple isolate the host to inspect?
Security Monitoring (25%) · 75 questions
- At a retailer, staff close an unused remote-desktop port on the registers, while a missing patch remains on the file server. What did closing that port reduce?
- At a bank, the internet-facing VPN appliance is powered on and reachable from outside the bank, and no specific software flaw has been named. What is that exposure called?
- At a hospital, the imaging server cannot be reached from the guest network, and that server still runs an unpatched service. Which statement is the vulnerability?
- At a manufacturer, an analyst needs the payload bytes of one plant-floor transfer, not a summary of the conversation. Which source contains those bytes?
- At a hotel, a firewall log shows an allowed TCP session from a guest laptop to port 443 and says nothing about the website or the application. Which source produces a record limited to that connection?
- At a logistics hub, a record shows source, destination, ports, packet counts, and byte counts, and it contains no URL and no file contents. Which source type is that record?
- At a university, a lab page lists every URL the research portal accepts, and a separate note says one parameter is not sanitized. Which statement describes the vulnerability?
- At a bank, a log names the application, the user, and an intrusion verdict, in addition to the port. Which technology produced that log?
- Engineers at a SaaS company can name the application on a flow even when the traffic uses a port that is not the well-known port for that application. Which technology supplies the application name?
- A retailer is comparing a new next-generation firewall with the older stateful firewall already in the store. What does the next-generation firewall add that the older one does not already provide?
- A hospital analyst has three records for three different questions: a packet capture, an exported flow record, and a mail-filter verdict. Which record can recover a file from an unencrypted download?
- At an agency, a workstation browsed a site and the only saved record is a web-filter line that contains the URL and a category. What can that saved line not show?
- An agency record shows the sender, the recipient, the attachment name, and a phishing verdict. Which source produced that record?
- A university report lists a URL category and states whether the campus filter allowed the request. Which source produces a report in that form?
- An MSSP customer wants byte counts for a conversation that ended yesterday, and nobody saved the packets. Which source can still show those counts?
- A retailer kept the full packet capture for a checkout session, and the file body inside that session is unreadable while the session uses TLS. What is the monitoring impact?
- Hotel firewall logs on the outside show one public address in use by many front-desk PCs at the same time. What is required to name the specific inside PC for one of those sessions?
- A manufacturer wants the category of a website that a plant workstation requested, and the team does not need a copy of the packets. Which source holds that category?
- An agency workstation sends its web browsing into an anonymity overlay, and the local proxy log records only the first hop into that overlay. Which technology accounts for that limited record?
- At a bank, a sensor inside the data center never sees scan packets that the edge access list drops before they enter the data center. What visibility impact does that filtering have?
- At a university, traffic that looks like DNS carries a second protocol inside it, and the intrusion-detection rule for that inner protocol never fires. What is the visibility impact?
- The same bank transfer appears as four summary lines in one monitoring note. Which line describes the impact of NAT rather than the impact of encryption?
- At a logistics hub, a GRE-style wrapper carries an inner conversation whose addresses are not the addresses on the outer header a sensor indexed. What is the monitoring impact?
- At a SaaS company, one client session is split across several web servers, and any single server log is missing most of the URLs from that session. What is the monitoring impact?
- At an MSSP, a customer ACL log shows denies, and the IDS placed behind that ACL has no events for the same traffic. What is the correct reading of those two records?
- At a university, student traffic is wrapped in an extra IP header before it leaves a research tunnel, and the outside sensor shows a tunnel address rather than the student's address. What visibility impact explains that result?
- At a manufacturer, two hosts exchange files with a peer-to-peer protocol, and those transfers never appear in the web proxy log. Why is the web proxy the wrong place to look?
- At a hospital, legal staff need the contents of an unencrypted file that a workstation downloaded. Which data type should the analyst retrieve to supply those contents?
- Leadership at a logistics hub wants to know whether tonight's outbound volume is unusual for that site. Which data type answers the question?
- At a retailer, an analyst needs only who talked to whom, when they talked, and how many bytes moved, for one flow from last week. Which data type answers that request?
