A security architect is evaluating how to improve their incident response process. They want to identify the attacker's infrastructure and also understand the attack progression. Which of the following is the most effective approach?

Use only the Diamond Model because it includes the infrastructure and the attack progression.

Use only the Cyber Kill Chain because it includes the infrastructure in its phases.

Use the Diamond Model to identify the infrastructure and the Cyber Kill Chain to map the attack progression.

Use the Cyber Kill Chain to identify the infrastructure and the Diamond Model to map the attack progression.

CiscoCertified CyberOps Associate

Domain 5Objective 10

5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 2)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

15%of the exam

Questions 6–10

6expert · medium
A security architect is evaluating how to improve their incident response process. They want to identify the attacker's infrastructure and also understand the attack progression. Which of the following is the most effective approach?
Select an answer first
7application · medium
An analyst is reviewing logs and sees that an attacker has exfiltrated a large amount of data from a database to an external server. According to the Cyber Kill Chain, which phase does this activity represent?
Select an answer first
8expert · medium
An analyst is using the Diamond Model to analyze a series of intrusions. The analyst notices that the same adversary is using different infrastructure and capabilities against different victims. Which element is consistent across all intrusions?
Select an answer first
9foundation · easy
During which Cyber Kill Chain phase does the attacker establish a communication channel between the compromised system and an external server to maintain control?
Select an answer first
10foundation · easy
In a Diamond Model analysis of an intrusion, the attacker uses a malicious domain to host a phishing page targeting employees of a company. Which element is the Infrastructure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 2)

Questions 6–10

A security architect is evaluating how to improve their incident response process. They want to identify the attacker's infrastructure and also understand the attack progression. Which of the following is the most effective approach?

An analyst is reviewing logs and sees that an attacker has exfiltrated a large amount of data from a database to an external server. According to the Cyber Kill Chain, which phase does this activity represent?

An analyst is using the Diamond Model to analyze a series of intrusions. The analyst notices that the same adversary is using different infrastructure and capabilities against different victims. Which element is consistent across all intrusions?

During which Cyber Kill Chain phase does the attacker establish a communication channel between the compromised system and an external server to maintain control?

In a Diamond Model analysis of an intrusion, the attacker uses a malicious domain to host a phishing page targeting employees of a company. Which element is the Infrastructure?

Keep studying — 5.0 Security Policies and Procedures