An analyst is reviewing an alert where an attacker used a watering hole attack to compromise a website frequently visited by employees. The website delivered a malicious JavaScript that exploited a browser vulnerability to install a keylogger. The keylogger then captured credentials and sent them to an external server. Which two Cyber Kill Chain phases are most directly represented by the delivery of the malicious JavaScript and the installation of the keylogger?

Command and Control and Actions on Objectives

Reconnaissance and Weaponization

CiscoCertified CyberOps Associate

Domain 5Objective 10

5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 1)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

15%of the exam

Questions 1–5

1application · medium
An analyst is mapping an intrusion to the Diamond Model. The attacker used a phishing email to deliver a macro-enabled document to a finance employee. The document downloaded a trojan that communicated with a C2 server. Which element is the finance employee?
Select an answer first
2expert · medium
An analyst is reviewing an alert where an attacker used a watering hole attack to compromise a website frequently visited by employees. The website delivered a malicious JavaScript that exploited a browser vulnerability to install a keylogger. The keylogger then captured credentials and sent them to an external server. Which two Cyber Kill Chain phases are most directly represented by the delivery of the malicious JavaScript and the installation of the keylogger?
Select an answer first
3foundation · easy
In the Diamond Model of Intrusion, which core feature represents the tools, techniques, and procedures used by the attacker to conduct the intrusion?
Select an answer first
4application · medium
An analyst observes that an attacker has successfully established a persistent connection to a compromised host and is sending periodic commands to the host to gather sensitive data. According to the Cyber Kill Chain, which phase is the attacker currently in?
Select an answer first
5application · medium
During an incident, the analyst sees that the attacker performed network reconnaissance by scanning the company's public IP range for open ports. According to the Cyber Kill Chain, which phase does this activity represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 1)

Questions 1–5

An analyst is mapping an intrusion to the Diamond Model. The attacker used a phishing email to deliver a macro-enabled document to a finance employee. The document downloaded a trojan that communicated with a C2 server. Which element is the finance employee?

In the Diamond Model of Intrusion, which core feature represents the tools, techniques, and procedures used by the attacker to conduct the intrusion?

An analyst observes that an attacker has successfully established a persistent connection to a compromised host and is sending periodic commands to the host to gather sensitive data. According to the Cyber Kill Chain, which phase is the attacker currently in?

During an incident, the analyst sees that the attacker performed network reconnaissance by scanning the company's public IP range for open ports. According to the Cyber Kill Chain, which phase does this activity represent?

Keep studying — 5.0 Security Policies and Procedures