CiscoAssociate level200-201

200-201 exam dumps: 405 free Cisco CyberOps Associate (CBROPS) practice questions

Free 200-201 practice questions for the Cisco Cybersecurity Associate exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 405 by number, or take a timed practice exam.

Question bank last updated January 2025

Start timed practice exam Browse all 405 questions

Free 200-201 practice questions

Questions 1 to 10 of 405

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

200-201 Question 1

Select 2

A cybersecurity analyst is tasked with identifying security risks in a company's network. During the assessment, the analyst discovers that several outdated systems are running without encryption and that employees frequently fall victim to phishing attacks. Based on the CIA triad principles, which two security objectives are most directly impacted by these issues?

  1. A

    Confidentiality

  2. B

    Integrity

  3. C

    Availability

  4. D

    Authentication

  5. E

    Non-repudiation

Show answer and explanation

Correct answers: A, B

Explanation

The CIA triad (Confidentiality, Integrity, Availability) is a foundational security model. In this scenario, outdated systems without encryption pose a risk to Confidentiality by exposing sensitive data, and phishing attacks threaten Integrity by allowing unauthorized manipulation of data. Availability is not impacted, as the described issues do not involve service interruptions.

  • A. Correct.

    Confidentiality is impacted because outdated systems without encryption allow unauthorized individuals to potentially access sensitive data.

  • B. Correct.

    Integrity is affected because phishing attacks can lead to unauthorized changes to data, compromising its accuracy and reliability.

  • C. Incorrect.

    Availability is not directly impacted in this scenario, as there is no evidence of denial-of-service attacks or system downtime caused by these issues.

  • D. Incorrect.

    Authentication is not directly relevant in this context because the described issues involve encryption and phishing, not user identity verification mechanisms.

  • E. Incorrect.

    Non-repudiation is not related to this scenario, as it deals with ensuring that actions or transactions cannot be denied by the user or entity that performed them.

200-201 Question 2

Single answer

A cybersecurity analyst at a Security Operations Center (SOC) is investigating a potential security incident involving unusual outbound traffic from a corporate server. Which security concept would best help the analyst determine if the server's behavior is legitimate or malicious?

  1. A

    Least Privilege

  2. B

    Defense in Depth

  3. C

    Baseline Behavior

  4. D

    Zero Trust

Show answer and explanation

Correct answer: C

Explanation

In this scenario, the cybersecurity analyst is investigating unusual outbound traffic and needs to determine if it is legitimate or malicious. Establishing a baseline of normal behavior for the server allows the analyst to identify deviations that could signal unauthorized or malicious activity. This makes 'Baseline Behavior' the most relevant security concept for addressing the situation.

  • A. Incorrect.

    Least Privilege is a principle that ensures users or systems only have the minimum access necessary to perform their tasks, but it does not directly help in identifying unusual behavior.

  • B. Incorrect.

    Defense in Depth is a strategy that layers multiple security measures to protect systems, but it does not focus on identifying or analyzing unusual behavior.

  • C. Correct.

    Baseline Behavior refers to establishing a normal pattern of system or network activity, which can then be used to detect deviations that may indicate malicious activity. This concept directly applies to the scenario.

  • D. Incorrect.

    Zero Trust is a security model that assumes no implicit trust and requires verification for every access request, but it does not specifically address analyzing or detecting unusual behavior.

200-201 Question 3

Single answer

During a security assessment, a company discovers that unauthorized users have been accessing confidential customer data due to weak access controls. Which element of the CIA triad is primarily affected in this scenario?

  1. A

    Confidentiality

  2. B

    Integrity

  3. C

    Availability

  4. D

    Authentication

Show answer and explanation

Correct answer: A

Explanation

The CIA triad consists of Confidentiality, Integrity, and Availability, which are the core principles of cybersecurity. In this scenario, the primary issue is unauthorized access to sensitive information, which directly impacts confidentiality. Proper access controls are essential to prevent breaches of confidentiality and protect sensitive data.

  • A. Correct.

    Confidentiality is the aspect of the CIA triad that ensures information is protected from unauthorized access or disclosure. In this scenario, unauthorized users accessing confidential data directly compromises confidentiality.

  • B. Incorrect.

    Integrity focuses on maintaining the accuracy and consistency of data and systems. While important, integrity is not the primary concern in this specific scenario.

  • C. Incorrect.

    Availability is about ensuring that systems and data are accessible when needed. This scenario does not involve disruptions to access or availability of resources.

  • D. Incorrect.

    Authentication refers to verifying a user's identity, which is a security mechanism but not a direct component of the CIA triad. This option is irrelevant to the described situation.

200-201 Question 4

Single answer

A financial institution has implemented a secure online banking system. During an internal audit, the team discovers that unauthorized users could potentially alter transaction records stored in the database. This issue directly violates which aspect of the CIA triad?

  1. A

    Confidentiality

  2. B

    Integrity

  3. C

    Availability

  4. D

    Authentication

Show answer and explanation

Correct answer: B

Explanation

The CIA triad consists of Confidentiality, Integrity, and Availability. In this scenario, the unauthorized alteration of transaction records violates the Integrity principle, which is responsible for maintaining the accuracy and trustworthiness of data. Integrity ensures that data cannot be modified or tampered with by unauthorized users.

  • A. Incorrect.

    Confidentiality focuses on ensuring that sensitive information is only accessible to authorized individuals. While important, this is not the aspect affected in this scenario.

  • B. Correct.

    Integrity ensures that data remains accurate, consistent, and unaltered by unauthorized users. The issue described in the scenario, alteration of transaction records, directly relates to a breach of integrity.

  • C. Incorrect.

    Availability ensures that systems and data are accessible to authorized users when needed. This scenario does not involve availability concerns.

  • D. Incorrect.

    Authentication is the process of verifying the identity of users attempting to access a system. While authentication may help mitigate unauthorized access, it is not a part of the CIA triad.

200-201 Question 5

Single answer

A company is deciding between deploying a host-based intrusion detection system (HIDS) and a network-based intrusion detection system (NIDS). The organization has critical servers that handle sensitive data and wants to focus on detecting potential malicious activities on these servers specifically. Which security deployment is most suitable in this scenario?

  1. A

    Host-based Intrusion Detection System (HIDS)

  2. B

    Network-based Intrusion Detection System (NIDS)

  3. C

    Cloud Access Security Broker (CASB)

  4. D

    Endpoint Detection and Response (EDR)

Show answer and explanation

Correct answer: A

Explanation

A Host-based Intrusion Detection System (HIDS) is the best choice for monitoring and detecting malicious activities on specific servers or hosts, particularly critical systems handling sensitive data. HIDS operates at the host level, making it an appropriate solution for the organization's specific requirement to focus on server-based detection.

  • A. Correct.

    HIDS is suitable for monitoring and detecting malicious activities on specific hosts or endpoints, such as critical servers. It operates at the host level and is ideal for environments where a detailed focus on individual systems is required.

  • B. Incorrect.

    NIDS is designed to monitor network traffic and detect threats at the network level. While effective for network-wide visibility, it is not the most focused solution for monitoring activities on individual servers.

  • C. Incorrect.

    CASB is primarily used to secure cloud services and ensure compliance with organizational policies. It does not address the specific need for detecting threats on individual critical servers.

