An organization has a high rate of false positives from its current detection system. The system flags legitimate users who occasionally access the network from new locations. The team wants to reduce false positives while still detecting compromised accounts. Which approach is most appropriate?

Use rule-based detection that flags any login from a new location

Use statistical detection with a fixed threshold for all users

Disable detection for new locations

Use behavioral detection with a baseline that includes location variability

A security analyst is monitoring network traffic and wants to detect a slow and low data exfiltration attack that transfers small amounts of data over a long period. The analyst has no prior knowledge of the attack. Which detection method is most likely to identify this activity?

Rule-based detection using a signature for known exfiltration tools.

Behavioral detection that flags any data transfer outside of business hours.

A combination of rule-based and behavioral detection using known signatures and user baselines.

Statistical detection that monitors the cumulative data transferred over time and flags when it exceeds a threshold.

A security team wants to detect a new ransomware strain that encrypts files in a pattern never seen before. They also need to reduce false positives from legitimate users who occasionally work late. Which detection strategy best addresses both needs?

Deploy statistical detection to model normal file-access rates and flag outliers, while using rule-based detection for known ransomware signatures

Use only rule-based detection with a broad set of ransomware signatures

Disable all detection and rely on manual review of alerts

Use only behavioral detection that flags any user who works after 6 PM

A security operations center (SOC) is implementing a new detection strategy. The SOC has a small team and cannot investigate all alerts. They want to reduce alert fatigue while maintaining the ability to detect unknown threats. Which approach is most effective?

Use only rule-based detection to minimize false positives and focus on known threats.

Use only behavioral detection and alert on all anomalies, regardless of severity.

Use statistical detection with a low threshold to catch all outliers.

Use rule-based detection for known threats and behavioral detection for anomalies, but only alert on high-severity behavioral anomalies.

CiscoCertified CyberOps Associate

Domain 1Objective 11

1.11 Compare Rule-Based Detection vs. Behavioral and Statistical Detection 200-201 Practice Questions (Page 2)

Part of the 1.0 Security Concepts domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

4concepts

20%of the exam

Questions 6–10

6application · medium
An organization has a high rate of false positives from its current detection system. The system flags legitimate users who occasionally access the network from new locations. The team wants to reduce false positives while still detecting compromised accounts. Which approach is most appropriate?
Select an answer first
7application · medium
A security analyst is monitoring network traffic and wants to detect a slow and low data exfiltration attack that transfers small amounts of data over a long period. The analyst has no prior knowledge of the attack. Which detection method is most likely to identify this activity?
Select an answer first
8application · medium
A security team wants to detect a new ransomware strain that encrypts files in a pattern never seen before. They also need to reduce false positives from legitimate users who occasionally work late. Which detection strategy best addresses both needs?
Select an answer first
9expert · hard
A security operations center (SOC) is implementing a new detection strategy. The SOC has a small team and cannot investigate all alerts. They want to reduce alert fatigue while maintaining the ability to detect unknown threats. Which approach is most effective?
Select an answer first
10foundation · easy
A security team deploys a system that learns normal user login times and flags logins at unusual hours. Which detection method does this describe?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.