A SOC analyst sees an alert for a known command-and-control domain. The analyst checks the firewall logs and confirms that a workstation has been communicating with that domain. According to NIST SP 800-61, which phase of incident handling is the analyst performing?

Containment, eradication, and recovery

What is the primary purpose of a communication plan in incident response?

To ensure that the right information reaches the right people in a timely manner

To provide a detailed technical analysis of the incident

To list the tools used for forensic analysis

To document the evidence collected during the incident

A SOC analyst sees an alert for a known malicious IP address. The IP is also used by a legitimate vendor that the company works with. The analyst must decide whether to block the IP or investigate further. Which action is most aligned with NIST SP 800-61 detection and analysis guidance?

Escalate the alert to law enforcement without further analysis.

Block the IP immediately because it is on a threat intelligence list.

Investigate the context of the alert, including other logs and the vendor relationship, before taking action.

Ignore the alert because the IP belongs to a known vendor.

During a security incident, the incident response team needs to make a decision about whether to take a critical server offline, which will affect business operations. According to NIST SP 800-61, who should make this decision?

The system administrator for the server

The incident response team as a group

Management or an executive designated in the incident response plan

CiscoCertified CyberOps Associate

Domain 5Objective 2

5.2 Describe the Elements in an Incident Response Plan as Stated in NIST.SP800-61 200-201 Practice Questions (Page 6)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

12concepts

15%of the exam

Questions 26–30

26application · medium
A SOC analyst sees an alert for a known command-and-control domain. The analyst checks the firewall logs and confirms that a workstation has been communicating with that domain. According to NIST SP 800-61, which phase of incident handling is the analyst performing?
Select an answer first
27application · easy
A junior analyst receives an alert for a possible SQL injection attack. The team has a documented set of steps that includes verifying the attack, blocking the source IP, and escalating to the database team. What is this documented set of steps called?
Select an answer first
28foundation · easy
What is the primary purpose of a communication plan in incident response?
Select an answer first
29expert · hard
A SOC analyst sees an alert for a known malicious IP address. The IP is also used by a legitimate vendor that the company works with. The analyst must decide whether to block the IP or investigate further. Which action is most aligned with NIST SP 800-61 detection and analysis guidance?
Select an answer first
30application · medium
During a security incident, the incident response team needs to make a decision about whether to take a critical server offline, which will affect business operations. According to NIST SP 800-61, who should make this decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.