  • D. Incorrect.

    EDR provides advanced threat detection and response capabilities for endpoints. However, it is more suited for active response and remediation rather than just intrusion detection, which is the focus of the scenario.

200-201 Question 6

Select 3

An organization is deciding between deploying a host-based intrusion detection system (HIDS) and a network-based intrusion detection system (NIDS). Which of the following are key differences between these two types of security deployments?

  1. A

    HIDS monitors activity on individual devices, while NIDS monitors traffic across the entire network.

  2. B

    NIDS is more effective at detecting insider threats than HIDS.

  3. C

    HIDS can detect unauthorized changes to files and processes on a host, while NIDS cannot.

  4. D

    NIDS requires endpoint agents to be installed on each device, while HIDS requires only a central monitoring device.

  5. E

    HIDS typically has access to encrypted data on the host, while NIDS cannot analyze encrypted network traffic in transit.

Show answer and explanation

Correct answers: A, C, E

Explanation

HIDS and NIDS serve different purposes in security deployments. HIDS focuses on monitoring and detecting threats on individual devices, such as unauthorized file changes and process anomalies. NIDS, on the other hand, monitors network traffic to identify malicious activities across the network. HIDS may have visibility into encrypted data on the host, while NIDS cannot analyze encrypted traffic in transit. Understanding these distinctions is critical for selecting the appropriate security deployment for a given use case.

  • A. Correct.

    HIDS is designed to monitor activity on individual devices, such as file changes, process anomalies, and log entries. NIDS focuses on monitoring network traffic for signs of malicious activity across the entire network.

  • B. Incorrect.

    NIDS is not inherently more effective at detecting insider threats. Insider threats are often better identified using HIDS, as it can monitor local user activity and system changes.

  • C. Correct.

    HIDS is capable of detecting unauthorized changes to files and processes on the host, which is outside the scope of what NIDS is designed to monitor.

  • D. Incorrect.

    NIDS does not require endpoint agents; it typically operates using a central network tap or port mirroring to analyze traffic. HIDS, however, requires installation on each host it protects.

  • E. Correct.

    HIDS can access encrypted data on the host since it operates at the endpoint level and has visibility into decrypted data. NIDS struggles with encrypted traffic since it only observes data in transit.

200-201 Question 7

Select 3

A cybersecurity analyst is investigating a security incident where an employee's device was compromised after visiting a malicious website. To prevent similar incidents in the future, the analyst recommends implementing a layered security approach. Which combination of network, endpoint, and application security systems would best mitigate this type of threat?

  1. A

    Web Application Firewall (WAF) to monitor and filter HTTP/HTTPS traffic to web applications

  2. B

    Endpoint Detection and Response (EDR) to monitor and respond to threats on endpoints

  3. C

    URL filtering to block access to known malicious websites

  4. D

    Antivirus software to scan and remove malware on the endpoint

  5. E

    Intrusion Prevention System (IPS) to detect and block malicious network traffic

Show answer and explanation

Correct answers: B, C, D

Explanation

To prevent endpoint compromise from malicious websites, a layered approach is necessary. URL filtering directly blocks access to harmful websites, endpoint detection and response (EDR) monitors and mitigates suspicious behavior on devices, and antivirus software detects and removes malware. While WAF and IPS are valuable security tools, they are not directly relevant to addressing this specific type of threat.

  • A. Incorrect.

    A Web Application Firewall (WAF) is primarily designed to protect web applications from specific attacks like SQL injection or cross-site scripting (XSS). It does not directly prevent endpoint compromise from visiting malicious websites.

  • B. Correct.

    Endpoint Detection and Response (EDR) is effective in monitoring endpoints for suspicious activity and responding to threats, making it a key element in mitigating endpoint-based attacks.

  • C. Correct.

    URL filtering blocks access to known malicious websites, which directly addresses the root cause of this incident and helps prevent similar attacks.

  • D. Correct.

    Antivirus software is essential for detecting and removing malware that may have been downloaded from a malicious website, thereby reducing the risk of further compromise.

  • E. Incorrect.

    An Intrusion Prevention System (IPS) focuses on analyzing and blocking malicious network traffic. While useful, it does not directly address the issue of endpoint compromise from visiting malicious websites.

200-201 Question 8

Select 3

A cybersecurity analyst at your organization notices unusual traffic patterns coming from an endpoint device on the network. Upon further investigation, the analyst determines that the device has been compromised and is communicating with a known malicious server. Which combination of network, endpoint, and application security systems would be most effective in detecting and mitigating such a threat?

  1. A

    Endpoint Detection and Response (EDR) to identify and isolate the compromised device

  2. B

    Intrusion Prevention System (IPS) to block communication with the malicious server

  3. C

    Web Application Firewall (WAF) to monitor and block web-based malicious activities

  4. D

    Network Access Control (NAC) to enforce device authentication and restrict network access

  5. E

    Anti-virus software to detect and remove malware on the affected endpoint

Show answer and explanation

Correct answers: A, B, D

Explanation

To effectively detect and mitigate the threat, a combination of EDR, IPS, and NAC systems is required. EDR identifies and isolates the compromised device, IPS blocks communication with the malicious server, and NAC enforces access control policies to limit the impact of the compromised device. While anti-virus software and WAF have their uses, they do not fully address the specific scenario of detecting and blocking unusual traffic patterns from a compromised endpoint.

  • A. Correct.

    Endpoint Detection and Response (EDR) is crucial for detecting unusual behaviors and isolating compromised devices to prevent further damage.

  • B. Correct.

    An Intrusion Prevention System (IPS) can block communication with known malicious servers by inspecting network traffic and applying security policies.

  • C. Incorrect.

    A Web Application Firewall (WAF) is designed to protect web applications, not to handle endpoint-based traffic or block malicious servers in this scenario.

  • D. Correct.

    Network Access Control (NAC) helps enforce security policies such as device authentication and can restrict network access for compromised devices.

  • E. Incorrect.

    Anti-virus software is helpful for detecting and removing malware, but it is not sufficient on its own for detecting or mitigating communication with a malicious server.

200-201 Question 9

Single answer

A cybersecurity analyst is tasked with implementing endpoint protection for a company's devices. The analyst is deciding between agent-based and agentless approaches. Which of the following scenarios best aligns with using an agentless protection approach?

  1. A

    The company needs to monitor network traffic for threats without installing software on endpoints.

  2. B

    The company requires a solution capable of performing detailed behavioral analysis on endpoint processes.

  3. C

    The company needs to enforce endpoint compliance policies even when devices are offline.

  4. D

    The company wants to use a lightweight solution that provides real-time remediation of endpoint security threats.

Show answer and explanation

Correct answer: A

Explanation

Agentless protection is ideal for scenarios where monitoring can be achieved by analyzing network traffic or external data sources without requiring software installation on endpoints. It is best suited for environments where minimal intrusion and easy deployment are priorities. In contrast, agent-based protections are needed for detailed analysis, offline policy enforcement, and real-time remediation, as they require direct interaction with the endpoint.

  • A. Correct.

    This is correct. Agentless protection monitors endpoints by analyzing network traffic and does not require software installation on individual devices.

  • B. Incorrect.

