An analyst is investigating a phishing email that contains a link to http://example.com@192.168.1.50/update. The analyst needs to assess the risk of this URL. What is the most important observation?

The URL uses HTTP instead of HTTPS, so it is definitely malicious.

The domain example.com is the destination, and 192.168.1.50 is a path.

The URL is safe because it points to a private IP address.

The host portion is actually 192.168.1.50, and 'example.com' is just a username component.

What is the primary purpose of checking a URL's reputation using a threat intelligence service?

To check the URL's search engine ranking

To identify if the URL is associated with known malicious activity

To determine the URL's page load speed

To find the website's owner contact information

An analyst is evaluating a URL that was clicked by a user: https://example.com/redirect?url=http://192.168.1.50/malware.exe. The URL's domain (example.com) has a good reputation, but the redirect target is an IP address. The analyst needs to determine if the user is at risk. What is the most important consideration?

The redirect target should be analyzed for reputation and content before concluding the user is safe.

The redirect target is a private IP, so the user is not at risk.

The analyst should block example.com because it is redirecting to a suspicious IP.

The URL is safe because example.com is reputable.

A proxy log contains the following entry: 'GET /%72%65%64%69%72%65%63%74?url=http%3A%2F%2Fevil.com HTTP/1.1'. The analyst wants to understand the full request. What is the decoded URL path and query?

/redirect?url=http%3A%2F%2Fevil.com

/%72%65%64%69%72%65%63%74?url=http://evil.com

A Linux administrator suspects that the /usr/bin/curl binary was replaced during a breach. The administrator has the original SHA-256 hash from the package manager. Which command should the administrator run to verify the current file's integrity?

cmp /usr/bin/curl /usr/bin/curl.bak

CiscoCertified CyberOps Associate

Domain 3Objective 7

3.7 200-201 Practice Questions (Page 3)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

20%of the exam

Questions 11–15

11application · medium
An analyst is investigating a phishing email that contains a link to http://example.com@192.168.1.50/update. The analyst needs to assess the risk of this URL. What is the most important observation?
Select an answer first
12foundation · easy
What is the primary purpose of checking a URL's reputation using a threat intelligence service?
Select an answer first
13expert · hard
An analyst is evaluating a URL that was clicked by a user: https://example.com/redirect?url=http://192.168.1.50/malware.exe. The URL's domain (example.com) has a good reputation, but the redirect target is an IP address. The analyst needs to determine if the user is at risk. What is the most important consideration?
Select an answer first
14application · medium
A proxy log contains the following entry: 'GET /%72%65%64%69%72%65%63%74?url=http%3A%2F%2Fevil.com HTTP/1.1'. The analyst wants to understand the full request. What is the decoded URL path and query?
Select an answer first
15application · medium
A Linux administrator suspects that the /usr/bin/curl binary was replaced during a breach. The administrator has the original SHA-256 hash from the package manager. Which command should the administrator run to verify the current file's integrity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.