A company has experienced a malware outbreak that affected multiple servers. The team has contained the outbreak by isolating the affected servers. During eradication, the team discovers that the malware was introduced through a vulnerability in a third-party application. The vendor has released a patch. Which action should the team take to prevent recurrence?

Increase the frequency of antivirus scans on the affected servers

Apply the vendor patch to all affected and unaffected systems

Restore the affected servers from backups without applying the patch

Remove the third-party application from all systems

Why is it important to document evidence collection during an incident?

To reduce the need for incident response training

To increase the speed of the incident response

To hide the incident from upper management

To maintain the chain of custody for potential legal proceedings

A company's security team has confirmed that a malware infection is spreading from a single workstation to other systems on the same network segment. The malware is actively encrypting files on the infected workstation. Which containment strategy should the team apply FIRST to limit the spread?

Apply a firewall rule to block all inbound traffic to the infected workstation

Reboot the infected workstation to clear the malware from memory

Disconnect the infected workstation from the network

Run an antivirus scan on the infected workstation

During a major incident, the incident response team lead needs to communicate with external stakeholders, including customers and regulatory bodies. The team has a communications lead, but the lead is unavailable. Which action should the team lead take to ensure effective communication?

Assign a temporary communications lead from the team and ensure they have the necessary information and authority

Delay all external communications until the communications lead is available

Have the technical lead handle all external communications

Send a general message to all stakeholders without specific details

In the NIST SP 800-61 incident handling lifecycle, which phase includes activities such as eradicating the root cause of the incident and restoring affected systems to a secure operational state?

Containment, Eradication, and Recovery

CiscoCertified CyberOps Associate

Domain 5Objective 3

5.3 Apply the Incident Handling Process Such as NIST.SP800-61 to an Event 200-201 Practice Questions (Page 1)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

15%of the exam

Questions 1–5

1expert · hard
A company has experienced a malware outbreak that affected multiple servers. The team has contained the outbreak by isolating the affected servers. During eradication, the team discovers that the malware was introduced through a vulnerability in a third-party application. The vendor has released a patch. Which action should the team take to prevent recurrence?
Select an answer first
2foundation · easy
Why is it important to document evidence collection during an incident?
Select an answer first
3application · medium
A company's security team has confirmed that a malware infection is spreading from a single workstation to other systems on the same network segment. The malware is actively encrypting files on the infected workstation. Which containment strategy should the team apply FIRST to limit the spread?
Select an answer first
4expert · hard
During a major incident, the incident response team lead needs to communicate with external stakeholders, including customers and regulatory bodies. The team has a communications lead, but the lead is unavailable. Which action should the team lead take to ensure effective communication?
Select an answer first
5foundation · easy
In the NIST SP 800-61 incident handling lifecycle, which phase includes activities such as eradicating the root cause of the incident and restoring affected systems to a secure operational state?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.