    This is incorrect. Detailed behavioral analysis on endpoint processes typically requires an agent installed on the device to collect and analyze data.

  • C. Incorrect.

    This is incorrect. Enforcing endpoint compliance policies when devices are offline often requires an agent to be installed and actively running on the endpoint.

  • D. Incorrect.

    This is incorrect. Real-time remediation of endpoint threats usually requires an agent to provide direct interaction with the endpoint.

200-201 Question 10

Single answer

A cybersecurity analyst is tasked with protecting a corporate network and its endpoints. The analyst needs to decide between using agent-based and agentless protections for different parts of the infrastructure. Which of the following scenarios would best benefit from agentless protection?

  1. A

    Monitoring devices in a Bring Your Own Device (BYOD) environment.

  2. B

    Providing malware detection and remediation on corporate laptops.

  3. C

    Enforcing endpoint protection policies on managed servers.

  4. D

    Tracking and securing sensitive data on mobile devices using an installed application.

Show answer and explanation

Correct answer: A

Explanation

Agentless protections are commonly used in scenarios where deploying agents is impractical or not allowed, such as in BYOD environments. They rely on network-level monitoring and controls, making them suitable for overseeing a broad range of devices without requiring software installation on each endpoint.

  • A. Correct.

    Agentless protection is ideal for environments like BYOD where installing agents on personal devices may not be feasible. It allows for network-based monitoring without requiring software installation.

  • B. Incorrect.

    Agent-based protection is more effective for tasks like malware detection and remediation, as it requires direct access to the system and its files.

  • C. Incorrect.

    Enforcing endpoint protection policies on managed servers typically requires agent-based solutions to ensure comprehensive control and monitoring.

  • D. Incorrect.

    Tracking and securing sensitive data on mobile devices usually involves an agent-based approach, as it requires an application to be installed for detailed control.

Timed practice exam

Take a 200-201 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the 200-201 exam covers

Official Cisco Cybersecurity Associate exam domains and weightings.