- An agency record lists a file hash, a file size, and the mailbox that sent the file, and the record does not include the file body. What data type is that record?
- At a university, an analyst needs the DNS name that was queried and the answer code that came back, not the packets surrounding the lookup. Which data type supplies those two fields?
- At a bank, a monitoring tool has already decided that one flow matches a known beacon and has attached a signature name to that decision. Which type of security data is this record?
- At a manufacturer, the plant has an alert that a signature fired on one flow, and no packets were saved for that flow. What can that alert not answer?
- An MSSP customer forwards only alerts and does not include session records. Which question can those alerts answer that session data cannot answer on its own?
- At a retailer, one host sends a huge number of TCP SYN packets to the payment server, and legitimate clients can no longer complete a connection. Which attack class fits this traffic?
- At a bank, a workstation answers ARP for the gateway address and then starts receiving frames that were meant for the gateway. What class of attack is this behavior?
- At a SaaS company, support wants proof of what was in a response body, but the security team has only metadata and session data for that exchange. What is missing?
- At a hotel, an analyst has four records from last night's guest traffic and must pick the one that is transaction data rather than session data. Which record is transaction data?
- Dozens of outside addresses send the same request to a university, and the public campus website becomes unreachable for students. Which attack class fits?
- Hotel guests still reach the network, yet a device on the path rewrites DNS answers so browsers open a look-alike booking site. Which attack class is this?
- At a manufacturer, one crafted packet abuses a parser in an industrial protocol and crashes the listener on a plant controller. Which attack class is this?
- At a university, a lab form passes a student-supplied field into a server shell command, and the page returns a directory listing from that server. Which attack produced the listing?
- On a retailer product-search page, a parameter contains a quote and a database keyword, and the response includes rows that belong to a different customer. Which attack is this?
- A logistics hub sees two SYN floods on its tracking site, one from a single address and one from many addresses using the same request pattern. Which flood is distributed?
- At a bank, a person calls the wire desk, pretends to be a known executive, and demands an urgent transfer, and there is no malware on the call. Which attack is this?
- At a hospital, a patient-portal page places input from a clicked link into the HTML returned to that same person, and the response shows no database error. Which attack fits?
- At a SaaS company, a comment field stores a script, and that script runs later in the browsers of other users who open the same comment. Which attack is this?
- At an agency, a reviewer treats a script that runs in the victim browser as if it were a statement that runs in the database. What is the correction?
- At a bank, reviewers compare several probes against one web application from the same afternoon. Which probe is command injection?
- At an agency, an email matches the director's writing, cites a real project, and asks for a password. A phone call to the director shows the director did not send the email. What did that second channel stop?
- At a retailer, a program copies more data into a fixed buffer than that buffer can hold, and the process then runs attacker-controlled instructions. Which attack is this?
- At a bank, after the initial infection, a host calls the same rare address every few minutes and receives tasking back. Which attack stage is that repeating exchange?
- At a university, students say they can spot fake mail by grammar, but a lure arrives with perfect grammar and a real course name and asks for a course password. What is the better check?
- At a hotel, one guest emails the manager a link, and a different guest makes the same request by phone. What do those two contacts have in common?
- At an MSSP, a customer wants a control for AI-written mail that has no attachment and no malicious URL and only asks to change a payment account. Which control fits that request?
- At a manufacturer, a voicemail sounds like the plant manager and asks maintenance to email a badge export, but the manager is in a meeting and did not call. What pattern is this?
- At a hospital, an unwanted program with a known-bad hash is resident on a clinical PC, has not encrypted any files, and is not a document lure. Which attack category fits that program?
- At a university, a lab PC is slow, no files on it are encrypted, and a process has been injected into a signed binary. Which broad attack category fits?
- At a manufacturer, files on a design share are renamed and a note demands payment before those files can be restored. Which endpoint-attack category fits that outcome?
- At a bank, an intrusion rule looks for a string inside HTTP bodies. The same string is then sent inside TLS and the rule does not fire. Which evasion explains the miss?
