A company is deploying a new security policy that requires blocking access to a specific application category (e.g., social media) and also blocking access to a list of known malicious URLs. The security team wants to use a single device to enforce both policies and log the user identity for each blocked attempt. Which technology should be deployed?

Web content filtering appliance

Next-generation firewall with integrated application visibility and web content filtering

Application visibility and control appliance

Which data types are typically provided by a next-generation firewall (NGFW) that a traditional stateful firewall does NOT provide?

Connection state and session information for allowed and denied traffic

Source and destination IP addresses and ports for each connection

Packet headers and payloads for every packet

Application-level information, user identity, and intrusion prevention alerts

Which type of data is primarily provided by a traditional stateful firewall?

Connection state and session information for allowed and denied traffic

URL categories and reputation scores for web requests

Full packet payloads for forensic analysis

Application identification and user identity for each session

A network administrator needs to verify that a firewall is correctly allowing established connections while blocking new inbound connections from the internet. Which data source provides the most direct evidence of connection state and session information?

Traditional stateful firewall logs

Next-generation firewall application logs

A network analyst is investigating a DDoS attack. The analyst needs to identify the top source IPs generating the most traffic, but also needs to see the exact packet payloads to determine if the attack is using a specific exploit. The analyst has limited storage and cannot capture full packets for all traffic. Which approach balances the need for flow statistics and packet-level detail?

Use NetFlow to identify top talkers and TCP dump with a filter to capture only traffic from those IPs

Use TCP dump for top talkers and NetFlow for packet payloads

Use NetFlow for both top talkers and packet payloads

Use TCP dump on all traffic and NetFlow for top talkers

CiscoCertified CyberOps Associate

Domain 2Objective 2

2.2 Identify the Types of Data Provided by These Technologies 200-201 Practice Questions (Page 5)

Part of the 2.0 Security Monitoring domain, which accounts for 25% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

7concepts

25%of the exam

Questions 21–25

21expert · hard
A company is deploying a new security policy that requires blocking access to a specific application category (e.g., social media) and also blocking access to a list of known malicious URLs. The security team wants to use a single device to enforce both policies and log the user identity for each blocked attempt. Which technology should be deployed?
Select an answer first
22foundation · easy
Which data types are typically provided by a next-generation firewall (NGFW) that a traditional stateful firewall does NOT provide?
Select an answer first
23foundation · easy
Which type of data is primarily provided by a traditional stateful firewall?
Select an answer first
24application · medium
A network administrator needs to verify that a firewall is correctly allowing established connections while blocking new inbound connections from the internet. Which data source provides the most direct evidence of connection state and session information?
Select an answer first
25expert · hard
A network analyst is investigating a DDoS attack. The analyst needs to identify the top source IPs generating the most traffic, but also needs to see the exact packet payloads to determine if the attack is using a specific exploit. The analyst has limited storage and cannot capture full packets for all traffic. Which approach balances the need for flow statistics and packet-level detail?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

2.2 Identify the Types of Data Provided by These Technologies 200-201 Practice Questions (Page 5)

Questions 21–25

Which data types are typically provided by a next-generation firewall (NGFW) that a traditional stateful firewall does NOT provide?

Which type of data is primarily provided by a traditional stateful firewall?

A network administrator needs to verify that a firewall is correctly allowing established connections while blocking new inbound connections from the internet. Which data source provides the most direct evidence of connection state and session information?

Keep studying — 2.0 Security Monitoring