An analyst is investigating a possible C2 beacon. The IDS generated an alert for a suspicious pattern, the firewall log shows an allow for the same connection, and NetFlow shows a flow with a regular interval. Which log provides the strongest evidence of a beacon?

NetFlow flow with regular interval

A user reports that a legitimate file download from a vendor website is being blocked. The proxy log shows: `action=blocked, category=Downloads, reason=file-type, url=https://vendor.com/update.exe`. The antivirus log shows no detection for the file. Which action should the analyst take first?

Add a firewall rule to allow the URL

Whitelist the user in the proxy

Review the proxy file-type filtering policy

Disable antivirus real-time scanning

Which event is most likely generated by antivirus software?

File 'report.doc' was cleaned because it contained a macro virus

Connection from 10.0.0.1 to 10.0.0.2 port 22 was denied by rule 5

User 'bob' requested http://example.com and was allowed by policy

Attack 'EternalBlue' detected on host 10.0.0.5, action: dropped

Which event is most likely generated by a network application control system?

Application 'Facebook' matched policy 'Block-Social-Media' and session was terminated

Connection from 10.0.0.1 to 10.0.0.2 port 22 was allowed by rule 5

File 'invoice.pdf' was quarantined because it contained a macro virus

User 'alice' requested http://blocked-site.com and was denied by URL category 'Malware'

CiscoCertified CyberOps Associate

Domain 4Objective 1

4.1 Map the Provided Events to Source Technologies 200-201 Practice Questions (Page 2)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

20%of the exam

Questions 6–10

6expert · hard
An analyst is investigating a possible C2 beacon. The IDS generated an alert for a suspicious pattern, the firewall log shows an allow for the same connection, and NetFlow shows a flow with a regular interval. Which log provides the strongest evidence of a beacon?
Select an answer first
7expert · hard
A user reports that a legitimate file download from a vendor website is being blocked. The proxy log shows: `action=blocked, category=Downloads, reason=file-type, url=https://vendor.com/update.exe`. The antivirus log shows no detection for the file. Which action should the analyst take first?
Select an answer first
8foundation · easy
Which event is most likely generated by antivirus software?
Select an answer first
9foundation · easy
Which event is most likely generated by a network application control system?
Select an answer first
10foundation · easy
A log entry shows: "Action=ALLOW, Src=10.1.1.10, Dst=172.16.5.20, Spt=12345, Dpt=443, Rule=1001". Which technology is the most likely source of this event?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.