A security team manages a large fleet of IoT devices that cannot run any third-party software. The team needs to monitor these devices for suspicious network activity. Which approach is most appropriate for this environment?

Install an EDR agent on each IoT device

Configure a VPN client on each IoT device

Deploy an agentless network monitoring solution that analyzes traffic via SPAN or TAP

Use a host-based firewall on each IoT device

A virtualized data center hosts multiple tenants on the same hypervisor. One tenant's VM is compromised, and the security team is concerned about the risk of the attacker accessing other tenants' VMs. The team must implement a control that reduces this risk without impacting performance significantly. Which control is most appropriate?

Install host-based firewalls on every VM

Enable hypervisor-level isolation and micro-segmentation

Use strong encryption for VM disk images

Deploy a network IPS on the physical network

Which endpoint security solution is specifically designed to detect, investigate, and respond to advanced threats by continuously monitoring endpoint behavior?

Endpoint Detection and Response (EDR)

How does antimalware differ from legacy antivirus in terms of detection capabilities?

Antimalware uses only signature-based detection

Antimalware only detects viruses, not other types of malware

Antimalware cannot be updated with new signatures

Antimalware can detect unknown threats using heuristics and behavior analysis

What is a primary purpose of log management in a security operations context?

To store logs in a way that supports compliance and analysis

To automatically block malicious IP addresses

To provide real-time antivirus scanning

CiscoCertified CyberOps Associate

Domain 1Objective 2

1.2 Compare Security Deployments 200-201 Practice Questions (Page 9)

Part of the 1.0 Security Concepts domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

14concepts

20%of the exam

Questions 41–45

41application · medium
A security team manages a large fleet of IoT devices that cannot run any third-party software. The team needs to monitor these devices for suspicious network activity. Which approach is most appropriate for this environment?
Select an answer first
42expert · hard
A virtualized data center hosts multiple tenants on the same hypervisor. One tenant's VM is compromised, and the security team is concerned about the risk of the attacker accessing other tenants' VMs. The team must implement a control that reduces this risk without impacting performance significantly. Which control is most appropriate?
Select an answer first
43foundation · easy
Which endpoint security solution is specifically designed to detect, investigate, and respond to advanced threats by continuously monitoring endpoint behavior?
Select an answer first
44foundation · easy
How does antimalware differ from legacy antivirus in terms of detection capabilities?
Select an answer first
45foundation · easy
What is a primary purpose of log management in a security operations context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.