A security analyst is building a baseline profile for a critical database server that hosts a customer-facing application. The analyst wants to identify unusual patterns that could indicate data exfiltration. Which combination of metrics would be MOST useful for this baseline?

Number of failed login attempts and source IP addresses

CPU utilization and memory usage of the database server

DNS query volume and response times

Total throughput and session duration for the database port

Why is identifying the critical asset address space important in network profiling?

It automatically blocks all traffic to those addresses

It reduces the total number of IP addresses needed by the organization

It determines the physical location of the servers

It allows analysts to focus monitoring and alerts on the most valuable systems

In network profiling, what does 'session duration' represent?

The time between the first and last packet of a network session

The time it takes for a packet to travel from source to destination

The time a device remains powered on

The time between two consecutive packets in the same session

A network analyst is creating a baseline for a backup server that transfers large files to an offsite location every night. The analyst wants to detect if an attacker is using the backup channel to exfiltrate data. Which metric would be MOST useful to monitor?

Ports used by the backup application

Source IP addresses of backup connections

Total throughput of the backup traffic

Session duration of each backup connection

A security team is defining the critical asset address space for a large enterprise. The team has limited monitoring resources and must prioritize. The enterprise has the following subnets: 10.1.0.0/16 (employee workstations), 10.2.0.0/16 (production servers), 10.3.0.0/16 (development environment), and 10.4.0.0/16 (guest Wi-Fi). Which subnet should be designated as the highest-priority critical asset address space?

10.1.0.0/16 (employee workstations)

10.3.0.0/16 (development environment)

10.2.0.0/16 (production servers)

CiscoCertified CyberOps Associate

Domain 5Objective 7

5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 5)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

4concepts

15%of the exam

Questions 21–25

21application · medium
A security analyst is building a baseline profile for a critical database server that hosts a customer-facing application. The analyst wants to identify unusual patterns that could indicate data exfiltration. Which combination of metrics would be MOST useful for this baseline?
Select an answer first
22foundation · easy
Why is identifying the critical asset address space important in network profiling?
Select an answer first
23foundation · easy
In network profiling, what does 'session duration' represent?
Select an answer first
24application · medium
A network analyst is creating a baseline for a backup server that transfers large files to an offsite location every night. The analyst wants to detect if an attacker is using the backup channel to exfiltrate data. Which metric would be MOST useful to monitor?
Select an answer first
25expert · hard
A security team is defining the critical asset address space for a large enterprise. The team has limited monitoring resources and must prioritize. The enterprise has the following subnets: 10.1.0.0/16 (employee workstations), 10.2.0.0/16 (production servers), 10.3.0.0/16 (development environment), and 10.4.0.0/16 (guest Wi-Fi). Which subnet should be designated as the highest-priority critical asset address space?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.