200-201 Practice Questions

A Security Information and Event Management (SIEM) system's fundamental role is to aggregate and correlate log and event data from various sources across an organization's infrastructure. Its primary goal is to provide centralized visibility and detect anomalies, potential threats, and security incidents by analyzing this data against predefined rules. In contrast, a Security Orchestration, Automation, and Response (SOAR) platform is designed to ingest alerts (often from a SIEM) and automate the subsequent incident response actions. SOAR uses "playbooks" to orchestrate tasks across different security tools, thereby streamlining security operations and reducing manual intervention.

A. This incorrectly assigns prediction to SOAR and mitigation to SIEM. SIEM is for detection, while SOAR automates the response and mitigation actions.

C. This incorrectly states that SIEM predicts and prevents alerts. SIEM's core function is detection and alerting, not prevention.

D. This option reverses the roles of the two technologies. SIEM is for collection and detection, whereas SOAR is for automation and response.

---

1. Official Vendor Documentation (Cisco Press):

Santos

O. (2020). CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 2

"The SOC

" the text distinguishes the technologies: "A SIEM system collects and analyzes security alerts

logs

and other real-time and historical data from security devices

network devices

endpoint

and servers... A security orchestration

automation

and response (SOAR) is a solution stack that allows an organization to collect data about security threats and respond to security events without human assistance." (pp. 46-47). This directly supports that SIEM is for collection/analysis (detection) and SOAR is for automated response.

2. Official Vendor Documentation (Cisco):

Cisco. (n.d.). What Is SOAR (Security Orchestration

Automation

and Response)? Cisco.com. Retrieved from https://www.cisco.com/c/en/us/products/security/what-is-soar.html. The document states

"SOAR platforms are a force multiplier for the security team... They do this by automating and orchestrating many of the manual

repetitive tasks that bog down security analysts." This confirms SOAR's focus on automation and response.

3. Official Vendor Documentation (Cisco):

Cisco. (n.d.). What Is SIEM (Security Information and Event Management)? Cisco.com. Retrieved from https://www.cisco.com/c/en/us/products/security/what-is-siem.html. This source clarifies SIEM's function: "SIEM software works by collecting log and event data... and bringing it together in a single centralized location. From there

the system sorts through the data and identifies and categorizes incidents and events." This highlights the collection and detection role of SIEM.

An Indicator of Compromise (IoC) is a piece of forensic data or an artifact observed on a network or host that indicates, with high confidence, that a security intrusion has occurred. The primary role of an IoC is to act as a clue or sign for security analysts, helping them identify potentially malicious activity that warrants further investigation. IoCs are the fundamental building blocks used in intrusion detection, threat hunting, and incident response to uncover security breaches.

A. IoCs help identify the "what" or "how" of an attack (e.g., a specific malware file), but they do not inherently explain the motive or the "why."

C. IoCs are a critical form of forensic data. Stating they are "nonforensic" is incorrect, and their ease of detection varies significantly.

D. An IoC is a specific data point (e.g., an IP address), not a comprehensive narrative that describes both what happened and why.

1. Official Vendor Documentation: Santos

O.

Stuppi

J.

& Pirc

J. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. In Chapter 13

"Introduction to Intrusion Analysis

" the text states

"An indicator of compromise (IoC) is an artifact observed on a network or in an operating system that with high confidence indicates a computer intrusion." This supports the role of identifying malicious activity.

2. Peer-reviewed Academic Publications/Standards: Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology. In Section 2.3.2

"Sources of Precursors and Indicators

" an indicator is defined as "a sign that an incident may have occurred or may be occurring now

" which directly aligns with identifying malicious activity. (DOI: https://doi.org/10.6028/NIST.SP.800-61r2)

3. University Courseware: Carnegie Mellon University

Software Engineering Institute. (2017). Defining Indicators of Compromise. "Indicators of compromise (IoCs) are forensic data

such as data found in system log entries or files

that identify potentially malicious activity on a system or network." This definition explicitly validates that the role of an IoC is to identify malicious activity.