  • Security Concepts

    20% of exam

  • Security Monitoring

    25% of exam

  • Host-Based Analysis

    20% of exam

  • Network Intrusion Analysis

    20% of exam

  • Security Policies and Procedures

    15% of exam

All 405 200-201 practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

  1. 1.A cybersecurity analyst is tasked with identifying security risks in a company's network. During the...
  2. 2.A cybersecurity analyst at a Security Operations Center (SOC) is investigating a potential security incident...
  3. 3.During a security assessment, a company discovers that unauthorized users have been accessing confidential...
  4. 4.A financial institution has implemented a secure online banking system. During an internal audit, the team...
  5. 5.A company is deciding between deploying a host-based intrusion detection system (HIDS) and a network-based...
  6. 6.An organization is deciding between deploying a host-based intrusion detection system (HIDS) and a...
  7. 7.A cybersecurity analyst is investigating a security incident where an employee's device was compromised after...
  8. 8.A cybersecurity analyst at your organization notices unusual traffic patterns coming from an endpoint device...
  9. 9.A cybersecurity analyst is tasked with implementing endpoint protection for a company's devices. The analyst...
  10. 10.A cybersecurity analyst is tasked with protecting a corporate network and its endpoints. The analyst needs to...
  11. 11.Your organization uses a legacy antivirus solution to protect endpoints. Recently, multiple systems were...
  12. 12.A cybersecurity analyst is tasked with protecting a legacy system that relies on a traditional antivirus...
  13. 13.A security analyst is tasked with investigating an ongoing phishing attack targeting employees within their...
  14. 14.A security operations center (SOC) team is overwhelmed by a large volume of alerts generated by multiple...
  15. 15.A cybersecurity analyst is tasked with deploying an application in a secure environment. The application must...
  16. 16.An organization is running a critical web application inside a containerized environment on multiple hosts....
  17. 17.A company has recently migrated its application workloads to a public cloud provider. The security team is...
  18. 18.An organization has recently migrated its web application to a public cloud environment. To improve its...
  19. 19.An organization has recently experienced a data breach where sensitive customer information was accessed by...
  20. 20.While investigating a potential security breach, an analyst notices that an unauthorized individual accessed...
  21. 21.A cybersecurity operations center receives reports of a new malware campaign targeting financial...
  22. 22.A security analyst at your organization receives a threat intelligence report indicating a new malware...
  23. 23.During a proactive threat-hunting exercise, a cybersecurity analyst notices a sudden spike in outbound...
  24. 24.During a routine threat-hunting session, a cybersecurity analyst notices abnormal outbound traffic from a...
  25. 25.A security analyst is tasked with analyzing a suspicious file that was flagged by the organization's email...
  26. 26.During an investigation of a suspicious file, a cybersecurity analyst performs static analysis and discovers...
  27. 27.A cybersecurity analyst at a SOC has identified suspicious activity indicating a potential data exfiltration...
  28. 28.An organization has recently fallen victim to a sophisticated cyberattack that exfiltrated sensitive customer...
  29. 29.A Security Operations Center (SOC) analyst is investigating an alert for potential malware activity. The SOC...
  30. 30.A security operations center (SOC) analyst is tasked with responding to numerous alerts triggered by a...
  31. 31.A cybersecurity analyst is tasked with investigating a suspicious executable file found on a company...
  32. 32.During an investigation of a suspicious executable file, a cybersecurity analyst decides to perform reverse...
  33. 33.You are a cybersecurity analyst monitoring network traffic using a security information and event management...
  34. 34.You are monitoring network traffic for anomalies using a sliding window anomaly detection algorithm. During a...
  35. 35.As a cybersecurity analyst, you are tasked with conducting threat modeling for a new web application that...
  36. 36.As part of a cybersecurity assessment, a SOC team is performing threat modeling for a new web application...
  37. 37.A cybersecurity operations team is adopting a DevSecOps approach to integrate security into their software...
  38. 38.A security operations center (SOC) analyst is reviewing the development pipeline of a company that recently...
  39. 39.You are a cybersecurity analyst investigating a recent data breach. The attacker exploited a vulnerability in...
  40. 40.A security operations center (SOC) is investigating a potential data breach involving sensitive customer...
  41. 41.A cybersecurity analyst at your organization has conducted a risk assessment for a newly implemented web...
  42. 42.A cybersecurity analyst is tasked with evaluating the risk of a newly discovered vulnerability in the...
  43. 43.A SOC analyst is investigating suspicious activity on a company's network. They discover that an attacker has...
  44. 44.A company's security operations center (SOC) has detected a suspicious file being downloaded from an external...
  45. 45.You are working as a cybersecurity analyst and discover that a critical web application on your...
  46. 46.A cybersecurity analyst discovers that an outdated web server in the organization is running software with a...
  47. 47.A cybersecurity analyst is investigating a reported incident where an attacker successfully exploited a known...
  48. 48.A security analyst is investigating a recent data breach where an attacker leveraged a software vulnerability...
  49. 49.A company wants to improve its cybersecurity posture using a defense-in-depth strategy. The security team...
  50. 50.You are a cybersecurity analyst for a medium-sized company. The organization recently experienced a...
  51. 51.A cybersecurity analyst is tasked with implementing an access control model for a financial organization's...
  52. 52.An organization wants to secure its database containing sensitive financial records. Only employees in the...
  53. 53.A system administrator at a company is responsible for granting access to sensitive files. They decide to...
  54. 54.A cybersecurity analyst is tasked with configuring access permissions on a file server for a newly created...
  55. 55.A healthcare organization uses a database to store sensitive patient records. The organization implements a...
  56. 56.A company is implementing a mandatory access control (MAC) system to protect sensitive customer data. In this...
  57. 57.A cybersecurity analyst is tasked with configuring access control for a secure database containing sensitive...
  58. 58.A cybersecurity analyst is working in an organization that uses a mandatory access control (MAC) model to...
  59. 59.A security analyst is reviewing login attempts on a corporate network and notices that users are being denied...
  60. 60.A company's cybersecurity operations team is implementing a solution to control access to its internal...
  61. 61.An organization is implementing a rule-based access control (RBAC) system for securing access to their...
  62. 62.A cybersecurity analyst is configuring access control for a file server that contains sensitive documents....
  63. 63.A security analyst is tasked with configuring time-based access control for a contractor who needs temporary...
  64. 64.A financial organization has implemented a time-based access control policy to restrict access to its...
  65. 65.A cybersecurity analyst is tasked with implementing role-based access control (RBAC) in their organization....
  66. 66.A company uses a role-based access control (RBAC) model for managing access to its internal systems. The...
  67. 67.A cybersecurity analyst is tasked with implementing Attribute-Based Access Control (ABAC) in an organization...
  68. 68.A cybersecurity analyst is configuring access control for a sensitive database containing customer data. The...
  69. 69.You are analyzing a recently disclosed vulnerability using the CVSS framework. The vulnerability allows...
  70. 70.A cybersecurity analyst is reviewing a vulnerability report that includes a CVSS score of 9.8. The report...
  71. 71.A financial institution reports that an attacker gained unauthorized access to its internal systems by...
  72. 72.A cybersecurity analyst is investigating a data breach at a retail company. The threat actor gained...
  73. 73.A cybersecurity analyst is investigating a recent attack on a company’s web application. The attacker...
  74. 74.A cybersecurity analyst is investigating two different attacks: one involves exploiting a zero-day...
  75. 75.A junior cybersecurity analyst is tasked with analyzing logs from a web server to investigate a potential...
  76. 76.A security analyst in your team is tasked with investigating a suspected data exfiltration incident involving...
  77. 77.A security analyst is investigating a phishing attack on their organization. During the investigation, they...
  78. 78.A security analyst receives a report from a user who claims their workstation is running slower than usual...
  79. 79.A cybersecurity analyst is tasked with investigating a potential data breach that occurred in the...
  80. 80.During an investigation of a potential data breach, the cybersecurity operations team is tasked with defining...
  81. 81.A cybersecurity analyst is assessing a newly discovered vulnerability in a critical system. The team is using...
  82. 82.A cybersecurity analyst is assessing a newly discovered vulnerability in their organization's infrastructure....
  83. 83.A cybersecurity analyst is assessing the environmental metrics of a vulnerability using the CVSS (Common...
  84. 84.A cybersecurity analyst is evaluating an organization's environmental metrics to assess its readiness for...
  85. 85.An organization is facing challenges in detecting advanced threats across its infrastructure, which includes...
  86. 86.A Security Operations Center (SOC) analyst is monitoring a hybrid environment consisting of on-premises...
  87. 87.A security analyst is monitoring network traffic and notices an unusual amount of outbound data from a...
  88. 88.A cybersecurity analyst is monitoring network traffic and notices a sudden increase in outbound data...
  89. 89.A security analyst is tasked with identifying a potentially compromised host within a network. The analyst...
  90. 90.A security analyst is monitoring network traffic in a Security Operations Center (SOC). The analyst notices a...
  91. 91.A cybersecurity analyst is monitoring network traffic in a Security Operations Center (SOC). They are using...
  92. 92.An organization's SOC team notices an unusual spike in outbound network traffic from a critical server during...
  93. 93.A security analyst is monitoring an organization's network and notices a sudden spike in outbound traffic to...
  94. 94.An online retail company is conducting a security review of its e-commerce platform. During the review, the...
  95. 95.A cybersecurity analyst is reviewing an organization's security posture and notices that an outdated web...
  96. 96.An organization is deploying several cybersecurity tools to monitor and protect its network. Which of the...
  97. 97.A security analyst is investigating an incident using data collected from various tools. Which of the...
  98. 98.You are a junior security analyst investigating unusual network activity. Your team lead asks you to use...
  99. 99.During a cybersecurity investigation, you are tasked with capturing and analyzing network traffic on a Linux...
  100. 100.An organization is experiencing unusual network activity, and you are tasked with using NetFlow to...
  101. 101.A cybersecurity analyst is investigating unusual traffic patterns within a corporate network. The analyst...