- At an agency, malware traffic is wrapped inside DNS, and a detection rule that looks for the malware's own port stays quiet. Which evasion technique is in use?
- At a logistics hub, analysts must separate command and control from ransomware and from other endpoint activity. Which event is the command-and-control activity?
- After a SaaS company TLS handshake, application data is encrypted with a symmetric key both sides derived. Why is that bulk data not encrypted with the server long-term private key?
- A hospital clinic trusts a station only after the station certificate chains to a hospital authority. What is that certificate chain for?
- A retailer host is blocked from direct internet access, so it sends that traffic to an internal proxy that is allowed outbound, and the outside log shows the proxy rather than the host. What evasion is in use?
- A hotel analyst compares a TLS session that encrypts HTTP with a DNS session whose payload is another protocol. Which session is tunneling rather than encryption?
- During a bank TLS handshake the server certificate crosses the network, and the server long-term private key does not. Which of these is supposed to stay off the wire?
- An MSSP customer reports that the attacker used a proxy, encryption, and a tunnel, and the path to the sensor is direct. Which technique hides the bytes from deep inspection?
- An agency analyst captures the server certificate during a TLS handshake and reports that the private key was stolen because that certificate crossed the network. What correction should the SOC lead give?
- A bank proxy log shows one session that negotiated TLS 1.2 and a second session that negotiated TLS 1.3. What differs between those two sessions?
- A university analyst inspects an object that shows a subject, an issuer, validity dates, and a subject alternative name, and the object does not include a private key. Which format family is this?
- At a manufacturer, a TLS handshake agrees on a fresh shared secret by using ephemeral values, while the long-term private key only signs that exchange. Which piece is the analyst looking at?
- A SaaS company holds a password-wrapped file that contains a certificate and its private key, ready to import onto a server. Which PKCS flavor is that file?
- A retailer TLS log records the string TLSAES128GCMSHA256 for a completed connection to the payment application. What is that string naming?
Host-Based Analysis (20%) · 60 questions
- A hotel endpoint agent carries a signature for one malware family and a model that scores unusual parent-child process chains. Why does the agent keep both instead of relying on only one?
- At a university, a process on a lab PC begins accepting inbound connections from other hosts in the lab. Which control on that PC blocks those inbound connections?
- At a hospital, a clinical PC raises an alert after one process injects code into another process, and no known file hash was involved. Which endpoint technology fits the alert?
- At a manufacturer, an endpoint product scores a signed admin tool as suspicious because that tool's behavior is rare on the host, and no hash matched. What kind of detection produced the score?
- At a bank, outbound port 443 from a workstation is allowed, and a new listening port that a script just opened is denied. Which technology enforced that decision?
- At a retailer, a file on a register matches a known-bad hash, and the security product quarantines the file before it runs. Which technology performed that action?
- At a logistics hub, fileless malware is running inside a script host whose file hash matches the vendor signed binary. Which endpoint approach can still see that activity?
- On a bank workstation, Windows Security event 4625 records failed logons for an account and event 4624 is recorded for the same account just afterward. What does event 4624 add?
- On a university Windows host, event 1102 reports that the security audit log was cleared outside any maintenance window the team expected. Why does that event matter?
- On a hospital PC, Windows Security event 4688 records a new process after process-creation auditing was enabled so the event would exist. What does this event prove?
- On a retailer Windows host, event 7045 reports that a service was installed during the overnight window. Which item should the analyst inspect next on that same host?
- At an agency, a predictive endpoint model alerts on a help-desk remote-admin tool that staff launch on every working day. What is the right first reading of that alert?
- On an agency Linux jump host, a user's authorizedkeys file gains a public key line that the account owner did not add. What access does that new line create?
- At a SaaS company, Windows event 4720 shows that an account was created, and event 4732 shows that the same account was added to the local administrators group. What do these two events show together?
- On a Linux server at a logistics hub, a crontab entry for a warehouse account runs a downloader every hour. Which host component is that entry using?
- A manufacturer Linux host has a new systemd unit that starts a shell script at every boot, and the distribution authentication log shows no matching change ticket. What persistence mechanism is in front of the analyst?
