A SOC analyst is investigating a potential incident. The SIEM shows multiple failed login attempts from a single IP address, followed by a successful login. The user associated with the account denies any unusual activity. The analyst also notices that the successful login occurred at 3:00 AM local time, which is unusual for this user. Which action should the analyst take to confirm the incident?

Ignore the alert because the user denied any unusual activity

Immediately disconnect the user's account to prevent further access

Correlate the SIEM data with the user's normal behavior and other logs, such as VPN logs and endpoint logs

Report the incident to law enforcement immediately

During an incident, the incident response team is collecting evidence from affected systems. The team lead instructs the team to document the chain of custody for all evidence. Why is this documentation important?

It ensures that the evidence is admissible in legal proceedings

It helps the team determine the root cause of the incident

It speeds up the incident response process by reducing the need for analysis

It allows the team to share evidence with external parties without restrictions

CiscoCertified CyberOps Associate

Domain 5Objective 3

5.3 Apply the Incident Handling Process Such as NIST.SP800-61 to an Event 200-201 Practice Questions (Page 5)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

15%of the exam

Questions 21–25

21foundation · easy
Which containment strategy involves dividing the network into smaller segments to limit the blast radius of an incident?
Select an answer first
22expert · hard
A SOC analyst is investigating a potential incident. The SIEM shows multiple failed login attempts from a single IP address, followed by a successful login. The user associated with the account denies any unusual activity. The analyst also notices that the successful login occurred at 3:00 AM local time, which is unusual for this user. Which action should the analyst take to confirm the incident?
Select an answer first
23foundation · easy
After containing a malware infection, the incident response team removes the malicious files and patches the vulnerability that was exploited. Which phase of the incident handling process does this action belong to?
Select an answer first
24application · medium
During an incident, the incident response team is collecting evidence from affected systems. The team lead instructs the team to document the chain of custody for all evidence. Why is this documentation important?
Select an answer first
25foundation · easy
Which of the following is a common source of incident data that an analyst might use to detect and analyze a potential security incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.3 Apply the Incident Handling Process Such as NIST.SP800-61 to an Event 200-201 Practice Questions (Page 5)

Questions 21–25

Which containment strategy involves dividing the network into smaller segments to limit the blast radius of an incident?

After containing a malware infection, the incident response team removes the malicious files and patches the vulnerability that was exploited. Which phase of the incident handling process does this action belong to?

During an incident, the incident response team is collecting evidence from affected systems. The team lead instructs the team to document the chain of custody for all evidence. Why is this documentation important?

Which of the following is a common source of incident data that an analyst might use to detect and analyze a potential security incident?

Keep studying — 5.0 Security Policies and Procedures