Cisco CyberOps Associate Practice Exam

These questions are part of the practice quiz. Start practicing

• Which of the following does NetFlow use to determine if traffic belongs to the same flow? (Select three.)
• Which security condition does an attacker exploit when sending a flood of packets to a victim to disrupt services?
• Which of the following is the case when an IDS does not identify an actual attack?
• Which of the following is a technique used by cybercrooks to trick users into revealing confidential information?
• Which of the following is NOT a characteristic of a secure storage facility in emergency planning?
• Which of the following VPN protocols is known for its strong security and encryption capabilities?
• What is the definition of code injection?
• Which property of information security does encryption support?
• Which of the following metrics can measure the effectiveness of a runbook?
• What should be avoided when developing emergency communication strategies?
• What is an advantage of application visibility and control?
• Which security monitoring data type requires the most storage space?
• Which of the following answers best describes the purpose of the preparation phase?
• Which security model restricts access based on the owner's policy?
• Which type of attack occurs when a botnet is used to transmit requests from an NTP server to overwhelm the target?
• Which type of attack is characterized by overwhelming a system with traffic, rendering it unavailable?
• What does CIA stand for in the context of information security?
• What is a primary benefit of conducting security awareness training?
• What is the primary focus of incident response in cybersecurity?
• Which of the following is not related to SIEM system activity?
• Which of the following describes a computer program designed to infiltrate and damage a computer without user interaction?
• What does the term "malware" encompass?
• Which of the following is most commonly used in PPTP, L2TP/IPsec, SSTP, and OpenVPN?
• At which OSI layer does a router typically operate?
• Which of the following uses a set of rules that filter network traffic and can be configured on network devices with packet filtering capabilities?
• What are the advantages of full-duplex transmission mode, as opposed to half-duplex mode? (Select all correct answers.)
• Which of the following is an attack that exploits a vulnerable application and executes commands on a remote host?
• Which of the following terms represent types of cross-site scripting attacks? (Choose two.)
• What does it mean when access to a resource is granted with discretionary control?
• Which of the following refers to disassembling an object to see how it works and to study its structure and behavior?
• What type of attack involves overwhelming a server with too many requests?
• Define "data loss prevention" (DLP).
• What is "DNS Spoofing"?
• What is a zero-day vulnerability?
• Which method is commonly used for securing wireless networks?
• Which statement about digitally signing a document is true?
• What is a primary purpose of a firewall in a network security architecture?
• Which of the following allows you to create a secure connection to another network over the internet?
• John sent an HTTP GET request to get a file from the web server. Which event artifact will identify the request?
• Which of the following is a code injection technique that launches malicious statements via input fields?
• For which of the following access control models is the main purpose preserving the confidentiality of data?
• Which of the following is an ideal characteristic of communication in emergencies?
• Which term describes the modification of a message during transmission without detection?
• Which type of malware is specifically designed to extort money from victims?
• Which of the following is the correct definition of tcpdump?
• Explain what "sandboxing" means in cybersecurity.
• Which cryptographic key is used by an X.509 certificate?
• What is essential for backup in an emergency situation?
• By introducing malicious code into a program, what is the primary goal of a code injection attack?
• What constitutes a successful brute force attack?
• What term describes the process of making data unreadable except to those with a key?
• What does the term 'malware' encompass?
• How does "two-factor authentication" enhance security?
• What does "Doxing" refer to?
• What does the term 'zero-day vulnerability' refer to?
• What is an example of social engineering?
• Which of the following relate to the preparation phase?
• What role does an intrusion detection system (IDS) play in cybersecurity?
• Which technology allows a large number of private IP addresses to be represented by a smaller number of public IP addresses?
• Which security model incorporates the concepts of confidentiality, integrity, and availability?
• Which of the following describes a situation in which a virus scanner identifies a file as a virus, when it isn't really a virus, and then tries to delete it?
• What is the role of firewalls in network security?
• In security terms, which of the following describes the principle of least privilege (POLP)?
• A user reports difficulty accessing certain external webpages. What might explain the situation if many SYNs have the same sequence number but different payloads?
• What does "social engineering" primarily rely on?
• Which definition correctly describes the IIS log parser tool?
• What is the main purpose of auditing in the field of cybersecurity?
• What leads to unauthorized data exposure?
• What function do firewalls serve in a network?
• How would you describe a "brute force" attack?
• What type of data is typically found in application server logs?
• When an instruction is issued stating that more than one person must perform a critical task, which principle is being followed?