The Zero Trust model is a security framework built on the principle of "never trust, always verify." It fundamentally assumes that threats can exist both inside and outside the traditional network perimeter. Consequently, it eliminates the concept of a trusted internal network. Every user, device, and application must be strictly authenticated and authorized before being granted access to any resource, regardless of its location. This continuous verification process is enforced for every access request, directly matching the scenario described in the question.

A. Biba: This is a formal security model focused on maintaining data integrity, using rules like "no read down" and "no write up," not on verifying network connections.

B. Object-capability: This model grants access based on possession of an unforgeable token (a capability), which is a specific access control mechanism, not a comprehensive network architecture.

C. Take-Grant: This is a theoretical model used to analyze the transfer of rights within a system, rather than a practical architecture for securing network access.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-207: Zero Trust Architecture.

Section 2.1

Tenets of Zero Trust: "A core tenet of Zero Trust is to assume that a breach is inevitable or has likely already occurred. This means the enterprise should not trust any network

device

or user by default... All resource access is done in a secure manner

and trust is not granted based on the asset or user account being on the enterprise-owned network." This directly supports the assumption of internal and external attackers and the need for strict verification.

2. Cisco. (n.d.). What Is Zero Trust?

"What Is Zero Trust?" Section

Paragraph 1: "Zero Trust is a security framework requiring all users

whether in or outside the organization’s network

to be authenticated

authorized

and continuously validated for security configuration and posture before being granted or keeping access to applications and data." This official vendor documentation confirms the core principles described in the question.

3. Bishop

M. (2005). Introduction to Computer Security. Addison-Wesley Professional.

Chapter 13

"Security Models

" pp. 360-362: This university-level textbook describes the Biba model as a formal state machine model concerned with integrity levels.

Chapter 13

"Security Models

" pp. 370-372: The Take-Grant Protection Model is explained as a formal model for analyzing the propagation of rights using a graph-based approach. These definitions clearly distinguish them from the Zero Trust architecture.

A primary goal of a Security Operations Center (SOC) is to minimize the impact of security incidents. This is measured using key performance indicators (KPIs), which are often time-based. The "time it takes to detect the incident," commonly known as Mean Time to Detect (MTTD), is a critical SOC metric. It measures the average time elapsed from when a security threat first appears in an environment to when the SOC identifies it. A lower MTTD indicates a more effective and efficient security monitoring and detection capability, which is a core function of any SOC.

B. time it takes to assess the risks of the incident: This is a component of the analysis phase within the overall incident response time, not a standalone, primary SOC metric like MTTD or MTTR.

C. probability of outage caused by the incident: This is a risk assessment factor used to determine the potential impact of an incident, not a metric measuring the SOC's operational performance.

D. probability of compromise and impact caused by the incident: These are core components of a risk analysis (Likelihood x Impact), which informs the SOC's prioritization, but they do not measure the SOC's efficiency.

1. Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Chapter 1

"Cybersecurity and the Security Operations Center

" Section: "SOC Metrics." This section explicitly lists "Mean time to detect (MTTD)" as a common metric used to measure SOC effectiveness

defining it as "the average time that it takes for the security team to identify a security incident."

2. Cichonski

P.

Millar

T.

Grance

T.

& Scarfone

K. (2012). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). National Institute of Standards and Technology.

Section 2.3.3

"Incident Response Metrics." This section emphasizes the importance of metrics for improving incident response capabilities. It states

"Metrics can be used to measure the success of an incident response program... Examples of information that organizations may want to collect include... how long it took to detect and assess damage and scope for each incident." This directly supports measuring detection time as a key activity.

3. MITRE. (2021). 11 Strategies of a World-Class Cybersecurity Operations Center. The MITRE Corporation.

Strategy 3

"Measure Performance to Improve Performance

" Section: "What to Measure." The document lists "Mean Time to Detect (MTTD)" as a foundational metric

describing it as the time from the start of an incident to the moment the SOC detects it. It highlights that reducing MTTD is a primary goal for improving security posture.

