A SOC team spends significant time manually performing repetitive tasks such as quarantining infected endpoints and blocking malicious IP addresses after receiving alerts. The team wants to reduce response time and ensure consistent actions. Which solution should be implemented?

Endpoint detection and response (EDR) with manual investigation

SIEM with more correlation rules

A company is migrating a monolithic application to a containerized microservices architecture in a public cloud. The security team must ensure that containers are isolated from each other and from the host, and that images are free of known vulnerabilities. The team also needs to comply with a requirement that all container images be scanned before deployment. Which combination of controls best meets these requirements?

A network firewall between the containers and a host-based IDS on the Kubernetes nodes

A SIEM to monitor container logs and a SOAR platform to automate responses

Container image scanning in CI/CD and runtime isolation via Kubernetes namespaces and security contexts

A web application firewall (WAF) in front of the application and a VPN for inter-container traffic

A development team is deploying a containerized application to a Kubernetes cluster. The security team wants to ensure that the container images do not contain known vulnerabilities before they are deployed. Which control should be integrated into the CI/CD pipeline?

Container image scanning during the build process

A network firewall between the Kubernetes nodes

A web application firewall (WAF) in front of the application

A host-based intrusion detection system (HIDS) on the Kubernetes nodes

A security operations center (SOC) receives logs from firewalls, servers, and applications. Analysts are overwhelmed by the volume and cannot correlate events across different sources to detect multi-stage attacks. Which solution would most directly address this challenge?

Deploy a SIEM platform to aggregate and correlate logs

Implement a SOAR platform for automated response

Use a log management tool for centralized storage only

In which cloud service model does the customer have the most responsibility for securing the operating system and applications?

Infrastructure as a Service (IaaS)

CiscoCertified CyberOps Associate

Domain 1Objective 2

1.2 Compare Security Deployments 200-201 Practice Questions (Page 3)

Part of the 1.0 Security Concepts domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

20%of the exam

Questions 11–15

11application · medium
A SOC team spends significant time manually performing repetitive tasks such as quarantining infected endpoints and blocking malicious IP addresses after receiving alerts. The team wants to reduce response time and ensure consistent actions. Which solution should be implemented?
Select an answer first
12expert · hard
A company is migrating a monolithic application to a containerized microservices architecture in a public cloud. The security team must ensure that containers are isolated from each other and from the host, and that images are free of known vulnerabilities. The team also needs to comply with a requirement that all container images be scanned before deployment. Which combination of controls best meets these requirements?
Select an answer first
13application · medium
A development team is deploying a containerized application to a Kubernetes cluster. The security team wants to ensure that the container images do not contain known vulnerabilities before they are deployed. Which control should be integrated into the CI/CD pipeline?
Select an answer first
14application · medium
A security operations center (SOC) receives logs from firewalls, servers, and applications. Analysts are overwhelmed by the volume and cannot correlate events across different sources to detect multi-stage attacks. Which solution would most directly address this challenge?
Select an answer first
15foundation · easy
In which cloud service model does the customer have the most responsibility for securing the operating system and applications?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.