An analyst is examining a PCAP and sees a TCP packet with destination port 80. The payload contains the string 'GET /index.php?file=../../etc/passwd HTTP/1.1'. The analyst needs to determine if this is a legitimate request or an attack. Which conclusion is most accurate?

The request is a cross-site scripting attack

The request is a normal HTTP GET request

The request is a SQL injection attempt

The request is likely a path traversal attack

An analyst is examining a PCAP and sees a TCP stream from 10.0.0.5 to 172.16.0.10. The first packet has source port 12345 and destination port 445. The response packet has source port 445 and destination port 12345. The payload contains SMB negotiation commands. What is the role of port 12345?

It is the destination port for the server

It is the well-known port for SMB

It is the ephemeral source port chosen by the client

It is the port for a reverse shell

CiscoCertified CyberOps Associate

Domain 4Objective 7

4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 4)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

20%of the exam

Questions 16–20

16application · medium
An analyst is examining a PCAP and sees a TCP packet with destination port 80. The payload contains the string 'GET /admin/login.php HTTP/1.1'. Which application-layer protocol is being used?
Select an answer first
17foundation · easy
In an IPv4 header, which field indicates the transport-layer protocol (e.g., TCP, UDP, ICMP) carried in the packet?
Select an answer first
18expert · hard
An analyst is examining a PCAP and sees a TCP packet with destination port 80. The payload contains the string 'GET /index.php?file=../../etc/passwd HTTP/1.1'. The analyst needs to determine if this is a legitimate request or an attack. Which conclusion is most accurate?
Select an answer first
19expert · hard
An analyst is examining a PCAP and sees a TCP stream from 10.0.0.5 to 172.16.0.10. The first packet has source port 12345 and destination port 445. The response packet has source port 445 and destination port 12345. The payload contains SMB negotiation commands. What is the role of port 12345?
Select an answer first
20application · medium
An analyst is reviewing a PCAP and sees a packet with an IPv4 header with protocol field 6, a TCP header with destination port 443, and a payload that begins with the bytes '16 03 01'. Which protocol is being used at the application layer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 4)

Questions 16–20

An analyst is examining a PCAP and sees a TCP packet with destination port 80. The payload contains the string 'GET /admin/login.php HTTP/1.1'. Which application-layer protocol is being used?

In an IPv4 header, which field indicates the transport-layer protocol (e.g., TCP, UDP, ICMP) carried in the packet?

An analyst is examining a PCAP and sees a TCP packet with destination port 80. The payload contains the string 'GET /index.php?file=../../etc/passwd HTTP/1.1'. The analyst needs to determine if this is a legitimate request or an attack. Which conclusion is most accurate?

An analyst is examining a PCAP and sees a TCP stream from 10.0.0.5 to 172.16.0.10. The first packet has source port 12345 and destination port 445. The response packet has source port 445 and destination port 12345. The payload contains SMB negotiation commands. What is the role of port 12345?

An analyst is reviewing a PCAP and sees a packet with an IPv4 header with protocol field 6, a TCP header with destination port 443, and a payload that begins with the bytes '16 03 01'. Which protocol is being used at the application layer?

Keep studying — 4.0 Network Intrusion Analysis