CiscoCertified CyberOps Associate
Domain 3Objective 2
3.2 Identify Components of an Operating System (such as Windows and Linux) in a Given Scenario 200-201 Practice Questions (Page 9)
Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)
49questions here
10free pages
8concepts
20%of the exam
Questions 41–45
- 41
A security analyst is investigating a Windows server where a user account was unexpectedly added to the local Administrators group. The analyst needs to find when this change occurred and which account performed it. Where should the analyst look first?
Select an answer first - 42
A Windows administrator needs to determine whether an account was used to log on interactively to a workstation at a specific time. Which Windows log should the administrator review?
Select an answer first - 43
A Windows service fails to start, and the administrator suspects that the service account does not have the 'Log on as a service' right. Where should the administrator verify this right?
Select an answer first - 44
A security analyst is investigating a Windows host and needs to identify which processes are currently running and their resource usage. Which tool should they use?
Select an answer first - 45
A Linux server is running a web application that spawns multiple concurrent connections. The administrator notices that the application creates a new process for each connection, causing high memory usage. The administrator wants to reduce memory overhead while keeping the application responsive. Which OS concept should the administrator leverage?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.