A security engineer is troubleshooting a network issue where an inline security appliance is dropping legitimate traffic. The appliance is configured in fail-closed mode. The engineer needs to maintain security enforcement while minimizing the impact on legitimate traffic. Which action should the engineer take?

Adjust the inspection rules to reduce false positives

Increase the appliance's logging level to debug

Replace the inline appliance with a passive tap and IDS

Switch the appliance to fail-open mode

A service provider needs to block DDoS attacks at the network edge. The solution must be able to drop malicious traffic without affecting legitimate traffic. The provider has a limited budget and cannot afford a dedicated inline appliance for every peering point. Which approach is most effective?

Use a centralized inline scrubbing center that traffic is redirected to during an attack

Use a passive tap and an IDS to detect attacks, then manually block via router ACLs

Use SPAN to mirror traffic to a DDoS mitigation appliance

Deploy an inline IPS at each peering point

A small business wants to inspect all traffic between its branch office and the internet to enforce content filtering and block malware downloads. The business has a limited budget and cannot afford additional hardware. Which approach should they take?

Configure SPAN on the switch to mirror traffic to a laptop

Use a passive tap on the internet link and analyze traffic offline

Enable inline inspection on the existing firewall/router

Deploy a separate inline IPS appliance

CiscoCertified CyberOps Associate

Domain 4Objective 4

4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 7)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

5concepts

20%of the exam

Questions 31–33

31expert · hard
A security engineer is troubleshooting a network issue where an inline security appliance is dropping legitimate traffic. The appliance is configured in fail-closed mode. The engineer needs to maintain security enforcement while minimizing the impact on legitimate traffic. Which action should the engineer take?
Select an answer first
32expert · hard
A service provider needs to block DDoS attacks at the network edge. The solution must be able to drop malicious traffic without affecting legitimate traffic. The provider has a limited budget and cannot afford a dedicated inline appliance for every peering point. Which approach is most effective?
Select an answer first
33application · medium
A small business wants to inspect all traffic between its branch office and the internet to enforce content filtering and block malware downloads. The business has a limited budget and cannot afford additional hardware. Which approach should they take?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

4.4 Compare Inline Traffic Interrogation and Taps or Traffic Monitoring 200-201 Practice Questions (Page 7)

Questions 31–33

A service provider needs to block DDoS attacks at the network edge. The solution must be able to drop malicious traffic without affecting legitimate traffic. The provider has a limited budget and cannot afford a dedicated inline appliance for every peering point. Which approach is most effective?

A small business wants to inspect all traffic between its branch office and the internet to enforce content filtering and block malware downloads. The business has a limited budget and cannot afford additional hardware. Which approach should they take?

Keep studying — 4.0 Network Intrusion Analysis