- On a bank workstation, HKLM\Software\Microsoft\Windows\CurrentVersion\Run contains a new value pointing at a user-writable path. What does that value do?
- A hotel security console shows Windows event 4698 on a front-desk PC, recording that a scheduled task was created to run overnight. Which Windows component does that event describe?
- A hospital investigation can name the imaging server that was encrypted and cannot yet name who performed the encryption. Which attribution element is already known?
- An MSSP report names a criminal group as responsible for a customer incident solely from one IP address, and that address is a shared VPN exit. What is the correction?
- A university case file holds four notes: a stolen laptop, a group claim of responsibility, a file hash, and a sign-out sheet for the imaged drive. Which note is the chain of custody?
- At an agency, every person who handled a disk image signed the time they received it and the time they released it. What does that set of signatures document?
- At a bank, an analyst watches a help-desk tool spawn a shell and connect to a rare address while that activity is still underway, and no file hash has been published. What term fits this observation?
- After an incident at a retailer, responders publish a file hash and a callback domain found on a payment server. What term names those two artifacts?
- At a hotel, leadership wants the threat actor's legal name on the first day, but the only fact in hand is a foreign address on a consumer VPN. What can the analyst honestly report from that fact?
- At a retailer, a cashier was unhappy, and a register later had malware, but nothing ties that person to the file. What evidence class is the note about the unhappy cashier?
- At a manufacturer, a design file's hash matches a published indicator, and a process on the file server is spawning a script host right now. Which fact is the indicator of attack?
- At a bank, the original firewall log is still stored on the appliance, and the incident ticket holds a screenshot of that same log. Which item is best evidence of what the firewall recorded?
- At a hospital, an endpoint alert says a file hash ran, and the proxy log shows that same host fetched the file one minute earlier. What is the proxy log in relation to the endpoint alert?
- At a university, the host agent and the network log are independent sensors, and both show the same callback from one workstation. What is the relationship between those two records?
- At a manufacturer, an application log records an administrator export of the customer table at 02:00 from a workstation that has no night shift. What should the analyst do first?
- A hospital SOAR record says a playbook disabled a clinician account, but the directory still lists that same account as enabled. How should the analyst read the two records?
- At a logistics hub, a timeline note says the vendor was probably late and therefore the warehouse outage was an attack, but no log shows an intrusion. What evidence class is that note?
- Counsel for an agency demands the original disk from a seized workstation and will not accept the analyst's written notes about that disk. What evidence class is the original disk?
- At a university, shell history on a research host shows curl piping a script into a shell, followed by a new crontab line for that same account. What did this host record?
- A bank SIEM search on one account shows repeated Windows 4625 events and then a single 4624 from an address that account has not used before. What does this sequence show?
- At an agency, event 4624 records a successful logon for an ordinary user account, and event 4672 follows it showing special privileges assigned to that logon. What does event 4672 add?
- At a bank, the Linux authentication log shows repeated failures and then a success for an admin from a foreign address, and no change ticket exists for that logon. What is the first triage step?
- At a retailer, a register the real help desk does not use records Windows event 4720 for a new local account named helpdesk and event 4732 adding that account to the local Administrators group. What happened?
- At a SaaS company, a command-line log shows one process encoding a payload and starting a child process that opens an outbound connection. What does that host log support?
- At a hotel, the distribution authentication log shows a successful SSH login as a service account from the guest Wi-Fi range, and that account has previously been used only from the management VLAN. What is the lead?
- At a logistics hub, the SIEM shows Windows event 1102 on a warehouse PC and then no further security events from that PC. What is the best reading of those facts?
- At a hospital, the EHR application log shows a bulk chart read by a service account that has never read more than a few charts. Which question should the analyst ask first?
- At an MSSP, a customer ticket includes a SOAR log saying a host was isolated, yet that host still answers ping. What should the analyst do next?
- At a hotel, a front-desk Windows host records event 4740, an account lockout, after a burst of event 4625 failures from the guest VLAN. What do those events show?
- At a manufacturer, event 4698 records a new task whose action is a script in a temp directory, and event 4688 shows that script starting at the task time. What do the two events show together?
