CiscoCertified CyberOps Associate
Domain 4Objective 7
4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 7)
Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)
41questions here
9free pages
7concepts
20%of the exam
Questions 31–35
- 31
A PCAP shows a UDP packet with source IP 10.0.0.2, destination IP 10.0.0.255, source port 68, and destination port 67. The payload contains a DHCP discover message. What is the destination IP address?
Select an answer first - 32
A PCAP shows a series of TCP SYN packets from 192.168.1.10 to 10.0.0.1 on port 22, followed by SYN packets from 192.168.1.10 to 10.0.0.1 on port 23, then port 25, then port 80. Each SYN packet has a different source port. What is the most likely activity?
Select an answer first - 33
During analysis of a PCAP, an analyst sees a TCP packet with the SYN flag set. The IP header shows source 10.0.0.5 and destination 192.168.1.10. The TCP header shows source port 12345 and destination port 445. Which source port should be recorded as the initiating port?
Select an answer first - 34
Given a PCAP file containing an IPv4 packet, which field in the IP header contains the source IP address?
Select an answer first - 35
When examining a PCAP file, how can you quickly identify the destination IP address of a packet using Wireshark?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.