A SOC analyst is reviewing SOAR platform logs after an automated playbook ran. The logs show that the playbook 'Isolate_Endpoint' was triggered by a SIEM alert, executed a command on the endpoint to disable its network interface, and then sent a notification to the incident response team. The analyst notices that the playbook ran twice for the same alert. What is the most likely reason for the duplicate execution?

The endpoint had two network interfaces that both needed to be disabled

The SOAR platform's logging system duplicated the log entries

The SIEM alert was re-sent because the SOAR platform did not acknowledge receipt

The playbook was manually re-run by an analyst

A security analyst is examining a log entry that contains the following fields: timestamp, hostname, process name, event ID, and message. Which type of log format is the analyst most likely viewing?

A packet capture file in PCAP format

A free-form text log with no defined fields

A binary log format that requires a special parser

A structured log format such as JSON

A web application log shows the following entries for a single user session: 'GET /login.php', 'POST /login.php', 'GET /profile.php', 'GET /admin/users.php', 'GET /admin/config.php'. The user is a standard user and should not have access to the /admin/ pages. The application returned HTTP 200 for all requests. What does this log pattern most likely indicate?

The user is performing a normal browsing session

The web server is misconfigured to log incorrect status codes

The user is using a proxy that modifies the logs

The application has a broken access control vulnerability

A web server log contains an entry with a 404 status code for a request to /admin.php. What does this log entry most likely indicate?

The requested resource was not found

The server encountered an internal error

CiscoCertified CyberOps Associate

Domain 3Objective 5

3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 5)

Part of the 3.0 Host-Based Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

20%of the exam

Questions 21–25

21application · medium
A SOC analyst is reviewing SOAR platform logs after an automated playbook ran. The logs show that the playbook 'Isolate_Endpoint' was triggered by a SIEM alert, executed a command on the endpoint to disable its network interface, and then sent a notification to the incident response team. The analyst notices that the playbook ran twice for the same alert. What is the most likely reason for the duplicate execution?
Select an answer first
22foundation · easy
A security analyst is examining a log entry that contains the following fields: timestamp, hostname, process name, event ID, and message. Which type of log format is the analyst most likely viewing?
Select an answer first
23application · medium
A web application log shows the following entries for a single user session: 'GET /login.php', 'POST /login.php', 'GET /profile.php', 'GET /admin/users.php', 'GET /admin/config.php'. The user is a standard user and should not have access to the /admin/ pages. The application returned HTTP 200 for all requests. What does this log pattern most likely indicate?
Select an answer first
24foundation · easy
On a Linux system, which file or service is the primary destination for kernel and system log messages?
Select an answer first
25foundation · easy
A web server log contains an entry with a 404 status code for a request to /admin.php. What does this log entry most likely indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 5)

Questions 21–25

A security analyst is examining a log entry that contains the following fields: timestamp, hostname, process name, event ID, and message. Which type of log format is the analyst most likely viewing?

On a Linux system, which file or service is the primary destination for kernel and system log messages?

A web server log contains an entry with a 404 status code for a request to /admin.php. What does this log entry most likely indicate?

Keep studying — 3.0 Host-Based Analysis