CISCO

Cisco Certified CyberOps Associate

200-201

The Cisco Certified CyberOps Associate certification validates your ability to detect and respond to cybersecurity threats as part of a Security Operations Center (SOC) team. This certification is for security analysts and SOC practitioners who monitor, analyze, and investigate security events. Earning it demonstrates that you have the foundational skills to protect your organization's digital assets and advance your cybersecurity career.

Practice Free Questions

5Domains

50Objectives

383Practice pages

1812Free questions

200-201 free practice questions

Choose any objective and open any question page — no sign-in required.

1.1 Describe the CIA triad

38 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–38

1.2 Compare security deployments

58 questions · 12 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–58

1.3 Describe security terms

51 questions · 11 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–51

1.4 Compare security concepts

40 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40

1.5 Describe the principles of the defense-in-depth strategy

47 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–47

1.6 Compare access control models

30 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30

1.7 Describe terms as defined in CVSS

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

1.8 Identify the challenges of data visibility (network, host, and cloud) in detection

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–33

1.9 Identify potential data loss from traffic profiles

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

1.10 Interpret the 5-tuple approach to isolate a compromised host in a grouped set of logs

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20

1.11 Compare rule-based detection vs. behavioral and statistical detection

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

2.1 Compare attack surface and vulnerability

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–33

2.2 Identify the types of data provided by these technologies

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

2.3 Describe the impact of these technologies on data visibility

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

2.4 Describe the uses of these data types in security monitoring

28 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–28

2.5 Describe network attacks, such as protocol-based, denial of service, distributed denial of service, and man-in-the-middle

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

2.6 Describe web application attacks, such as SQL injection, command injections, and cross-site scripting

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

2.8 Describe endpoint-based attacks, such as buffer overflows, command and control (C2), malware, and ransomware

51 questions · 11 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–51

2.9 Describe evasion and obfuscation techniques, such as tunneling, encryption, and proxies

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

2.10 Describe the impact of certificates on security (includes PKI, public/private crossing the network, asymmetric/symmetric)

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

2.11 Identify the certificate components in a given scenario

38 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–38

3.1 Describe the functionality of these endpoint technologies in regard to security monitoring utilizing rules, signatures, and predictive AI

47 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–47

3.2 Identify components of an operating system (such as Windows and Linux) in a given scenario

49 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–49

3.3 Describe the role of attribution in an investigation

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

3.4 Identify type of evidence used based on provided logs

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

3.5 Interpret operating system, SIEM, SOAR platform, application, or command line logs to identify an event

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

3.6 Interpret the output report of malware analysis tools such as a detonation chamber or sandbox

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

3.7

59 questions · 12 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–59

4.1 Map the provided events to source technologies

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

4.2 Compare impact and no impact for these items

41 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–41

4.3 Compare deep packet inspection with packet filtering and stateful firewall operation

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

4.4 Compare inline traffic interrogation and taps or traffic monitoring

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–33

4.5 Compare the characteristics of data obtained from taps or traffic monitoring and transactional data (NetFlow) in the analysis of network traffic

40 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40

4.6 Extract files from a TCP stream when given a PCAP file and Wireshark

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

4.7 Identify key elements in an intrusion from a given PCAP file

41 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–41

4.9 Interpret common artifact elements from an event to identify an alert

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

4.10 Interpret basic regular expressions

11 questions · 3 pages

Questions 1–5 6–10 11–11

5.1 Describe management concepts

57 questions · 12 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–57

5.2 Describe the elements in an incident response plan as stated in NIST.SP800-61

59 questions · 12 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–59

5.3 Apply the incident handling process such as NIST.SP800-61 to an event

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

5.4 Map elements to these steps of analysis based on the NIST.SP800-61

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

5.5 Map the organization stakeholders against the NIST IR categories (CMMC, NIST.SP800-61)

44 questions · 9 pages

5.6 Describe concepts as documented in NIST.SP800-86

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

5.7 Identify these elements used for network profiling

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

5.8 Identify these elements used for server profiling

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

5.9 Identify protected data in a network

48 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–48

5.10 Classify intrusion events into categories as defined by security models, such as Cyber Kill Chain Model and Diamond Model of Intrusion

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

5.11 Describe the relationship of SOC metrics to scope analysis (time to detect, time to contain, time to respond, time to control)

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (50 objectives · 383 pages).

Cisco Certified CyberOps Associate

200-201 free practice questions

Domain 1 · 1.0 Security Concepts22% of practice bank · 11 objectives · 400 questions22%

Domain 2 · 2.0 Security Monitoring21% of practice bank · 11 objectives · 383 questions21%

Domain 3 · 3.0 Host-Based Analysis15% of practice bank · 7 objectives · 279 questions15%

Domain 4 · 4.0 Network Intrusion Analysis18% of practice bank · 10 objectives · 326 questions18%

Domain 5 · 5.0 Security Policies and Procedures23% of practice bank · 11 objectives · 424 questions23%