10 free Cisco 200-201 CBROPS practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 462 questions. Work through them, then open each answer to check your reasoning.
Get all 462 questions (US$39) · Download these 10 as a PDF
Question 1
Which event is user interaction?
Show answer and explanation
Correct answer: D. opening a malicious file
Opening a malicious file is a direct user interaction event, a person actively performs the action that triggers the security incident. The other options represent either system-level compromises (gaining root access, executing remote code) or administrative properties (file permissions) that may occur without user awareness or direct interaction.
Why the other options are wrong
- A. Gaining root access is a system-level compromise, not a user interaction event.
- B. Executing remote code is an attacker-driven action, not a user interaction.
- C. Reading and writing file permissions are system properties, not user interactions.
Question 2
Which security principle requires more than one person is required to perform a critical task?
Show answer and explanation
Correct answer: C. separation of duties
Separation of duties is the principle that requires multiple people to complete a critical task, ensuring no single person can perform sensitive operations alone. This provides accountability and prevents fraud. Least privilege limits access scope, need to know restricts information sharing, and due diligence refers to investigative processes, none specifically address the multi-person requirement.
Why the other options are wrong
- A. Least privilege restricts access levels, not requiring multiple people.
- B. Need to know limits information distribution to those who require it.
- D. Due diligence is an investigative and assessment process, not a multi-person control.
Question 3
How is attacking a vulnerability categorized?
Show answer and explanation
Correct answer: C. exploitation
Exploitation is the attack phase in which an attacker actively attacks a vulnerability to gain access or control. This is distinct from delivery (moving the attack tool to the target), installation (establishing persistence), and action on objectives (achieving the attacker's goal after compromise).
Why the other options are wrong
- A. Action on objectives occurs after successful exploitation, when the attacker pursues their goal.
- B. Delivery is the phase of transporting the attack tool to the target system.
- D. Installation is the phase of establishing persistence mechanisms, not attacking the vulnerability itself.
Question 4
What is a benefit of agent-based protection when compared to agentless protection?
Show answer and explanation
Correct answer: C. It collects and detects all traffic locally
Agent-based protection collects and detects traffic and threats locally on each endpoint, providing visibility into all local activity. This local detection capability is a key advantage over agentless protection, which cannot observe all local processes. Centralized platforms, managing numerous devices, and lowering maintenance costs are either characteristic of agentless solutions or not primarily benefits of agent-based approaches.
Why the other options are wrong
- A. Agent-based protection typically increases maintenance costs due to per-endpoint management.
- B. Agentless protection provides the centralized platform advantage.
- D. Agentless solutions are better suited for managing numerous devices simultaneously without per-device agents.
Question 5
Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?
Show answer and explanation
Correct answer: D. due diligence
Due diligence is the principle of conducting thorough, systematic investigation and information gathering to understand a situation before making decisions. During incident response, an analyst gathers relevant information about the security incident to determine the appropriate course of action, this investigation process embodies due diligence. Decision making, rapid response, and data mining describe actions or techniques, not the underlying principle of careful investigative analysis.
Why the other options are wrong
- A. Decision making is the act of choosing a course of action, not the investigative principle.
- B. Rapid response emphasizes speed, not the thorough information gathering required by due diligence.
- C. Data mining is a technique for extracting information, not the principle guiding investigation.
Question 6
One of the objectives of information security is to protect the CIA of information and systems.
What does CIA mean in this context?
Show answer and explanation
Correct answer: D. confidentiality, integrity, and availability
The CIA triad stands for confidentiality, integrity, and availability, the three core objectives of information security. Confidentiality prevents unauthorized disclosure, integrity ensures data is not altered without authorization, and availability ensures systems and data are reachable when needed. Identity and authorization are valid security concepts, but they belong to access control, not the CIA model.
Why the other options are wrong
- A. This option replaces both integrity and availability with identity and authorization, neither of which is part of the triad.
- B. Confidentiality and integrity are correct, but the third element is availability, not authorization.
- C. Confidentiality and availability are correct, but the second element is integrity, not identity.
Question 7
What is rule-based detection when compared to statistical detection?
Show answer and explanation
Correct answer: B. proof of a user's action
Rule-based detection uses predefined rules to identify and flag specific actions that match known patterns of malicious or unauthorized behavior, providing proof of a user's action. Statistical detection, by contrast, establishes baselines and flags deviations, providing a likelihood assessment. Rule-based detection is deterministic, it confirms that an action matching the rule has occurred, not merely suggesting probability.
Why the other options are wrong
- A. Neither rule-based nor statistical detection proves a user's identity; both analyze behavior.
- C. Likelihood of action characterizes statistical detection, not rule-based detection.
- D. Falsification of identity is not the purpose of either detection method.
Question 8
An engineer configured regular expression ".*.([Dd][Oo][Cc]|[Xx][LI][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]" on Cisco ASA firewall.
What does this regular expression do?
Show answer and explanation
Correct answer: C. It captures Word, Excel, and PowerPoint files in HTTP v1.0 and v1.1.
The expression matches requests for files whose extensions are doc, xls, or ppt in any combination of upper and lower case, carried over HTTP/1.0 or HTTP/1.1. Those extensions correspond to Microsoft Word, Excel, and PowerPoint files, and the HTTP/1. [01] portion covers both protocol versions. The character classes exist only to make the match case insensitive, so the filter catches DOC, Doc, and doc equally.
Why the other options are wrong
- A. The third alternation matches the ppt extension, not pdf, so PDF files are never matched.
- B. This is too broad: the expression matches only three specific Office extensions over HTTP/1.0 and HTTP/1.1, not documents in general.
- D. The pattern HTTP/1.[01] matches both HTTP/1.0 and HTTP/1.1, so restricting it to HTTP/1.0 is incorrect.
Question 9
Which process is used when IPS events are removed to improve data integrity?
Show answer and explanation
Correct answer: B. data normalization
Data normalization is the process used to remove IPS (Intrusion Prevention System) events and other redundant or duplicate data to improve data integrity and consistency. Normalization standardizes data formats and eliminates duplicates that can skew analysis and reporting in security operations.
Why the other options are wrong
- A. Data availability refers to ensuring systems and data are accessible when needed, not the removal of events for integrity.
- C. Data signatures are patterns used to identify threats, not a process for removing events.
- D. Data protection involves safeguarding data through encryption and access controls, not event removal.
Question 10
An analyst is investigating an incident in a SOC environment.
Which method is used to identify a session from a group of logs?
Show answer and explanation
Correct answer: C. 5-tuple
A 5-tuple (source IP, destination IP, source port, destination port, and protocol) uniquely identifies a network session and is the standard method used by analysts to correlate and identify specific sessions within logs during incident investigation.
Why the other options are wrong
- A. Sequence numbers identify individual packets within a stream, not sessions themselves.
- B. The IP identifier field is used for packet fragmentation reassembly, not session identification.
- D. Timestamps alone cannot uniquely identify a session as multiple sessions may occur at overlapping times.
That was 10 of 462.
The full Cisco 200-201 CBROPS pack has all 462 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.