A Windows analyst is investigating a possible privilege escalation. The Security event log shows Event ID 4688 (process creation) with a command line that includes 'whoami /priv'. Which additional log should the analyst check to confirm the process was created with elevated privileges?

Security log for Event ID 4672 (special privileges assigned to new logon)

System log for Event ID 7045 (service installed)

Application log for Event ID 1000 (application error)

PowerShell operational log for ScriptBlock logging

A security team is designing a file integrity monitoring (FIM) system for critical system binaries. They need to detect unauthorized modifications while minimizing false positives from legitimate software updates. Which approach best balances security and operational efficiency?

Use SHA-1 hashes and never update the baseline

Use MD5 hashes because they are faster and sufficient for integrity

Monitor file sizes and modification times instead of hashes

Use SHA-256 hashes and a baseline that is updated during approved maintenance windows

A security analyst is reviewing a proxy log entry and sees the following URL: hxxp://192.168.1.10/%77%65%62%73%69%74%65/login.php?redirect=//evil.com. The analyst needs to determine the actual destination. What is the most effective first step to decode this URL?

Perform a DNS lookup on 192.168.1.10 to find the hostname.

Decode the percent-encoded characters in the path to reveal the actual path.

Block the IP address immediately because it is a private IP.

Follow the redirect to evil.com to see where it leads.

CiscoCertified CyberOps Associate

Domain 3Objective 7

3.7 200-201 Practice Questions (Page 6)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

20%of the exam

Questions 26–30

26application · medium
A Windows analyst is investigating a possible privilege escalation. The Security event log shows Event ID 4688 (process creation) with a command line that includes 'whoami /priv'. Which additional log should the analyst check to confirm the process was created with elevated privileges?
Select an answer first
27foundation · easy
Which property of a cryptographic hash function ensures that a one-bit change in the input produces a completely different output hash?
Select an answer first
28foundation · easy
In the URL https://www.example.com:8443/path/page?query=1#section, which component is the port number?
Select an answer first
29expert · hard
A security team is designing a file integrity monitoring (FIM) system for critical system binaries. They need to detect unauthorized modifications while minimizing false positives from legitimate software updates. Which approach best balances security and operational efficiency?
Select an answer first
30application · medium
A security analyst is reviewing a proxy log entry and sees the following URL: hxxp://192.168.1.10/%77%65%62%73%69%74%65/login.php?redirect=//evil.com. The analyst needs to determine the actual destination. What is the most effective first step to decode this URL?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

3.7 200-201 Practice Questions (Page 6)

Questions 26–30

A Windows analyst is investigating a possible privilege escalation. The Security event log shows Event ID 4688 (process creation) with a command line that includes 'whoami /priv'. Which additional log should the analyst check to confirm the process was created with elevated privileges?

Which property of a cryptographic hash function ensures that a one-bit change in the input produces a completely different output hash?

In the URL https://www.example.com:8443/path/page?query=1#section, which component is the port number?

A security team is designing a file integrity monitoring (FIM) system for critical system binaries. They need to detect unauthorized modifications while minimizing false positives from legitimate software updates. Which approach best balances security and operational efficiency?

A security analyst is reviewing a proxy log entry and sees the following URL: hxxp://192.168.1.10/%77%65%62%73%69%74%65/login.php?redirect=//evil.com. The analyst needs to determine the actual destination. What is the most effective first step to decode this URL?

Keep studying — 3.0 Host-Based Analysis