- At a retailer, event 4768 records a Kerberos ticket-granting-ticket request for a store manager, and event 4769 records a service ticket for a file share that manager never uses. What do those two events support?
- At a university, a student lab image has an empty shell history, and the distribution authentication log shows a command that cleared that history. What do those two records show?
- A manufacturer detonates a sample known to check for a sandbox, and the report shows no network connections and no new files. How should the analyst read that quiet result?
- An agency sandbox shows two samples that share a behavior description and have different hashes. What does that combination mean?
- A university sandbox URL list contains the campus update server and one newly registered domain. Which contact should the analyst treat as the lead?
- At a bank, a sandbox report lists a SHA-256 for the sample and no other section is filled in yet. What is that hash useful for at this point?
- At a hospital, a detonation report shows that a sample connected to three URLs and also created a run-key value. Which part of the report shows that network activity?
- A retailer sandbox report says the sample spawned a script host, wrote a file, and lists that file's hash. Which section of the report supports the process behavior?
- At a SaaS company, the same file hash appears in a sandbox detonation and on a build server that is supposed to hold only source code. What should the analyst ask first?
- A bank sandbox report shows a networking section with a connection to a rare IP address on port 443, plus a hash section that identifies the file. Which fact is the callback?
- An MSSP customer submits an office document. The sandbox opens it and reports no callbacks, and macros are disabled in the sandbox image. What limitation should the analyst record?
- A hospital sandbox report offers three usable lines: a file hash, a contacted URL, and a service the sample created. Which line is the host persistence artifact?
- A hotel sandbox report shows a dropped file and the hash of that drop, and a guest laptop still has a file with the same hash. What does that match establish?
- A logistics hub sandbox report lists file hashes, contacted URLs, and a process tree. Counsel asks for proof of what the sample did on the host, not merely the sample identity. Which report section answers that request?
Network Intrusion Analysis (20%) · 60 questions
- At a logistics hub, a record lists byte and packet counts for one 5-tuple and includes no payload and no security verdict. Which source produces a record with that shape?
- At a retailer, a record says the application peer-file-share was denied even though an older rule had allowed that TCP port. Which technology produced the deny?
- At a university, a security record shows the user, the full URL, the category, and a block decision. Which technology produced that record?
- At a manufacturer, a record says a file hash was detected and the matching file was quarantined on a workstation. Which technology produced that record?
- At a bank, a monitoring record names a signature identifier, a severity, and a drop action taken on a flow. Which technology produced that record?
- At a hotel, a record says TCP from a guest device to port 443 was permitted, and the record names no application and no signature. Which technology produced that record?
- A detection rule at a bank alerts on a vulnerability scanner the bank scheduled, and that scanning is not an intrusion. How should the alert be classified?
- Ransomware spread across hospital systems and no sensor raised an alert during the spread. How should that detection miss be classified?
- At a retailer, a security alert fires and the analyst confirms that a real beacon is running on the checkout register. How should this investigated result be classified?
- At a SaaS company, one log shows a firewall allowed a 5-tuple, and another log from the same moment denies that flow after identifying a remote shell. Which log explains the deny?
- During a quiet night at a university, no security alert fires, and a later review of the same window finds no intrusion. How should that outcome be classified?
- An agency analyst is sorting a signature drop, a URL block that names a user and an address, and a byte count for a conversation. Which of those records came from the proxy?
- At a manufacturer, a signature matches an industrial vendor's licensed remote-support tool, and the change ticket authorized that tool for this window. The activity occurred and policy allows it. Which classification fits?
- At an agency, forensics shows an attacker forwarded an executive mailbox for a month, and no security alert fired during that period. Which detection label fits that outcome?
- A firewall at a retailer permits return traffic only when that traffic belongs to a connection an inside host already opened. Which inspection mode is the firewall using?
- A device at a bank allows or denies each packet using only addresses and ports, and it does not remember the handshake of any connection. Which kind of device is that?