Full packet capture (PCAP) is the process of recording all data packets (headers and payload) that pass through a specific network point. This method provides the most granular data for deep forensic analysis but, as a consequence, requires the largest amount of storage. In contrast, alert, transaction, and session data are all forms of metadata or summaries. They extract specific elements from the traffic, resulting in a significantly smaller data volume. For instance, session data like NetFlow only records conversation metadata (e.g., IPs, ports, byte counts), making it orders of magnitude smaller than a full capture of the same traffic.

A. alert data: Consists of small, event-driven notifications from security devices, representing the least amount of data collected.

B. transaction data: Captures application-layer request/response details, which is more voluminous than an alert but far less than a full packet stream.

C. session data: Contains metadata summaries of network flows (e.g., NetFlow), which is much more compact than capturing every packet's content.

1. Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 10

"Network Security Data

" the section "Full Packet Captures" states

"Full packet capture generates a tremendous amount of data that is difficult to store and analyze." This is contrasted with other data types like NetFlow (session data) and IDS alerts

which are described as more manageable.

2. Sommer

R.

& Paxson

V. (2010). Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. 2010 IEEE Symposium on Security and Privacy

305-316. In Section II-A

"Data Sources

" the paper notes that while full packet traces are the "richest possible source" for analysis

they come with "prohibitive storage and processing costs

" distinguishing them from less voluminous sources like flow records. DOI: https://doi.org/10.1109/SP.2010.25

3. Cisco. (n.d.). Cisco Secure Network Analytics (Stealthwatch) Data Sheet. This official vendor documentation highlights the scalability of using NetFlow (session data) for enterprise-wide visibility. It implicitly contrasts this with the resource-intensive nature of full packet capture

which is not feasible for continuous

large-scale collection due to high storage requirements. The value proposition of Secure Network Analytics is built on the efficiency of session data over PCAP.

Indicators of Attack (IoAs) focus on the behaviors and intent of an attacker, signaling an active intrusion is in progress. Malware that reinfects a system minutes after removal is a definitive sign of a persistence mechanism. This demonstrates that an adversary is actively working to maintain access and control over the compromised system. This focus on the attacker's actions (maintaining persistence) is the core characteristic of an IoA, as opposed to a static artifact left behind after an event.

A. spam emails on an employee workstation

Spam is a common delivery vector for potential threats but is not, by itself, an indicator of an active, ongoing attack.

B. virus detection by the AV software

A virus detection is a classic Indicator of Compromise (IoC), an artifact proving a compromise occurred, not necessarily that an attack is currently in progress.

C. blocked phishing attempt on a company

A blocked attempt is a record of a prevented attack. It indicates that security controls worked successfully, not that there is an ongoing intrusion.

1. Santos

O. (2020). CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Chapter 3

"Cybersecurity Threats

Vulnerabilities

and Attacks

" Section: "Maintaining Access." This section describes how attackers establish persistence using techniques like rootkits

trojans

and other backdoors to ensure they maintain access even if the system is rebooted or the initial vulnerability is patched. The scenario in option D is a direct example of an active persistence mechanism

which is a behavioral Indicator of Attack.

Chapter 13

"Fundamentals of Intrusion Analysis

" Section: "Indicators of Compromise." This section defines IoCs as "artifacts observed on a network or in an operating system that with high confidence indicate a computer intrusion." It lists examples like virus signatures and hashes

which align with option B

distinguishing them from the behavioral nature of an IoA.

2. Cisco. (2023). What Is an Indicator of Attack (IOA)?. Cisco Umbrella Documentation.

This official Cisco documentation states

"Unlike indicators of compromise (IOCs) which are reactive

IOAs are proactive... IOAs focus on detecting the intent of what an attacker is trying to accomplish

regardless of the malware or exploit used in an attack." The rapid reinfection described in option D clearly points to the attacker's intent to maintain persistence

fitting the definition of an IoA.

Stateful inspection, also known as stateful packet inspection, operates primarily at the Network (Layer 3) and Transport (Layer 4) of the OSI model. It maintains a state table to track active connections, making decisions based on the context of the traffic flow (e.g., TCP connection states). Deep Packet Inspection (DPI), a more advanced technology often found in Next-Generation Firewalls (NGFWs), goes further by examining the actual data payload of a packet. This allows it to inspect traffic at the Application Layer (Layer 7), identifying specific applications, services, and potential malicious content that a stateful firewall cannot see.

