CiscoCertified CyberOps Associate
Domain 4Objective 7
4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 8)
Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)
41questions here
9free pages
7concepts
20%of the exam
Questions 36–40
- 36
In a TCP segment captured in a PCAP file, which header field contains the source port number?
Select an answer first - 37
A PCAP contains a packet where the Ethernet type field is 0x0800, the IPv4 protocol field is 17, and the UDP destination port is 53. Which protocol should the analyst identify as the transport-layer protocol?
Select an answer first - 38
When examining a PCAP file, which tool feature is commonly used to view the payload contents of a packet?
Select an answer first - 39
A PCAP contains a UDP packet with source IP 203.0.113.5, destination IP 192.0.2.10, source port 53, and destination port 5353. The analyst needs to identify the host that sent the packet. Which field should be used?
Select an answer first - 40
An analyst is investigating a PCAP and sees a TCP connection with source IP 192.168.1.10, destination IP 203.0.113.7, source port 49152, and destination port 22. The analyst needs to determine if this is a legitimate SSH connection or a potential brute-force attack. Which additional finding would most strongly indicate a brute-force attack?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.