During a ransomware incident, the SOC detected the attack at 14:00. The incident response team isolated the affected hosts at 15:30, preventing further spread. The SOC manager asks for the time to contain (TTC). What is the TTC?

From 15:30 to when all systems are restored — variable

From the initial infection time to 15:30 — unknown

From 14:00 to when the ransomware is fully removed — variable

What is scope analysis in the context of a SOC investigation?

The process of identifying the root cause of a security incident

The process of notifying stakeholders about a security incident

The process of collecting and preserving evidence from compromised systems

The process of defining the boundaries and objectives of a security investigation or incident response

Which scenario best illustrates regaining control over affected systems?

The SOC detects an intrusion and begins investigating the alert

The SOC isolates an infected server to prevent further spread

The SOC removes the attacker's access and verifies that the system is no longer compromised

The SOC documents the incident and schedules a post-incident review

An organization's SOC detected a malware infection on a critical server at 10:00. The incident response team was notified and began containment actions at 10:45. The SOC manager wants to report the time to respond (TTR) for this incident. What is the TTR?

From 10:00 to when containment is fully successful — variable

From 10:45 to when the system is restored — variable

From the actual infection time to 10:00 — unknown

What is the primary purpose of SOC metrics?

To provide a qualitative narrative of recent security incidents

To evaluate the performance and effectiveness of security operations

To replace the need for security incident response plans

To automate the detection of all security threats

CiscoCertified CyberOps Associate

Domain 5Objective 11

5.11 Describe the Relationship of SOC Metrics to Scope Analysis (time to Detect, Time to Contain, Time to Respond, Time to Control) 200-201 Practice Questions (Page 5)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

15%of the exam

Questions 21–25

21application · medium
During a ransomware incident, the SOC detected the attack at 14:00. The incident response team isolated the affected hosts at 15:30, preventing further spread. The SOC manager asks for the time to contain (TTC). What is the TTC?
Select an answer first
22foundation · easy
What is scope analysis in the context of a SOC investigation?
Select an answer first
23foundation · easy
Which scenario best illustrates regaining control over affected systems?
Select an answer first
24application · medium
An organization's SOC detected a malware infection on a critical server at 10:00. The incident response team was notified and began containment actions at 10:45. The SOC manager wants to report the time to respond (TTR) for this incident. What is the TTR?
Select an answer first
25foundation · easy
What is the primary purpose of SOC metrics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.