A. DPI is more secure overall due to its Layer 7 capabilities, but this statement incorrectly limits the comparison to Layer 4, where stateful inspection is the foundational technology.

B. This statement is inaccurate. Stateful inspection verifies the state of a connection at Layer 4, not its "contents," while DPI inspects the contents at Layer 7.

C. This is incorrect. Stateful inspection lacks visibility into Layer 7; therefore, it cannot be more secure than DPI at that layer.

1. Official Vendor Documentation: Cisco

"What Is a Next-Generation Firewall (NGFW)?"

Cisco.com. The document states

"While first-generation stateful firewalls only look at the header of a packet (Layers 3 and 4 information)

a next-generation firewall (NGFW) looks at the entire packet

including the header and the payload of the packet (Layers 3-7 information)." This directly supports that stateful inspection is a Layer 4 function and DPI (a feature of NGFW) provides Layer 7 visibility.

(Source: Cisco official website

article on NGFW technology fundamentals).

2. Official Vendor Documentation: Santos

O. (2020). CCNA CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 10

"Network Security Infrastructure

" the text explains

"A stateful firewall... keeps track of the state of network connections... traveling across it." It later describes NGFWs as having "deep packet inspection (DPI) capabilities... to enforce policies at the application layer (Layer 7)." This clearly distinguishes stateful inspection (Layer 4 state) from DPI (Layer 7 visibility).

(Reference: Chapter 10

Sections "Stateful Firewalls" and "Next-Generation Firewalls (NGFWs) and Next-Generation Intrusion Prevention Systems (NGIPSs)").

3. Academic Publication: Al-shara

Z. A.

et al. (2015). "Survey of firewall technologies." Proceedings of the 2015 International Conference on Communications

Management and Information Technology (ICCMIT). This paper defines a stateful inspection firewall as one that "operates at layer 3 and 4 of OSI model" and contrasts it with application-level firewalls that use DPI to "examine the payload of the packet at the application layer."

(DOI: 10.1016/j.procs.2015.04.102

Section 3. "Firewall Technologies").

Scareware is a type of malicious software that uses social engineering tactics to cause shock, anxiety, or the perception of a threat. It manipulates users into buying or downloading unnecessary and potentially malicious software. The attack typically involves malicious code that generates alarming pop-up windows designed to look like legitimate system or antivirus alerts. These pop-ups falsely claim the user's computer is infected with viruses or is otherwise compromised, frightening the user into paying for fake removal software, which is itself often malware.

A. This describes phishing, which uses deceptive emails and websites to trick users into revealing sensitive information like login credentials or financial details.

B. This describes a Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attack, which aims to render a network or website unavailable to its intended users.

C. This describes ransomware, a type of malware that encrypts a victim's data and demands payment (a ransom) for the decryption key.

1. Official Vendor Documentation: Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 3

"Cybersecurity Threats

Vulnerabilities

and Attacks

" the section on "Types of Social Engineering Attacks" describes scareware as a tactic that "attempts to frighten the victim into performing an action... For example

a pop-up window may appear on your screen

displaying a message that your computer is infected with a virus." This aligns directly with the mechanism described in the correct answer.

2. Peer-reviewed Academic Publications / Reputable Institutions: National Institute of Standards and Technology (NIST). (n.d.). Glossary. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/scareware. The NIST glossary defines scareware as: "A type of malware that is designed to trick victims into purchasing and downloading useless and/or potentially dangerous software." The description often notes the use of pop-up security alerts as the primary delivery mechanism for the "scare."

3. University Courseware: Carnegie Mellon University

Software Engineering Institute. (2010

October 26). Recognizing and Avoiding Scareware. CERT Coordination Center. In this technical article

scareware is described as malicious software that "generates bogus warnings to frighten users into buying counterfeit security software

" explicitly identifying pop-up windows as the method used to present these fake warnings.