  102. 102.A cybersecurity analyst is configuring a Next-Generation Firewall (NGFW) in an enterprise environment. One of...
  103. 103.A cybersecurity analyst is tasked with configuring a next-generation firewall (NGFW) to enhance threat...
  104. 104.A network administrator has deployed a traditional stateful firewall to protect the internal network of an...
  105. 105.During a security audit, a network administrator observes that a traditional stateful firewall is not...
  106. 106.A cybersecurity analyst at a company notices an unusual spike in network traffic originating from an internal...
  107. 107.A cybersecurity analyst is tasked with monitoring and controlling the usage of applications within the...
  108. 108.A network administrator has noticed an increase in malware infections originating from users visiting...
  109. 109.A company deploys a web content filtering solution to block access to malicious websites and restrict...
  110. 110.A security analyst at your organization has configured an email content filtering solution to block emails...
  111. 111.A cybersecurity analyst at a company receives reports of phishing emails bypassing the organization's email...
  112. 112.A cybersecurity analyst is tasked with monitoring a hybrid network environment that includes on-premises...
  113. 113.A security analyst is tasked with monitoring network traffic for potential threats. However, the organization...
  114. 114.A security analyst is tasked with configuring an access control list (ACL) on a router to block all incoming...
  115. 115.You are a junior cybersecurity analyst tasked with implementing an access control list (ACL) on a network...
  116. 116.A network administrator has configured a router to use PAT (Port Address Translation) for internal devices...
  117. 117.A company has deployed a NAT/PAT configuration on their edge router to allow internal devices with private IP...
  118. 118.A cybersecurity analyst discovers that attackers are using tunneling techniques to bypass the organization’s...
  119. 119.A cybersecurity analyst notices unusual traffic on the network, where data packets from a banned application...
  120. 120.A security analyst is monitoring network traffic and notices an unusual spike in encrypted outbound...
  121. 121.You are an analyst in a SOC (Security Operations Center) investigating unusual traffic on your organization's...
  122. 122.A cybersecurity analyst is tasked with ensuring that sensitive emails sent by employees are protected from...
  123. 123.A cybersecurity analyst is tasked with securing data transmitted between two remote locations over an...
  124. 124.A cybersecurity analyst at your organization detects unusual outbound traffic from a user workstation. Upon...
  125. 125.A security analyst observes unusual network activity on a corporate network. Upon investigation, they...
  126. 126.A cybersecurity analyst is reviewing network traffic using a packet capture tool. They observe that data is...
  127. 127.A security analyst is troubleshooting a network issue where packets sent between two devices are not reaching...
  128. 128.A cybersecurity analyst is tasked with implementing load balancing to ensure high availability and optimal...
  129. 129.A company’s web application is experiencing high traffic, causing performance issues on its servers. The...
  130. 130.A security analyst is tasked with reviewing logs to identify a potential insider threat. They are advised to...
  131. 131.A cybersecurity analyst is monitoring network traffic logs and notices a sudden surge in outbound traffic to...
  132. 132.A security analyst at an organization is investigating a potential data exfiltration incident. They decide to...
  133. 133.A cybersecurity analyst is tasked with investigating a suspected data exfiltration incident. To analyze the...
  134. 134.You are a cybersecurity analyst reviewing a suspicious event in a network monitoring tool. You notice a spike...
  135. 135.A cybersecurity analyst is investigating a potential data exfiltration incident. They decide to review...
  136. 136.During a cybersecurity investigation, a Security Operations Center (SOC) analyst is tasked with analyzing...
  137. 137.An e-commerce company has detected unauthorized transactions in their payment system. As part of your...
  138. 138.You are a cybersecurity analyst investigating potential anomalies in an organization's network traffic. By...
  139. 139.A cybersecurity analyst is monitoring network traffic and notices an unusual spike in outbound traffic from...
  140. 140.A security analyst is investigating a potential data breach involving file transfers. They decide to review...
  141. 141.During a cybersecurity investigation, you are analyzing a suspicious email attachment. Metadata from the file...
  142. 142.You are a cybersecurity analyst working in a Security Operations Center (SOC). You receive an alert from your...
  143. 143.A cybersecurity analyst is reviewing alert data from a Security Information and Event Management (SIEM)...
  144. 144.A financial organization's web server suddenly becomes unresponsive, and an investigation reveals a flood of...
  145. 145.A cybersecurity analyst observes a sudden spike in traffic targeting a web server. The traffic originates...
  146. 146.A cybersecurity analyst detects unusual behavior on their network where a legitimate service, used for secure...
  147. 147.An attacker sets up a rogue access point to intercept communications between a user and a legitimate web...
  148. 148.A cybersecurity analyst is reviewing logs from a web application after users report unusual behavior. The...
  149. 149.A cybersecurity analyst is investigating a web application vulnerability affecting a company's customer...
  150. 150.An employee at a financial institution receives an email from what appears to be their IT department,...
  151. 151.A cybersecurity analyst receives a report that an employee was tricked into revealing their login credentials...
  152. 152.A cybersecurity analyst detects unusual outbound traffic from multiple endpoints within the network. Further...
  153. 153.A security analyst observes unusual outbound traffic from multiple endpoints within the network. After...
  154. 154.A financial institution has experienced a ransomware attack where critical customer data was encrypted. The...
  155. 155.A medium-sized company has been hit by a ransomware attack. The attackers have encrypted critical business...
  156. 156.A cybersecurity analyst discovers that an attacker is using an encrypted communication channel to exfiltrate...
  157. 157.An attacker is attempting to exfiltrate sensitive data from a corporate network without being detected by...
  158. 158.An organization implements a Public Key Infrastructure (PKI) to secure communication between its internal web...
  159. 159.An organization is implementing HTTPS on their web servers to ensure secure communication with clients....
  160. 160.A network administrator is configuring secure communication between two devices using encryption. They decide...
  161. 161.You are a cybersecurity analyst investigating encrypted communication between two endpoints on a network. The...
  162. 162.During an investigation, a cybersecurity analyst is presented with a digital certificate used to secure a web...
  163. 163.A cybersecurity analyst is reviewing an HTTPS certificate for a website that users reported as suspicious....
  164. 164.During a security review, your team discovers that a web server is using an outdated cipher suite to secure...
  165. 165.During a security audit, a cybersecurity analyst discovers that a web server is configured with the following...
  166. 166.A cybersecurity analyst is investigating a secure web server's X.509 certificate after users reported browser...
  167. 167.A cybersecurity analyst is investigating a security incident involving a compromised internal web server....
  168. 168.A cybersecurity analyst is configuring a secure communication channel between two systems and needs to ensure...
  169. 169.During a secure communication session between two parties, they decide to use the Diffie-Hellman (DH) key...
  170. 170.A security analyst is tasked with configuring a secure connection between a client and a server using SSH....
  171. 171.A cybersecurity analyst is investigating a case where an outdated protocol version is suspected to be the...
  172. 172.A security analyst is tasked with implementing secure key exchange and encryption mechanisms for an...
  173. 173.A security analyst is tasked with implementing a secure key exchange mechanism for a system that uses public...
  174. 174.A security analyst is investigating an endpoint that has been flagged for suspicious activity. During...
  175. 175.A security analyst is investigating an alert from an endpoint detection and response (EDR) system. The alert...
  176. 176.A company has recently deployed endpoint technologies to improve its security posture. The cybersecurity...
  177. 177.A cybersecurity analyst is tasked with securing endpoint devices in a corporate network. Which of the...
  178. 178.A cybersecurity analyst is tasked with monitoring network traffic for potential threats. The organization...
  179. 179.A security operations center (SOC) analyst is monitoring traffic in a network using a threat detection system...
  180. 180.You are a cybersecurity analyst tasked with monitoring an organization's endpoints using a Host-based...
  181. 181.A security operations team is using a host-based intrusion detection system (HIDS) to monitor a critical...
  182. 182.A cybersecurity analyst is investigating multiple reports of a new strain of malware spreading within the...
  183. 183.A company’s Security Operations Center (SOC) has implemented an antimalware solution across all endpoints in...
  184. 184.A security analyst is tasked with protecting a critical server that processes sensitive financial data. The...
  185. 185.A cybersecurity analyst is investigating a suspected malware infection on a workstation. The analyst notices...
  186. 186.A cybersecurity analyst is investigating a potential malware infection on a Linux server. The analyst needs...
  187. 187.A cybersecurity analyst is investigating a potential malware infection on a Windows system. The analyst...
  188. 188.A Security Operations Center (SOC) analyst receives an alert indicating unusual outbound traffic from a...
  189. 189.A cybersecurity analyst at a Security Operations Center (SOC) is investigating an incident where a user's...
  190. 190.During a cybersecurity investigation, a security analyst identifies suspicious activity originating from an...
  191. 191.During a cybersecurity investigation, a security analyst identifies an IP address linked to malicious...
  192. 192.A cybersecurity analyst at a company is performing an inventory of the organization's assets. Which of the...
  193. 193.You are a cybersecurity analyst tasked with securing an organization’s network. During an asset inventory...
  194. 194.A company has noticed unusual activity on its network, including exfiltration of sensitive data. Further...
  195. 195.A cybersecurity analyst is investigating a recent data breach at a financial organization. The attacker...
  196. 196.You are a cybersecurity analyst reviewing logs from an endpoint detection and response (EDR) system. You...
  197. 197.A security analyst is reviewing system logs and notices unusual DNS requests, unexpected outbound traffic to...
  198. 198.A cybersecurity analyst is monitoring network activity and notices an increase in outbound traffic to an...
  199. 199.A security analyst is monitoring network traffic and notices a surge in outbound data from an internal...
  200. 200.During an investigation of a suspected insider threat, a cybersecurity analyst collects a USB drive from the...
  201. 201.A cybersecurity analyst is investigating an incident involving unauthorized access to a company's database....
