An analyst is inspecting an HTTP/2 stream in a packet capture. The analyst sees a HEADERS frame with a stream identifier of 1 and a :method field set to GET. The :path field is set to /admin. What is the analyst most likely looking at?

An HTTP/2 response from the server

An HTTP/2 request for the /admin resource

A security analyst is reviewing email traffic and sees a TCP session to port 110. The client sends the command 'USER alice' and the server responds with '+OK'. The client then sends 'PASS secret' and the server responds with '+OK'. Which protocol is being used and what is the analyst seeing?

POP3; a successful authentication

SMTP; a successful authentication

An analyst is examining an ARP packet that has the operation field set to 1 (request). The sender hardware address is 00:11:22:33:44:55 and the sender protocol address is 192.168.1.10. The target hardware address is 00:00:00:00:00:00 and the target protocol address is 192.168.1.1. The Ethernet frame carrying this ARP packet has a source MAC of 00:11:22:33:44:55 and a destination MAC of ff:ff:ff:ff:ff:ff. What is the most likely purpose of this packet?

To announce the sender's MAC address to all hosts on the local network

To verify that the sender's IP address is not already in use

To update the ARP cache of the target host with the sender's MAC address

To resolve the MAC address of 192.168.1.1

CiscoCertified CyberOps Associate

Domain 4Objective 8

4.8 Interpret the Fields in Protocol Headers as Related to Intrusion Analysis 200-201 Practice Questions (Page 3)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

Questions 11–15

11foundation · easy
Which SMTP command is used to initiate the transfer of the email message data after the sender and recipients have been specified?
Select an answer first
12application · medium
An analyst is inspecting an HTTP/2 stream in a packet capture. The analyst sees a HEADERS frame with a stream identifier of 1 and a :method field set to GET. The :path field is set to /admin. What is the analyst most likely looking at?
Select an answer first
13foundation · easy
In an Ethernet frame, which field directly indicates the upper-layer protocol carried in the payload?
Select an answer first
14application · medium
A security analyst is reviewing email traffic and sees a TCP session to port 110. The client sends the command 'USER alice' and the server responds with '+OK'. The client then sends 'PASS secret' and the server responds with '+OK'. Which protocol is being used and what is the analyst seeing?
Select an answer first
15application · medium
An analyst is examining an ARP packet that has the operation field set to 1 (request). The sender hardware address is 00:11:22:33:44:55 and the sender protocol address is 192.168.1.10. The target hardware address is 00:00:00:00:00:00 and the target protocol address is 192.168.1.1. The Ethernet frame carrying this ARP packet has a source MAC of 00:11:22:33:44:55 and a destination MAC of ff:ff:ff:ff:ff:ff. What is the most likely purpose of this packet?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

4.8 Interpret the Fields in Protocol Headers as Related to Intrusion Analysis 200-201 Practice Questions (Page 3)

Questions 11–15

Which SMTP command is used to initiate the transfer of the email message data after the sender and recipients have been specified?

An analyst is inspecting an HTTP/2 stream in a packet capture. The analyst sees a HEADERS frame with a stream identifier of 1 and a :method field set to GET. The :path field is set to /admin. What is the analyst most likely looking at?

In an Ethernet frame, which field directly indicates the upper-layer protocol carried in the payload?

A security analyst is reviewing email traffic and sees a TCP session to port 110. The client sends the command 'USER alice' and the server responds with '+OK'. The client then sends 'PASS secret' and the server responds with '+OK'. Which protocol is being used and what is the analyst seeing?

Keep studying — 4.0 Network Intrusion Analysis