What is the primary goal of event correlation in incident analysis?

To encrypt logs for secure storage

To reduce the volume of logs by deleting duplicates

To assign severity levels to individual events

To reconstruct the sequence of events and identify the root cause of an incident

Which static analysis technique can help determine if a URL is malicious without actually visiting it?

Performing a traceroute to the server

Opening the URL in a browser to see the content

Examining the URL for suspicious patterns such as excessive subdomains or URL-encoded characters

Pinging the domain to check if it is online

A company has a limited budget and needs to improve visibility into security events. They currently have no centralized logging. The security team wants to prioritize log sources that provide the most value for detecting lateral movement. Which log source should be collected first?

Windows Security event logs from domain controllers

Firewall logs from the perimeter

Application logs from web servers

CiscoCertified CyberOps Associate

Domain 3Objective 7

3.7 200-201 Practice Questions (Page 1)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

20%of the exam

Questions 1–5

1application · medium
An analyst is reviewing a suspicious URL from a phishing email: https://www.example.com/login?redirect=https://evil.com. Which component of the URL is the primary target of the redirect parameter?
Select an answer first
2foundation · easy
What is the primary goal of event correlation in incident analysis?
Select an answer first
3foundation · easy
Which static analysis technique can help determine if a URL is malicious without actually visiting it?
Select an answer first
4foundation · easy
An attacker uses a URL like http://example.com/%73%65%63%75%72%65 to hide the word 'secure'. Which obfuscation technique is being used?
Select an answer first
5expert · hard
A company has a limited budget and needs to improve visibility into security events. They currently have no centralized logging. The security team wants to prioritize log sources that provide the most value for detecting lateral movement. Which log source should be collected first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

3.7 200-201 Practice Questions (Page 1)

Questions 1–5

An analyst is reviewing a suspicious URL from a phishing email: https://www.example.com/login?redirect=https://evil.com. Which component of the URL is the primary target of the redirect parameter?

What is the primary goal of event correlation in incident analysis?

Which static analysis technique can help determine if a URL is malicious without actually visiting it?

An attacker uses a URL like http://example.com/%73%65%63%75%72%65 to hide the word 'secure'. Which obfuscation technique is being used?

A company has a limited budget and needs to improve visibility into security events. They currently have no centralized logging. The security team wants to prioritize log sources that provide the most value for detecting lateral movement. Which log source should be collected first?

Keep studying — 3.0 Host-Based Analysis