  202. 202.A security analyst is investigating a potential unauthorized access attempt on a company server. The analyst...
  203. 203.A security analyst is investigating an incident where unauthorized access to a server occurred. The analyst...
  204. 204.During a forensic investigation of a security breach, an analyst collects several types of evidence from the...
  205. 205.During an incident investigation, a cybersecurity analyst is tasked with collecting evidence from a...
  206. 206.A cybersecurity analyst is investigating a suspected phishing email that was reported by an employee. The...
  207. 207.During a cybersecurity investigation, an analyst discovers suspicious network traffic from an internal IP...
  208. 208.A SOC analyst is investigating a potential insider threat incident where an employee is suspected of...
  209. 209.A cybersecurity analyst is investigating a suspected phishing attack on their organization. While analyzing...
  210. 210.A security analyst is investigating an unusual spike in outbound network traffic from a server in the...
  211. 211.A cybersecurity analyst receives an alert from the SIEM platform regarding unusual outbound traffic from a...
  212. 212.A security analyst is monitoring logs in a Security Information and Event Management (SIEM) system and...
  213. 213.A cybersecurity analyst is monitoring the organization's Security Information and Event Management (SIEM)...
  214. 214.You are reviewing the output of a malware analysis tool that operates as a detonation chamber. The report...
  215. 215.A cybersecurity analyst is reviewing the output of a malware detonation chamber tool. The report indicates...
  216. 216.A cybersecurity analyst is investigating a suspicious email attachment that might contain malware. They...
  217. 217.A security analyst is investigating a suspicious email attachment. To analyze the behavior of the attachment...
  218. 218.A security analyst is investigating a potential data breach and has been provided with a file suspected of...
  219. 219.During a cybersecurity investigation, an analyst is tasked with verifying the integrity of a file suspected...
  220. 220.A security analyst is investigating suspicious activity on a corporate network. The analyst notices that a...
  221. 221.A cybersecurity analyst is investigating a suspicious email that contains a link. Upon inspection, the URL in...
  222. 222.A cybersecurity analyst is investigating a suspected malicious activity in a network. They notice an...
  223. 223.A security analyst is monitoring a network for unusual activity and notices a significant spike in traffic...
  224. 224.
  225. 225.You are a cybersecurity analyst monitoring network traffic in the Security Operations Center (SOC). You...
  226. 226.You are a cybersecurity analyst reviewing IDS (Intrusion Detection System) logs after an unusual traffic...
  227. 227.A security analyst is investigating a series of unusual login attempts to a company's internal systems. The...
  228. 228.A cybersecurity analyst is investigating an alert about repeated failed login attempts on a company server....
  229. 229.You are a cybersecurity analyst monitoring network traffic in your organization. Your Intrusion Detection...
  230. 230.A Security Operations Center (SOC) analyst is tasked with configuring an Intrusion Detection System (IDS) and...
  231. 231.A cybersecurity analyst is tasked with configuring a firewall to restrict access to a web server hosted in...
  232. 232.A network administrator has configured a stateful firewall to protect their internal network. Recently, users...
  233. 233.A network administrator notices that employees are using a cloud-based file-sharing application that violates...
  234. 234.A cybersecurity analyst at your organization notices unusual traffic patterns originating from a specific...
  235. 235.You are a Security Analyst investigating a suspected data exfiltration incident. While analyzing proxy logs,...
  236. 236.You are a cybersecurity analyst reviewing proxy logs to investigate a potential data exfiltration event. The...
  237. 237.During a cybersecurity investigation, a Security Operations Center (SOC) analyst observes that multiple...
  238. 238.A security analyst at a small organization notices that multiple endpoints have been infected by a known...
  239. 239.A network administrator is investigating suspicious activity on the company's network. They decide to analyze...
  240. 240.A security analyst is investigating a potential data exfiltration incident in their network. The analyst...
  241. 241.Your organization’s Security Operations Center (SOC) detects unauthorized access to a file server containing...
  242. 242.A security analyst is reviewing the logs of a company’s file server and notices that a non-critical...
  243. 243.You are a Security Analyst reviewing alerts in your organization's Security Information and Event Management...
  244. 244.A cybersecurity analyst at a Security Operations Center (SOC) is investigating an alert generated by the...
  245. 245.A cybersecurity analyst is monitoring an Intrusion Detection System (IDS) in a corporate environment. The...
  246. 246.A cybersecurity analyst is monitoring traffic logs on a network using an intrusion detection system (IDS). A...
  247. 247.During a routine security monitoring task, a cybersecurity analyst observes an alert triggered by the...
  248. 248.You are a SOC analyst monitoring a network for potential threats. During an investigation, an intrusion...
  249. 249.A cybersecurity analyst is monitoring network traffic using a Security Information and Event Management...
  250. 250.You are a Security Analyst in a SOC. During routine analysis, the Intrusion Detection System (IDS) flags...
  251. 251.A cybersecurity analyst is investigating a suspicious file flagged by an endpoint detection and response...
  252. 252.You are monitoring network traffic as part of a cybersecurity operations team. Your intrusion detection...
  253. 253.A network security analyst is configuring a firewall to enhance security for a corporate network. The analyst...
  254. 254.A cybersecurity analyst is tasked with implementing a firewall solution for a company's network. The main...
  255. 255.A cybersecurity analyst is tasked with implementing a solution to monitor network traffic for potential...
  256. 256.A network administrator is tasked with monitoring traffic in a critical server environment without disrupting...
  257. 257.An organization is implementing network monitoring to detect potential security threats. The security team is...
  258. 258.A cybersecurity analyst is tasked with monitoring network traffic for potential threats. The analyst is...
  259. 259.A cybersecurity analyst is investigating unusual activity on the network. They decide to analyze NetFlow data...
  260. 260.A cybersecurity analyst is tasked with investigating unusual network activity on their organization's...
  261. 261.You are investigating a potential data breach and have been provided with a PCAP file containing suspicious...
  262. 262.While analyzing a PCAP file in Wireshark, you identify an HTTP stream containing a suspicious file download....
  263. 263.You are analyzing a PCAP file and notice a series of TCP packets where one host is sending a large number of...
  264. 264.You are analyzing a PCAP file from a suspected intrusion. Within the packet data, you notice an outbound...
  265. 265.A security analyst is investigating suspicious traffic flagged by the intrusion detection system (IDS). Upon...
  266. 266.A security analyst is investigating unusual activity on the company network. They notice a high number of...
  267. 267.A cybersecurity analyst is monitoring network traffic and notices multiple alerts indicating communication...
  268. 268.A cybersecurity analyst is monitoring network traffic and notices multiple outbound connections from an...
  269. 269.A cybersecurity analyst is investigating suspicious traffic on the network and notices that multiple packets...
  270. 270.A cybersecurity analyst is investigating suspicious traffic originating from a corporate workstation. The...
  271. 271.A cybersecurity analyst is investigating suspicious activity on the network and notices an unusual amount of...
  272. 272.A SOC analyst is investigating suspicious traffic on the network. They observe multiple connection attempts...
  273. 273.A security analyst is investigating unusual traffic patterns within the network and observes that a large...
  274. 274.A security analyst is investigating unusual network traffic patterns within an organization. They identify...
  275. 275.A cybersecurity analyst is investigating suspicious activity on a network. During the analysis, they find an...
  276. 276.A cybersecurity analyst is investigating a suspicious email attachment that was flagged by the organization's...
  277. 277.During an intrusion analysis, a security analyst notices unusual traffic originating from a specific IP...
  278. 278.An intrusion detection analyst is reviewing logs from a suspected malicious activity on the network. The...
  279. 279.A security analyst is investigating suspicious network activity and captures an Ethernet frame using a packet...
  280. 280.An analyst is reviewing a packet capture and observes an Ethernet frame with the following characteristics: a...
  281. 281.A cybersecurity analyst at a Security Operations Center (SOC) is investigating a suspected malicious activity...
  282. 282.You are a cybersecurity analyst tasked with investigating a potential network breach. You notice a suspicious...
  283. 283.You are a security analyst investigating a potential unauthorized network access incident in an enterprise...
  284. 284.A security analyst is investigating suspicious activity on a company's network that uses both IPv4 and IPv6....
  285. 285.A cybersecurity analyst notices that a specific application is failing to establish a connection with a...
  286. 286.An organization is troubleshooting an issue where a web application running on a server is not receiving any...
  287. 287.You are analyzing traffic in a network monitoring tool and notice a consistent stream of UDP packets being...
  288. 288.A cybersecurity analyst is investigating unusual traffic on the network. They observe a significant number of...
  289. 289.A cybersecurity analyst is monitoring traffic on the network and notices a significant number of ICMP Echo...
  290. 290.A cybersecurity analyst is investigating unusual network activity within their organization. They notice a...
  291. 291.A Security Operations Center (SOC) analyst is investigating an incident where users are being redirected to...
  292. 292.A cybersecurity operations analyst is investigating a possible DNS tunneling attack in a corporate network....
  293. 293.A cybersecurity analyst is investigating a suspected phishing attack involving email communication. During...
  294. 294.An organization has detected unusual activity on its email server, including unauthorized access to messages...
  295. 295.During an investigation, a cybersecurity analyst observes that a user is accessing a sensitive internal web...
  296. 296.A cybersecurity analyst is investigating an incident where sensitive information was intercepted during...
  297. 297.A security analyst is investigating a network issue where multiple devices on the same subnet are...
  298. 298.A cybersecurity analyst observes unusual network activity where multiple devices on the network are unable to...
  299. 299.You are analyzing an alert generated by a Security Information and Event Management (SIEM) system. The event...
  300. 300.A cybersecurity analyst at your organization receives an alert from a SIEM tool indicating potentially...
  301. 301.A cybersecurity analyst is investigating network traffic related to a potential data exfiltration attempt. In...
  302. 302.A cybersecurity analyst is investigating suspicious traffic in a network. They observe that a particular...
  303. 303.An analyst is investigating a potential security incident involving unusual traffic on a corporate network....