Agent-based monitoring utilizes a software agent installed directly on the monitored host. This agent can perform local data processing, aggregation, and filtering. By analyzing data at the source, it can be configured to transmit only the most critical or relevant events to the central monitoring server. This pre-processing significantly reduces the amount of data sent over the network. In contrast, agentless monitoring typically polls devices remotely using standard protocols (e.g., SNMP, WMI). This process often involves transferring larger, unfiltered datasets, which can result in higher network bandwidth consumption compared to the optimized transmissions from an agent.

A: WMI is a protocol commonly used for agentless monitoring of Windows systems, not a characteristic of agent-based methods. Both approaches can utilize APIs.

B: Agent-based monitoring is considered more intrusive because it requires the installation and maintenance of third-party software directly on the production system.

C: Agent-based monitoring typically has a higher operational overhead and cost due to the need to deploy, manage, and update agents across numerous endpoints.

1. Santos

O. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. Chapter 15

"Network Monitoring and Analysis

" in the section "Host-Based Data

" it is explained that endpoint security solutions (which use agents) provide deep visibility into the operating system. This local presence allows for intelligent

local processing before data is sent to a central manager

optimizing data transmission.

2. Cisco. (2023). Cisco Secure Endpoint User Guide. In the documentation describing the architecture

the connector (agent) is detailed as having local analysis capabilities. It processes events on the endpoint and sends select telemetry data to the cloud console

which exemplifies the principle of local filtering to reduce network traffic. (Reference: General architecture and connector function sections).

3. Stallings

W. (2013). SNMP

SNMPv2

SNMPv3

and RMON 1 and 2 (3rd ed.). Addison-Wesley Professional. Chapter 4

"SNMPv1

" describes the polling mechanism (get-request) inherent to SNMP

a primary agentless protocol. This model

without careful management

can lead to significant network overhead as the management station must repeatedly query for bulk data

contrasting with the event-driven

filtered reporting possible with an intelligent agent.

The Nmap scan output explicitly states, "Not shown: 997 filtered ports." In Nmap terminology, a port state of 'filtered' means that a firewall, router access control list (ACL), or another network filtering device is blocking the port. This prevents Nmap's probes from reaching the port, making it impossible to determine if the port is truly open or closed. The presence of a large number of filtered ports is a classic and strong indication that a firewall is actively protecting the target host by dropping unsolicited packets.

B: The scan results show ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open. The standard ports for SMB (445/tcp, 139/tcp) are not listed as open.

C: A basic SYN scan (-sS) identifies the state of ports (open, closed, filtered). It does not gather detailed information about the specific processes, such as PIDs or versions, running on the server.

D: A port scan is not designed to enumerate Active Directory users. This would require specialized enumeration scripts or tools targeting services like LDAP or Kerberos, which was not done here.

1. Official Vendor Documentation (Nmap): In the official Nmap Reference Guide

the description of port states clarifies the meaning of 'filtered'. It states

"Nmap cannot determine whether the port is open because packet filtering prevents its probes from reaching the port. The filtering could be from a dedicated firewall device

router rules

or host-based firewall software."

Source: Nmap.org

"Nmap Reference Guide

" Chapter 15

Section: "Port Scanning Basics

" Subsection: "Port States".

2. Official Vendor Documentation (Cisco): Cisco's documentation on its ASA firewalls explains the default behavior of dropping packets that are not explicitly permitted by an access rule. This packet-dropping action is what causes a scanning tool like Nmap to report a port as 'filtered'.

Source: Cisco

"Cisco ASA Series Firewall CLI Configuration Guide

9.8

" Chapter: "Getting Started with the Firewall

" Section: "Information About Security Levels for Interfaces."

3. University Courseware: Course materials from reputable institutions on network security confirm this interpretation. For example

materials often explain that a 'filtered' response from Nmap is a primary indicator of a firewall.

Source: Rochester Institute of Technology (RIT)

CSEC-380 Courseware

"Nmap - Port Scanning

" Slide 11. The slide defines the 'filtered' state as: "A firewall is preventing nmap from determining if the port is open or closed."