A security analyst is correlating logs from a suspected breach. The firewall log shows a deny for an outbound connection, but the NetFlow record shows a corresponding flow with a high byte count. Which conclusion is the most reasonable?

The firewall deny may have been bypassed or the NetFlow record is from a different time window

The NetFlow record is from a different source technology

The firewall allowed the connection despite logging a deny

The firewall deny is a false positive

A company needs to enforce a web-use policy that blocks social media during work hours but allows access during lunch. They also need to log user identity for every web request. The current firewall only filters by IP and port. Which technology should they add to meet both requirements?

Proxy server with time-based URL filtering

Network application control system

CiscoCertified CyberOps Associate

Domain 4Objective 1

4.1 Map the Provided Events to Source Technologies 200-201 Practice Questions (Page 1)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

20%of the exam

Questions 1–5

1expert · hard
A security analyst is correlating logs from a suspected breach. The firewall log shows a deny for an outbound connection, but the NetFlow record shows a corresponding flow with a high byte count. Which conclusion is the most reasonable?
Select an answer first
2expert · hard
A company needs to enforce a web-use policy that blocks social media during work hours but allows access during lunch. They also need to log user identity for every web request. The current firewall only filters by IP and port. Which technology should they add to meet both requirements?
Select an answer first
3foundation · easy
A log entry shows: "User=bob, URL=http://www.example.com, Category=Business, Action=ALLOW". Which technology is the most likely source of this event?
Select an answer first
4foundation · easy
A security analyst reviews an event that says "Threat 'Trojan.GenericKD.123456' detected in file 'C:\Users\alice\Downloads\invoice.exe', action: quarantine". Which technology is the most likely source of this event?
Select an answer first
5application · medium
A network analyst needs to investigate a potential data exfiltration. The available log shows: `src_ip=10.0.0.5, dst_ip=203.0.113.9, src_port=50000, dst_port=443, protocol=TCP, packets=5000, bytes=5000000, flow_start=..., flow_end=...`. Which source technology produced this log?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

4.1 Map the Provided Events to Source Technologies 200-201 Practice Questions (Page 1)

Questions 1–5

A security analyst is correlating logs from a suspected breach. The firewall log shows a deny for an outbound connection, but the NetFlow record shows a corresponding flow with a high byte count. Which conclusion is the most reasonable?

A company needs to enforce a web-use policy that blocks social media during work hours but allows access during lunch. They also need to log user identity for every web request. The current firewall only filters by IP and port. Which technology should they add to meet both requirements?

A log entry shows: "User=bob, URL=http://www.example.com, Category=Business, Action=ALLOW". Which technology is the most likely source of this event?

A security analyst reviews an event that says "Threat 'Trojan.GenericKD.123456' detected in file 'C:\Users\alice\Downloads\invoice.exe', action: quarantine". Which technology is the most likely source of this event?

A network analyst needs to investigate a potential data exfiltration. The available log shows: `src_ip=10.0.0.5, dst_ip=203.0.113.9, src_port=50000, dst_port=443, protocol=TCP, packets=5000, bytes=5000000, flow_start=..., flow_end=...`. Which source technology produced this log?

Keep studying — 4.0 Network Intrusion Analysis