A security analyst is creating a baseline for a critical application server. The analyst has two weeks of NetFlow data. The average session duration is 10 minutes, but there are occasional sessions that last over 1 hour. The analyst also notices that the total throughput during those long sessions is significantly higher than normal. What is the most appropriate action?

Block all sessions that last longer than 1 hour

Set the baseline to 1 hour and the throughput threshold to the high value

Investigate the long-duration, high-throughput sessions to determine if they are legitimate

Include all sessions in the baseline without investigation to avoid bias

A security analyst is investigating a potential data exfiltration from a critical file server. The server normally transfers about 10 GB per day to a backup site. Over the past week, the analyst observes that the server has been sending 15 GB per day to a new external IP address on port 443. The sessions are short but frequent. What is the MOST likely explanation?

The backup software has been reconfigured to use a different port

The server is performing a legitimate software update

The increase is due to normal business growth

An attacker is using HTTPS to exfiltrate data in small chunks

An organization has a limited security budget and must choose which network segments to monitor with full packet capture. The organization has a public web server, an internal file server with sensitive data, and a development network. The security team wants to maximize detection of data exfiltration. Which segment should be prioritized?

The internal file server segment

How does port usage contribute to network profiling?

It reveals the physical path packets take through the network

It indicates the application or service associated with the traffic

It determines the MAC address of the destination device

It shows the encryption strength of the session

CiscoCertified CyberOps Associate

Domain 5Objective 7

5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 1)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

4concepts

15%of the exam

Questions 1–5

1expert · hard
A security analyst is creating a baseline for a critical application server. The analyst has two weeks of NetFlow data. The average session duration is 10 minutes, but there are occasional sessions that last over 1 hour. The analyst also notices that the total throughput during those long sessions is significantly higher than normal. What is the most appropriate action?
Select an answer first
2expert · hard
A security analyst is investigating a potential data exfiltration from a critical file server. The server normally transfers about 10 GB per day to a backup site. Over the past week, the analyst observes that the server has been sending 15 GB per day to a new external IP address on port 443. The sessions are short but frequent. What is the MOST likely explanation?
Select an answer first
3expert · hard
An organization has a limited security budget and must choose which network segments to monitor with full packet capture. The organization has a public web server, an internal file server with sensitive data, and a development network. The security team wants to maximize detection of data exfiltration. Which segment should be prioritized?
Select an answer first
4foundation · easy
How does port usage contribute to network profiling?
Select an answer first
5application · easy
An analyst is reviewing network flows and sees that a server has high total throughput on TCP port 25. What is the most likely service running on that server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 1)

Questions 1–5

How does port usage contribute to network profiling?

An analyst is reviewing network flows and sees that a server has high total throughput on TCP port 25. What is the most likely service running on that server?

Keep studying — 5.0 Security Policies and Procedures