  304. 304.A cybersecurity analyst is investigating a suspected malicious connection between a client and a server. The...
  305. 305.A security analyst is investigating suspicious activity on a workstation and notices an unknown process...
  306. 306.While investigating a potential malware infection on a Windows server, a cybersecurity analyst notices an...
  307. 307.You are a junior SOC analyst investigating suspicious behavior in a cloud-hosted application. During your...
  308. 308.A security analyst is investigating unusual activity on a web server. During the investigation, the analyst...
  309. 309.As a junior cybersecurity analyst, you are investigating a suspected malware file found on a company system....
  310. 310.During an incident investigation, a cybersecurity analyst is asked to verify the integrity of a suspicious...
  311. 311.A security analyst observes an alert indicating that an attacker attempted to exploit a vulnerable web...
  312. 312.A security analyst is investigating a phishing attack where an employee received an email that directed them...
  313. 313.As a junior cybersecurity analyst, you are tasked with creating a filter in a SIEM tool to identify log...
  314. 314.You are tasked with filtering log entries to identify IP addresses from a server log file. The log contains...
  315. 315.A cybersecurity analyst at your organization has identified an incident involving unauthorized access to...
  316. 316.A security operations team is tasked with implementing a new Acceptable Use Policy (AUP) for all employees to...
  317. 317.A Security Operations Center (SOC) team is implementing a new access control policy to improve their...
  318. 318.A network administrator is tasked with implementing access control policies for a new system. They need to...
  319. 319.A cybersecurity analyst at an organization is reviewing the asset inventory to identify which devices are...
  320. 320.A cybersecurity analyst is tasked with creating an asset inventory for the organization. During this process,...
  321. 321.A security operations team is investigating a recent breach in which an unauthorized user gained access to...
  322. 322.As a cybersecurity analyst, you are investigating a security incident in which unauthorized changes were made...
  323. 323.A company has implemented a Mobile Device Management (MDM) solution to secure employee devices accessing...
  324. 324.A company has recently implemented a Mobile Device Management (MDM) solution to secure corporate data on...
  325. 325.A cybersecurity analyst at your organization is tasked with ensuring that all systems are protected against...
  326. 326.A cybersecurity analyst at your organization discovers that a critical vulnerability has been identified in a...
  327. 327.A company has recently deployed a new web application. During a routine vulnerability scan, the security...
  328. 328.A cybersecurity analyst at your organization has identified a critical vulnerability in one of the web...
  329. 329.A cybersecurity operations team is developing their organization's incident response plan in alignment with...
  330. 330.An organization is developing its incident response plan based on NIST SP 800-61 guidelines. Which of the...
  331. 331.Your organization’s security team has detected unusual outbound traffic from a corporate workstation,...
  332. 332.Your organization has detected unusual outbound traffic from a workstation, indicating a potential data...
  333. 333.During a cybersecurity incident, your team observes unusual outbound traffic from multiple systems in the...
  334. 334.During a cybersecurity incident at a financial institution, the security operations team is tasked with...
  335. 335.An organization is in the process of preparing for potential cybersecurity incidents. Which of the following...
  336. 336.Your organization is developing a cybersecurity incident response plan. As part of the preparation phase, you...
  337. 337.A cybersecurity analyst is monitoring a network using a SIEM solution and detects unusual outbound traffic...
  338. 338.A Security Operations Center (SOC) analyst is monitoring network traffic and notices unusual outbound...
  339. 339.During a cybersecurity incident, an organization's email server has been compromised and is being used to...
  340. 340.A cybersecurity analyst in your organization identifies malware spreading laterally across the network. After...
  341. 341.After a ransomware attack on an organization, the incident response team conducts a post-incident analysis....
  342. 342.After a ransomware attack on a company's network was mitigated, the cybersecurity team conducted a...
  343. 343.Your company is in the process of implementing a formal Incident Response (IR) plan based on the NIST SP...
  344. 344.A cybersecurity analyst is tasked with aligning organizational stakeholders with the NIST Incident Response...
  345. 345.A security analyst is monitoring a network using an intrusion detection system (IDS). The IDS generates an...
  346. 346.An organization has detected unusual outbound traffic from an internal server. As a security analyst, you...
  347. 347.A financial organization is preparing its cybersecurity team to respond to potential ransomware attacks. As...
  348. 348.Your organization is preparing for potential cybersecurity incidents by developing an incident response plan...
  349. 349.A security analyst is monitoring network traffic and notices a significant increase in outbound traffic to an...
  350. 350.You are a cybersecurity analyst monitoring network traffic in your organization. During your analysis, you...
  351. 351.You are a cybersecurity analyst responding to a ransomware attack on a company's file server. The attacker...
  352. 352.You are a cybersecurity analyst responding to a ransomware attack on a company’s network. After isolating the...
  353. 353.Following a ransomware attack on a company's network, the security team conducts a post-incident analysis to...
  354. 354.After a recent cybersecurity incident in which an organization's sensitive data was leaked, the incident...
  355. 355.A cybersecurity operations team is tasked with conducting a digital forensic investigation after a data...
  356. 356.You are a cybersecurity analyst investigating a potential security incident at a financial institution....
  357. 357.A cybersecurity analyst is responding to a ransomware attack on a company network. The attack has encrypted...
  358. 358.You are a cybersecurity analyst responding to a suspected data breach in your organization's network. During...
  359. 359.A cybersecurity analyst is investigating a suspected data breach in an organization. During the analysis,...
  360. 360.A security analyst is investigating a suspected data breach where an attacker might have altered sensitive...
  361. 361.An organization has detected unauthorized access to a critical file server. The cybersecurity team has been...
  362. 362.A cybersecurity analyst is investigating a potential data breach at an organization. The analyst needs to...
  363. 363.A security analyst is responding to a suspected malware infection on a critical production server. The...
  364. 364.During an active incident response investigation, a cybersecurity analyst needs to collect volatile data from...
  365. 365.A network security analyst is tasked with creating a network profile to better understand the organization's...
  366. 366.During routine network monitoring, a cybersecurity analyst is tasked with profiling the organization's...
  367. 367.A cybersecurity analyst is monitoring the performance of a network intrusion detection system (NIDS) deployed...
  368. 368.A cybersecurity analyst is monitoring a network's total throughput to ensure that no single device or...
  369. 369.During a network investigation, a cybersecurity analyst notices unusually long session durations for a...
  370. 370.A cybersecurity analyst is monitoring a web application and notices several sessions with unusually long...
  371. 371.A cybersecurity analyst is investigating suspicious network activity on a corporate network. They observe a...
  372. 372.A security analyst is monitoring network traffic and notices a large amount of suspicious activity on TCP...
  373. 373.During a routine network scan, a cybersecurity analyst discovers that an unauthorized user has accessed a...
  374. 374.An organization has identified its critical asset address space, which includes its primary database servers,...
  375. 375.As a cybersecurity analyst, you are tasked with server profiling to identify potential risks in your...
  376. 376.You are a cybersecurity analyst tasked with profiling a web server in your organization's network. Which of...
  377. 377.During a routine network audit, you discover an unknown process running on a server. You use the netstat...
  378. 378.A cybersecurity analyst notices unusual activity on a critical server in the network. Upon investigation,...
  379. 379.During a routine security audit, you discover that several service accounts on a critical server are being...
  380. 380.A cybersecurity analyst is reviewing logs from a critical server and notices the presence of a service...
  381. 381.A cybersecurity analyst is investigating a potential malware infection on a Windows workstation. During the...
  382. 382.While investigating a compromised server, you suspect a malicious process is running on the system. Which of...
  383. 383.You are a junior cybersecurity analyst investigating a suspicious process running on a Windows server. You...
  384. 384.A SOC analyst is tasked with automating the process of checking for vulnerabilities in endpoint systems. They...
  385. 385.An incident response team has detected unusual traffic patterns from a web application server in their...
  386. 386.Your organization recently deployed a new web application to handle sensitive customer data. The application...
  387. 387.During a network security audit, you are tasked with identifying protected data being transmitted over the...
  388. 388.You are a security analyst investigating data traffic on your organization's network. During your analysis,...
  389. 389.You are a cybersecurity analyst reviewing a corporate database that stores customer data. During your...
  390. 390.You are working as a security analyst for a company, and you receive a report about a potential data breach...
  391. 391.A cybersecurity analyst in your organization is using Protocol Statistics Information (PSI) to monitor...
  392. 392.As a cybersecurity analyst, you are tasked with investigating unusual activity on a company's network. During...
  393. 393.You are a cybersecurity analyst working for a healthcare organization. During a routine investigation, you...
  394. 394.A healthcare organization has experienced a ransomware attack where sensitive patient information, including...
  395. 395.A cybersecurity analyst at your organization identifies an unauthorized attempt to exfiltrate a proprietary...
  396. 396.A cybersecurity analyst at your organization discovers that an employee has been using company resources to...
  397. 397.A security analyst is investigating an intrusion event where an attacker gained access to a system through a...
  398. 398.A security analyst is investigating an intrusion event where an attacker successfully sent a phishing email...
  399. 399.A cybersecurity analyst is investigating a recent intrusion into their organization's network. They decide to...
  400. 400.An organization has detected a potential intrusion in their network. During the investigation, the security...
  401. 401.A Security Operations Center (SOC) team is analyzing an incident involving suspicious network traffic. They...
  402. 402.A Security Operations Center (SOC) team is analyzing an incident and wants to improve their metrics for scope...
  403. 403.A cybersecurity analyst in a Security Operations Center (SOC) detects suspicious activity on a critical...
  404. 404.An organization detects unauthorized access to a critical server and immediately initiates their incident...
  405. 405.