- A hotel SOC compares four outcomes from the same week: an attack with no alert, an alert that wasted an hour, a quiet night with no intrusion, and an approved support tool. Which outcome is the one in which the attacker had impact?
- An MSSP customer wants every alert called a true positive. On a customer host, an authorized backup trips a rule that labels the transfer as data theft. What is the right label for that alert?
- At a manufacturer, a security device sits in the forwarding path and drops an industrial-protocol exploit before the packet reaches a controller. Which deployment is that device using?
- At a hospital, a sensor receives only a copy of clinical traffic, and powering that sensor off does not stop the clinical traffic. Which deployment matches this result?
- At a hotel, a sensor outage left the guest network up while detection of that guest traffic stopped. Which design fits both of those results?
- A control at a university reads the HTTP body looking for a script tag and does not stop its decision at the destination port. Which inspection mode is that control using?
- Three products sit on one link at a logistics hub, and an analyst must choose the product that can name an application command carried inside the payload. Which product does that?
- At a bank, the team must block command-and-control packets on the path, and merely recording a copy of those packets will not perform the block. Which statement is accurate?
- At a manufacturer, a packet capture contains one unencrypted file download carried on a single TCP session. How should the analyst recover that file from the capture?
- At a university, an investigation only needs to know who talked to a rare address and how many bytes moved. Compared with a full packet capture, which lighter source answers that question?
- An agency analyst needs the unencrypted file a host downloaded. A week of NetFlow is stored, and no packets were saved. What gap prevents recovery of that file?
- At a bank, leadership wants to know which conversations moved the most data last month, and no packets from that month were retained. Which source can still answer the volume question?
- At a retailer, a tap captured a file transfer, and NetFlow shows the same 5-tuple with byte counts for that transfer. Which source can yield the file itself?
- At a SaaS company, a file moved inside TLS. The packet capture contains those packets, and the team does not have the server private key. What will TCP stream reassembly produce?
- At a hotel, the IP header protocol field on a captured packet says TCP, but a later analyst labels that same packet UDP after noticing the application is a VPN. What corrects the label?
- A university capture of a clear HTTP request contains a script tag in the request URI, while the host addresses look like ordinary campus machines. Which element carries the attack text?
- A hospital analyst holds a packet capture of a cleartext HTTP file download from a clinical workstation. What is the practical way to extract that file from the capture?
- At a logistics hub, two different files traveled inside two TCP sessions between the same pair of IP addresses. What must be separated before either file can be carved from the capture?
- A bank packet capture shows 10.1.1.20 sending a TCP SYN to 203.0.113.50 on port 443, and no reply has arrived yet. What is the source address of this session?
- A retailer capture of a client session shows destination port 443 and a high ephemeral source port on the same packets. Which value identifies the service the client contacted?
- At a hospital, an analyst must name what carried the exploit bytes. The IP header protocol number is 6, and the payload begins with an HTTP request line. What carried those bytes?
- At an MSSP, a capture shows a TCP SYN from port 51514 to port 22, and a junior analyst treats port 51514 as the service and the destination host as the client. What is the correction?
- At a manufacturer, a captured payload is encrypted, while the IP header still shows the address where the packet was sent. Which element remains usable for scoping the flow?
- At an agency, a capture line lists source 198.51.100.10, destination 198.51.100.20, destination port 445, and protocol TCP. Which element shows the service the sender contacted?
- At a bank, a captured frame carries a source MAC that is not the MAC the switch learned for that IP yesterday. Which header in the frame contains the MAC address?
- At a retailer, an IPv4 packet that should cross the store WAN reaches the first router with a TTL of 1 and dies there. What does that TTL value explain?
- At a hotel, a capture shows ICMP type 8 sent to the gateway and ICMP type 0 returned to the sender. Which exchange do those two ICMP types form?
- At a university, a captured IPv6 header has a next-header field that indicates TCP. What does that field tell you about the packet?
- At a manufacturer, a TCP header has SYN set and ACK unset, and the capture has no earlier packet for that 5-tuple. What do those flags mean?
- At a logistics hub, a UDP header shows destination port 53 and a short length, and the capture has no handshake for that flow. Why is the missing handshake normal?
