A security team is deciding which model to use for a post-incident review. They want to understand the relationships between the attacker, the tools used, the infrastructure, and the victim, and how these elements interacted during the intrusion. Which model is most appropriate for this analysis?

NIST Incident Response Framework

CiscoCertified CyberOps Associate

Domain 5Objective 10

5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 3)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

15%of the exam

Questions 11–15

11foundation · easy
A security analyst detects that an attacker has successfully exploited a vulnerability in a web application and has installed a backdoor on the server. Which Cyber Kill Chain phase is the installation of the backdoor?
Select an answer first
12application · medium
A security team is deciding which model to use for a post-incident review. They want to understand the relationships between the attacker, the tools used, the infrastructure, and the victim, and how these elements interacted during the intrusion. Which model is most appropriate for this analysis?
Select an answer first
13expert · medium
An analyst is investigating an alert where an attacker used a USB drop attack to deliver malware to a workstation. The malware then exploited a local privilege escalation vulnerability to gain admin rights. According to the Cyber Kill Chain, which phase is the privilege escalation?
Select an answer first
14foundation · easy
In the Cyber Kill Chain model, which phase involves the attacker creating a weaponized file that pairs malware with an exploit to deliver to a target?
Select an answer first
15application · medium
A security analyst is reviewing an alert that shows a user received a phishing email with a malicious attachment. The user opened the attachment, which executed a script that downloaded a remote access tool from an external server. The tool then established a command-and-control channel. According to the Cyber Kill Chain, which phase does the execution of the script and download of the tool represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 3)

Questions 11–15

A security analyst detects that an attacker has successfully exploited a vulnerability in a web application and has installed a backdoor on the server. Which Cyber Kill Chain phase is the installation of the backdoor?

A security team is deciding which model to use for a post-incident review. They want to understand the relationships between the attacker, the tools used, the infrastructure, and the victim, and how these elements interacted during the intrusion. Which model is most appropriate for this analysis?

An analyst is investigating an alert where an attacker used a USB drop attack to deliver malware to a workstation. The malware then exploited a local privilege escalation vulnerability to gain admin rights. According to the Cyber Kill Chain, which phase is the privilege escalation?

In the Cyber Kill Chain model, which phase involves the attacker creating a weaponized file that pairs malware with an exploit to deliver to a target?

Keep studying — 5.0 Security Policies and Procedures