200-201 Practice Test

Skills this practice test covers

• Compare the access control models, from discretionary to attribute-based, and read CVSS terms.
• Identify the data that NetFlow, tcpdump, firewalls and content filters give an analyst.
• Interpret Windows and Linux logs, disk images and sandbox reports during an investigation.
• Extract files and key intrusion elements from a PCAP file with Wireshark.
• Sort alerts into true positives, false positives, false negatives, true negatives and benign events.
• Apply the NIST.SP800-61 incident handling steps and classify attacks with the Cyber Kill Chain.

5 domains · 50 topics · 194 of 740 questions are written for 200-201

Requirements

• No formal prerequisites: anyone can book the exam.
• Recommended: at least one year of work in cybersecurity or a security operations center.
• Recommended: networking basics and working knowledge of the Windows and Linux operating systems.

About the 200-201 exam

How to earn the certification

Earns

CCNA CybersecurityAssociate

CCNA Cybersecurity is valid for three years.

After

• 350-201 Performing Cybersecurity Using Cisco Security Technologies (CBRCOR)

  The core exam for CCNP Cybersecurity at the professional level.

• 300-215 Forensic Analysis and Incident Response (CBRFIR)

  A concentration exam on forensics and incident response. With the core exam it completes CCNP Cybersecurity, and on its own it earns a specialist certification.

How to prepare for 200-201

1. 1

   Tick off the version 1.2 topics

   Cisco's exam topics for version 1.2 number every item, from 1.1 on the CIA triad to 5.11 on SOC metrics. Mark each one only when it can be explained or done without notes.

2. 2

   Give monitoring data the most time

   Security Monitoring is the largest domain. For each data type, from NetFlow to full packet capture, write down what it shows and what NAT, tunneling or encryption hides from it.

3. 3

   Open real captures in Wireshark

   Load sample PCAP files, follow TCP streams, export the files they carry and read each protocol header. Network Intrusion Analysis asks for exactly this work.

4. 4

   Run one incident through NIST

   Take one alert, such as a phishing email, through preparation, detection and analysis, containment, eradication and recovery, and post-incident analysis. Then classify it with the Cyber Kill Chain and the Diamond Model.

5. 5

   Close with timed full runs

   Take the 200-201 practice test in Timed Mode once every topic is ticked off. Ask Brainy AI Assistant to explain each missed log line or header field until the reasoning is clear.

   Start a timed 200-201run

Cisco's course for this exam is Understanding Cisco Cybersecurity Operations Fundamentals, taught by instructors or followed as a self-paced learning path. Cisco Press publishes the Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide.

Who 200-201 is for

• Junior SOC analysts who triage alerts and want a first Cisco security certification.
• Network and system administrators moving into security operations work.
• Students preparing for a first job in a security operations center.
• Analysts who plan to go on to the professional level through CBRCOR.

Typical job titles: SOC analyst · Security operations analyst · Junior cybersecurity analyst · Incident response analyst · Security monitoring specialist

200-201 glossary

20 terms from the exam objectives and the vendor's official material, each defined in a sentence.

5-tuple

The five values that identify a network connection: source and destination IP address, source and destination port, and protocol.

Attribute-based access control (ABAC)

Access decided by attributes of the user, the resource and the environment, such as department, file type or time of day.

CIA triad

Confidentiality, integrity and availability: the three properties that security controls protect.

Corroborative evidence

Evidence that supports another piece of evidence, such as a firewall log that confirms what a host log shows.

CVSS

The Common Vulnerability Scoring System, which rates how severe a vulnerability is from metrics such as attack vector and privileges required.

Cyber Kill Chain

Lockheed Martin's seven-stage model of an attack, from reconnaissance to actions on objectives.

Deep packet inspection

Inspection of the payload and application data in a packet, not only the header fields that packet filters read.

Defense-in-depth strategy

Layering several independent controls, so that an attacker who gets past one still meets the next.

Detonation chamber

An isolated environment that runs a suspicious file to watch what it does; it is also called a sandbox.

Diamond Model of Intrusion

A model that describes each intrusion event by four linked parts: adversary, capability, infrastructure and victim.

False positive

An alert raised for activity that is not actually malicious.

Full packet capture

A recording of complete packets, payload included, so that an analyst can later see exactly what crossed the network.

Indicators of attack (IOAs)

Signs that an attack is in progress, based on what the attacker is doing rather than on known artifacts.

Indicators of compromise (IOCs)

Evidence that a system has been breached, such as a known malicious file hash or contact with an attacker's server.

NetFlow

A Cisco protocol that records network conversations: who talked to whom, on which ports, for how long and how much data, without the payload.

Role-based access control (RBAC)

Access granted by job role, so that each user gets the permissions attached to that role.

Run book automation (RBA)

Scripted response steps that a tool runs on its own, so that routine alerts are handled the same way every time.

TOR (The Onion Router)

A network that relays encrypted traffic through several volunteer nodes, which hides where the traffic comes from.

Volatile data collection

Collecting the data that is lost at shutdown, such as memory contents and running processes, before anything else.

X.509 certificates

The standard format for digital certificates, which bind a public key to an identity and are used in TLS.