200-201 Cisco Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Free Practice Exam Questions (2025 Updated)

The user-agent HTTP header field is used in forensics to identify the type of browser used. It contains a characteristic string that allows network protocol peers to identify the operating system and browser of the web-server. This information is crucial in forensic analysis as it can provide insights into the client’s environment1.

References := The importance of the user-agent string in identifying the browser type is discussed in various technical resources, including the Wikipedia page on HTTP header fields2 and articles on GeeksforGeeks1.

According to the NIST SP 800-61 incident handling process, the SOC team should first isolate the affected endpoints to prevent further spread of the attack and take disk images for analysis (A). This helps in preserving evidence for a thorough investigation. The next step would be to block the connection to the C&C server on the perimeter next-generation firewall ©, which helps to cut off the communication between the compromised endpoint and the attacker’s server, thereby mitigating the threat123.

 During the collection phase of the forensic process, data related to a specific event is labeled and recorded to preserve its integrity. This step ensures that the data remains unaltered and authentic from the time of collection until it is presented as evidence,maintaining the chain of custody. References := Cisco Cybersecurity Operations Fundamentals - Module 6: Security Incident Investigations

 Behavior-based detection monitors the behavior of programs in real-time. If a piece of software acts similarly to known malware after it’s been executed, behavior-based detection can stop it in its tracks. Signature-based detection involves searching for known patterns of data within executable code; if a pattern matches a “signature” in the system’s database that is considered malicious. References: Cisco Cybersecurity Operations Fundamentals

When a company workstation is compromised, the stakeholders that must be involved are the ones who are responsible for the security incident response process. According to the table, these are Employee 4 (Security Operation Center Analyst), Employee 6 (Head of Network and Security Infrastructure Services), and Employee 7 (Technical Director). The other employees have different roles that are not directly related to the incident response process, such as accounting, financial management, or system administration. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 1: Security Concepts, Lesson 1.4: Security Monitoring, Topic 1.4.1: Security Operations Center

 Full packet capture requires the largest amount of storage space because it involves recording all packets that pass through a network, including all headers and payloads. This type of data collection is comprehensive and allows for detailed analysis, but due to the volume of data it encompasses, it demands significant storage capacity1.

References := The Cisco Secure Network Analytics Data Store Design Guide discusses the storage requirements for different types of network data collection, highlighting the substantial storage needs for full packet captures1.

Table Description automatically generated

To isolate the suspicious host that is performing intensive network scanning, the analyst should collect the traffic by most active source IP. This will help to identify the IP address of the host that is generating the most traffic and sending the most packets or bytes. The analyst can then apply filters or queries to analyze the traffic from that source IP anddetermine the nature and scope of the scanning activity. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 72; [Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide], page 468

The exhibit shows a network diagram with a switch, a router, and two hosts. The switch has a MAC address table that maps the MAC addresses of the connected devices to the corresponding ports. A MAC flooding attack is a type of attack that aims to overload the switch’s MAC address table by sending a large number of frames with spoofed source MAC addresses. This causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, effectively turning it into a hub. This allows the attacker tosniff the traffic between the hosts and the router, or launch other attacks such as ARP spoofing or man-in-the-middle

The delivery phase of the Cyber Kill Chain model involves the transmission of the weapon to the targeted environment. In the case of a spear-phishing email, the delivery is the act of sending the email to the user. The email itself is the weapon, designed to exploit the recipient’s trust to cause a breach