A security analyst is building a network profile to detect anomalies in traffic to the company's payment processing servers. The analyst has identified the IP address range 10.10.0.0/24 as the critical asset address space. Which additional profiling element would be most useful to establish a baseline for these servers?

Total number of IP addresses in the 10.10.0.0/24 range

The DNS name of the payment processing application

The MAC address of the default gateway for the 10.10.0.0/24 subnet

Average session duration for connections to the 10.10.0.0/24 range

A network analyst is profiling normal traffic for a file-sharing application used by the finance department. The analyst notices that some sessions to the file server last only a few seconds while others last over an hour. What is the MOST appropriate way to use session duration in this profile?

Set a fixed threshold of 30 minutes for all sessions

Ignore session duration because it varies too much to be useful

Record the average session duration and flag sessions that deviate significantly from it

Use session duration alone to identify the application

A network analyst is investigating a possible slow data exfiltration. The analyst notices that a workstation is sending small amounts of data to an external IP on port 53 (DNS) at regular intervals. The total throughput is low, but the sessions are very short and frequent. What does this pattern suggest?

The workstation is performing normal DNS lookups

The workstation is downloading software updates

The workstation is using DNS tunneling to exfiltrate data

The workstation is backing up data to a cloud service

In network profiling, what does the term 'total throughput' refer to?

The time taken for a single packet to travel from source to destination

The maximum theoretical bandwidth of the physical link

The total amount of data transferred over the network in a given period

The number of packets lost during a specific time interval

CiscoCertified CyberOps Associate

Domain 5Objective 7

5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 4)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

4concepts

15%of the exam

Questions 16–20

16application · medium
A security analyst is building a network profile to detect anomalies in traffic to the company's payment processing servers. The analyst has identified the IP address range 10.10.0.0/24 as the critical asset address space. Which additional profiling element would be most useful to establish a baseline for these servers?
Select an answer first
17application · medium
A network analyst is profiling normal traffic for a file-sharing application used by the finance department. The analyst notices that some sessions to the file server last only a few seconds while others last over an hour. What is the MOST appropriate way to use session duration in this profile?
Select an answer first
18expert · hard
A network analyst is investigating a possible slow data exfiltration. The analyst notices that a workstation is sending small amounts of data to an external IP on port 53 (DNS) at regular intervals. The total throughput is low, but the sessions are very short and frequent. What does this pattern suggest?
Select an answer first
19foundation · easy
In network profiling, what does the term 'total throughput' refer to?
Select an answer first
20foundation · easy
Which measurement unit is most commonly used to express total throughput in network profiling?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 4)

Questions 16–20

A network analyst is profiling normal traffic for a file-sharing application used by the finance department. The analyst notices that some sessions to the file server last only a few seconds while others last over an hour. What is the MOST appropriate way to use session duration in this profile?

In network profiling, what does the term 'total throughput' refer to?

Which measurement unit is most commonly used to express total throughput in network profiling?

Keep studying — 5.0 Security Policies and Procedures