- At an agency, a DNS query requests a TXT record whose name is a long random label, and the answer returned for that name is long as well. What suspicious use do that query and that answer support?
- At a bank, an SMTP transcript shows one address in MAIL FROM and a different address in the message From header. Which value did the receiving server use as the envelope sender?
- A bank intrusion alert includes a source address and a destination address, and the destination is the bank payroll server. Which address is the asset to scope first?
- At a retailer, an ARP reply tells the switch that the gateway IP address belongs to a cash-register MAC, and no ARP request was seen. Which artifact is that reply?
- In a hospital lab, HTTP/2 rides TCP port 443 in the clear, and a request pseudo-header carries the path. What changed relative to an HTTP/1 request line?
- At a SaaS company, a cleartext HTTP request line is GET and the Host header names a look-alike domain. Which field carries the site name the client asked for?
- At a logistics hub, one host fetches a mailbox with IMAP and later sends mail with SMTP to the same server. Which header family separates those two services?
- A university alert lists client port 49822 and server port 445 on the same connection. Which value identifies the service?
- A logistics hub alert shows a URI containing a scripted database predicate. The addresses on the alert are the warehouse web server and a clerk PC. Which artifact carries the injection?
- A manufacturer alert names a process path and a registry run-key value on a single host. What do those two artifacts describe?
- At an agency workstation, a detection record shows a script host making an unusual API call that allocates memory inside a second process. What kind of artifact is that record describing?
- At a bank, an analyst tests patterns against the address string 10.8.0.15 and must reject any pattern that also matches 192.168.0.15. Which pattern matches 10.8.0.15 and does not match 192.168.0.15?
- At a retailer, analysts are filtering file names, and the name under review is invoice.exe.txt. Which pattern matches a name that ends in .exe and does not match invoice.exe.txt?
- A hotel SOC sees two alerts that share one file hash and list two different guest-network IP addresses. What does that shared hash tie together?
Security Policies and Procedures (15%) · 45 questions
- At a hospital, a clinical device is live on the network and does not appear in the inventory the SOC uses. Which management practice failed?
- An agency incident plan names who may speak to the public, who may isolate a system, and how leadership is notified. Which plan elements are those three statements?
- At a bank, a server's running configuration no longer matches the approved baseline, and no change ticket exists for the difference. Which practice addresses this gap?
- At a retailer, store phones can be locked and wiped when people leave the company, and personal laptops cannot be controlled that way. Which practice covers the phones?
- A university team finds missing patches, weak service settings, and exposed admin pages, then ranks the findings and tracks them to closure. Which practice is that full effort?
- A manufacturer pushes vendor fixes to plant systems on a fixed schedule and does not rank configuration flaws or other weaknesses. Which practice is that schedule performing?
- A bank incident plan states which kinds of events count as incidents and which systems the plan covers. Which element of the plan is that statement?
- At a university, an alert is still unverified and the only fact in hand is a single failed logon on one lab PC. What handling step fits the evidence so far?
- A hospital incident-response plan shows a cover logo and contains neither a contact list nor a severity guide. What is missing for NIST-style incident-response preparation?
- A retailer has confirmed a beacon on a register that is still attached to the store LAN, and the incident plan says to isolate a confirmed host before imaging it. What is the next handling step?
- At a manufacturer, the infected host is already isolated, the malware has been removed, and the production line is still down. What phase work remains?
- A hotel guest Wi-Fi controller looks compromised, and that controller holds the only copy of the day's logs. What should the team protect while containing the device?
- A hospital SOC is still deciding whether a backup alert is an incident and is pulling related logs to make that decision. Which handling phase is underway?
- At a retailer, the team removes the malware, resets the passwords it used, and restores each register from a known-good image. Which incident-handling phase covers that work?
- Two weeks after an agency restores service, the team rewrites a detection that missed the forwarding rule used in the incident. Which incident-handling phase is that rewrite?
- Bank analysts build a contact tree and a severity chart before any incident has occurred this year. Which incident-handling phase is that work?