200-201 exam dumps FAQ

Are these 200-201 dumps real exam questions?

No. These are original practice questions written to the Cisco Cybersecurity Associate exam objectives, not questions copied from a live exam. Memorising leaked questions violates Cisco's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many 200-201 practice questions are there?

405 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the 200-201 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed 200-201 practice test?

Sign in and start the Cisco Cybersecurity Associate exam on HydraNode. A session gives you 75 questions drawn from this bank in 120 minutes, then a score report with a per-question review.

What topics does the 200-201 exam cover?

The official exam domains are: Security Concepts; Security Monitoring; Host-Based Analysis; Network Intrusion Analysis; Security Policies and Procedures.

More Cisco exam dumps

All Cisco exams
300-435322 questions

Cisco ENAUTO exam dumps

Automating Cisco Enterprise Solutions

200-301506 questions

Cisco CCNA exam dumps

Cisco Certified Network Associate

100-160265 questions

Cisco CCST Cybersecurity exam dumps

Cisco Certified Support Technician (CCST) Cybersecurity

100-140390 questions

Cisco CCST IT Support exam dumps

Cisco Certified Support Technician (CCST) IT Support

100-150295 questions

Cisco CCST Networking exam dumps

Cisco Certified Support Technician (CCST) Networking

200-901204 questions

Cisco DevNet Associate (DEVASC) exam dumps

Cisco DevNet Associate

300-215229 questions

Cisco CBRFIR (Forensic Analysis and Incident Response) exam dumps

Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity

350-201289 questions

Cisco CBRCOR (CyberOps Professional Core) exam dumps

Cybersecurity Professional - Performing Cybersecurity Using Cisco Security Technologies