CiscoAssociate level200-201Page 5 of 5

200-201 exam dumps: questions 401 to 403 of 403

Page 5 of the free 200-201 question bank for the Cisco Cybersecurity Associate exam. Questions 401 to 403 are listed below, the first 3 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated January 2025

Start timed practice exam Questions 401 to 403

Free 200-201 practice questions

Questions 402 to 404 of 403

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

200-201 Question 402

Select 2

A Security Operations Center (SOC) team is analyzing an incident and wants to improve their metrics for scope analysis. Which key metrics can directly impact the efficiency of identifying and understanding the scope of the incident?

  1. A

    Time to Detect (TTD)

  2. B

    Time to Respond (TTR)

  3. C

    Time to Containment (TTC)

  4. D

    Time to Resolution (TTR)

  5. E

    False Positive Rate

Show answer and explanation

Correct answers: A, C

Explanation

Metrics such as Time to Detect (TTD) and Time to Containment (TTC) are crucial for understanding and limiting the scope of a security incident. TTD ensures that the SOC identifies incidents promptly, while TTC ensures that the incident is contained quickly to prevent further escalation. These metrics directly affect the SOC's ability to scope, analyze, and manage incidents efficiently.

  • A. Correct.

    Time to Detect (TTD) refers to the time taken to identify an incident, which is critical for understanding the scope of an attack quickly and initiating the response process.

  • B. Incorrect.

    Time to Respond (TTR) is more focused on the actions taken after detection, which is less directly related to initial scope analysis.

  • C. Correct.

    Time to Containment (TTC) measures how quickly the SOC can limit the spread of an incident, which is directly relevant to managing and understanding the scope of the event.

  • D. Incorrect.

    Time to Resolution (TTR) is about fully resolving an incident, which occurs after scope analysis and containment, making it less relevant to this particular context.

  • E. Incorrect.

    False Positive Rate measures the accuracy of detection systems but does not directly relate to the efficiency of scope analysis.

200-201 Question 403

Single answer

A cybersecurity analyst in a Security Operations Center (SOC) detects suspicious activity on a critical server. The analyst follows the incident response process and prioritizes actions to minimize damage. Which step should the SOC analyst take first to effectively manage the incident and reduce the time to control?

  1. A

    Isolate the affected server from the network to prevent further spread

  2. B

    Conduct a forensic analysis to identify the root cause of the attack

  3. C

    Notify senior management and provide detailed incident reports

  4. D

    Restore the affected server from the latest known good backup

Show answer and explanation

Correct answer: A

Explanation

Containment is the top priority in responding to a cybersecurity incident to minimize damage and reduce the time to control. Isolating the affected server effectively stops the attack from spreading, allowing the SOC team to focus on investigating, mitigating, and recovering without risking further harm to the environment.

  • A. Correct.

    Isolating the affected server is critical to containing the threat and preventing further damage to the network. This step reduces the time to control the incident and limits its spread.

  • B. Incorrect.

    Conducting forensic analysis is important but should be performed after the threat is contained to avoid allowing the attack to propagate further.

  • C. Incorrect.

    Notifying senior management is necessary, but it is not the immediate priority during the containment phase of an active incident.

  • D. Incorrect.

    Restoring the affected server is part of the recovery phase, not the containment phase. This action should occur after the threat is neutralized and prevented from recurring.

200-201 Question 404

Select 2

An organization detects unauthorized access to a critical server and immediately initiates their incident response plan. The team observes that the attacker is actively exfiltrating data. Which of the following actions should the team prioritize to minimize the impact of the attack? (Choose two.)

  1. A

    Isolate the affected server from the network to stop further data exfiltration.

  2. B

    Analyze the attacker's tools and techniques before taking action.

  3. C

    Disable user accounts suspected of being compromised.

  4. D

    Notify external stakeholders about the breach immediately.

  5. E

    Preserve forensic evidence while containing the attack.

Show answer and explanation

Correct answers: A, E

Explanation

In incident response, containment is a high-priority action to limit the damage caused by an active attack. Isolating the affected server prevents further exfiltration, and preserving forensic evidence ensures that the organization can analyze the breach post-containment without losing critical information. These actions align with minimizing the time to respond and control the situation effectively.

  • A. Correct.

    Isolating the affected server immediately helps contain the attack and prevents further exfiltration of sensitive data, which is a critical response step.

  • B. Incorrect.

    While analyzing the attacker's tools and techniques is important, it should not take priority over containing the attack in real-time to minimize the damage.

  • C. Incorrect.

    Disabling user accounts could be part of the response but is not as immediate or impactful as isolating the compromised server during active data exfiltration.

  • D. Incorrect.

    Notifying external stakeholders is important but is part of the later stages of incident response (e.g., communication and recovery), not the containment phase.

  • E. Correct.

    Preserving forensic evidence while containing the attack ensures that the organization can investigate the breach without compromising the response effort.

Timed practice exam

Take a 200-201 practice test under exam conditions

75 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

200-201 practice questions 401 to 403 of 403

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 5 pages of up to 100 questions.

  1. 402.A Security Operations Center (SOC) team is analyzing an incident and wants to improve their metrics for scope...
  2. 403.A cybersecurity analyst in a Security Operations Center (SOC) detects suspicious activity on a critical...
  3. 404.An organization detects unauthorized access to a critical server and immediately initiates their incident...

More Cisco exam dumps

All Cisco exams
300-435321 questions

Cisco ENAUTO exam dumps

Automating Cisco Enterprise Solutions

200-301503 questions

Cisco CCNA exam dumps

Cisco Certified Network Associate

100-160264 questions

Cisco CCST Cybersecurity exam dumps

Cisco Certified Support Technician (CCST) Cybersecurity

100-140389 questions

Cisco CCST IT Support exam dumps

Cisco Certified Support Technician (CCST) IT Support

100-150294 questions

Cisco CCST Networking exam dumps

Cisco Certified Support Technician (CCST) Networking

200-901203 questions

Cisco DevNet Associate (DEVASC) exam dumps

Cisco DevNet Associate

300-215228 questions

Cisco CBRFIR (Forensic Analysis and Incident Response) exam dumps

Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity

350-201288 questions

Cisco CBRCOR (CyberOps Professional Core) exam dumps

Cybersecurity Professional - Performing Cybersecurity Using Cisco Security Technologies