- A logistics hub finished restoring warehouse systems yesterday and confirmed that operations are back to normal. What does the incident-handling process still require?
- Before any incident at a bank, someone must write the incident plan, the contact tree, and the severity guide. Whose stakeholder role owns that preparation work?
- At a manufacturer, a production line must be isolated now and restarted later. Besides the SOC, who has to take part in containment and recovery for that line?
- At an agency, a laptop is still powered on and the suspect process is resident in memory. What should be collected before that laptop is shut down?
- A bank forensic analyst images a seized workstation disk and records one hash of the original disk and one hash of the image. Why are the two hashes recorded?
- At a hospital, after the incident is over, leadership and the people who responded meet to change the handling plan. Which phase are those stakeholders serving in that meeting?
- A university forensics lab stores the original laptop drive on a shelf and allows the analyst to work only from a forensic copy. Which practice does that shelf rule follow?
- An MSSP customer asks who performs detection and analysis on Tuesday night, when the customer's alerts need a person to review them. Which role does that work?
- A hotel reservations server is still running, its memory matters to the case, and the plan lists unplugging the server, copying memory, and hashing a disk image. Which action should happen first?
- At a bank, branch sessions normally last a few minutes, the critical-asset address list is unchanged, and one session to an uncommon address stays up the entire business day. Which network-profile element broke?
- At a retailer, stores normally reach the payment service on port 443, and one register starts a session on a rare high port toward a new address. Which network-profile element changed?
- At a logistics hub, the site profile records how much data normally crosses the WAN during an hour of warehouse work. Which network-profile element is that measurement?
- At a retailer, a manager powers off a point-of-sale register before anyone captures its memory. What does that power-off destroy?
- At a hospital, the network profile lists address ranges reserved for medical devices and says those ranges must not be used by general user endpoints, yet a laptop is using one of those addresses. Which profile element makes this matter?
- At a hospital, a file contains a patient's diagnosis together with that patient's medical-record number. Which data class does the file fall under?
- At a bank, a spreadsheet lists customer names and account numbers and contains no passwords. Which data class fits that spreadsheet?
- At an agency, a new process whose name looks like a remote shell is running beside the usual web process on a server. Which server-profile element is this?
- At a manufacturer, a server that should listen only on port 443 also starts listening on port 4444. Which server-profile element changed?
- At a university, a service account has an interactive session on a research server where that account has never logged on, and the listening ports are unchanged. Which server-profile element changed?
- At a hotel, a scheduled task has appeared on the reservation server and is absent from the approved task list. Which server-profile element does that new task belong to?
- At a retailer, a file contains cashier usernames and passwords for the register system. Which data class does that file fall under?
- A manufacturer folder holds unreleased product designs that are not about a person and are not passwords. Which data class fits that folder?
- A retailer mailbox has received a weaponized document, and nobody has opened the file. Which Lockheed Kill Chain phase describes this point?
- Malware is already on an agency host, it calls out for tasks, and it has not yet copied files. Which Lockheed Kill Chain phase fits this activity?
- A crew is researching employee names and a bank VPN address, and no malware has been sent. Which Lockheed Kill Chain phase fits this activity?
- An MSSP writes up a customer intrusion with four labels: the adversary, a malware capability, rented infrastructure, and the customer as the victim. Which model is that write-up using?
- At a logistics hub, analysts acknowledged the alert quickly and isolated the host quickly, yet the warehouse system stayed unusable until the next day. Acknowledgment is the response clock and isolation is already done. Which metric covers the last wait until operations were under control?
- At a bank, detection of a malicious host was fast, yet that host stayed on the network for a long time after the alert before anyone isolated it. Which metric explains the extra risk that the activity kept spreading?
- At a hospital, a beacon had been calling out for 20 days before the first alert, and nobody has isolated the host. That gap is observed for this case and is not a published target. Which SOC metric is long, and what does that length do to the investigation?
These questions are original practice material and are NOT actual exam questions or brain-dump content. Cisco and related marks are trademarks of their respective owners. This material is not affiliated with, endorsed by, or sponsored by Cisco.