• Which of the following is software that runs on an individual computer to protect it from viruses and malware?
• What best describes the IIS Log Parser tool?
• What is the purpose of a "security assessment"?
• Which is the correct definition of an antivirus program?
• In cybersecurity, what is meant by the term "endpoint"?
• Which of the following is a process that allows two computers to use the same cryptographic algorithm?
• Which features must a next-generation firewall include? (Choose two.)
• Which cryptographic key is contained in an X.509 certificate?
• What is a "patch management" system?
• What is the maximum size of an IPv4 header?
• Code injection can be categorized primarily as what type of threat?
• Which of the following is an advantage of NGFW over a firewall?
• Which of the following describes the advantages of application visibility and control?
• Which definition of Windows Registry is correct?
• What does the acronym 'VPN' stand for in networking?
• What is a trunk link used for?
• How should coordination mechanisms be designed in emergency plans?
• Which of the following describes the Zero Trust model?
• What does the acronym "CISO" stand for?
• What refers to a situation in which computers in an organization are redirected to false websites?
• What is the purpose of logging in cybersecurity?
• What is the purpose of a vulnerability assessment?
• Which network device is used to separate broadcast domains?
• Which of the following is the practice of specifying an index of approved software applications?
• Which of the following is an example of social engineering?
• Which type of attack can a traditional firewall protect a system against?
• What is the purpose of an intrusion detection system (IDS)?
• Which of the following describes malware in which rogue software code effectively holds a user's computer hostage until a fee is paid?
• Which definition correctly describes the Windows registry?
• What does "malvertising" refer to?
• Which of the following refers to improving data integrity by removing IPS events?
• Which of the following refers to data that email content filtering provides?
• What is the main goal of threat hunting?
• Which of the following is true if the IDS identifies activity as an attack and the activity is actually an attack?
• What does "TLS" stand for, and what is its purpose?
• What is a "security policy"?
• Which property of information security does encryption support?
• Which situation best indicates application-level allow listing?
• Explain the term "business continuity" in cybersecurity.
• What are "IoT devices," and why do they pose a security risk?
• What does the principle of least privilege refer to in an organization?
• Which of the following terms applies to evidence that supports existing theories derived from an original piece of evidence?
• What is the difference between a vulnerability and a threat?
• What defines a "spear phishing" attack?
• Which of the following best defines incident response?
• What are indicators of compromise (IOCs)?
• In cybersecurity, what does "phishing" typically involve?
• What kind of information is typically targeted in social engineering attacks?
• In NetFlow records, which flags indicate that an HTTP connection was stopped by a security appliance, such as a firewall, before it could be fully established?
• Which of the following best describes the purpose of a cybersecurity policy?
• What is the primary function of a Security Operations Center (SOC)?
• What type of attack involves an attacker intercepting communications between a client and a server?
• Which of the following represents a mechanism that allows users to protect their privacy against a common form of internet surveillance known as traffic analysis?
• Which of the following is a disadvantage of a Brute-force attack?
• Which of the following describes multi-factor authentication (MFA)?
• What does "threat intelligence" refer to?
• What is meant by "credential stuffing"?
• Which is a characteristic of symmetric encryption?
• Which of the following protocols are used for email?
• What is network segmentation?
• What is a potential effect of a buffer overflow attack?
• Which of the following describes the effect of encryption on data?
• Which of the following best describes a "phishing attack"?
• What does the principle of least privilege entail?
• Which of the following is an attack in which the attacker secretly relays and possibly alters communication between two parties?
• What is the primary function of access control lists (ACL)?
• What role do smartphones play in emergency preparedness?
• In information security, what does the CIA of data refer to?
• Which of the following is a common technique used in phishing attacks?
• What is a common use for honeypots in cybersecurity?
• What is the significance of having a Cybersecurity Framework?
• Which of the following terms is commonly associated with forensic analysis in cybersecurity?
• Which of the following terms refers to a case in which an IDS fails to identify an actual attack?
• As an SOC analyst, which traffic protocol should be investigated for a suspected On-Path attack?
• Which code injection technique launches malicious statements via input fields?
• Which method is commonly used to improve network security?
• What term describes a weakness in a system that could lead to compromise?
• Which acronym refers to a method used to analyze network traffic flow for security monitoring?
• What type of attack is characterized by overwhelming a service with traffic to render it unavailable?
• In cybersecurity, which term is used to describe a hidden backdoor allowing unauthorized access?
• Which of the following is a benefit of using a variety of communication tools during an emergency?
• Which of the following is an indication of a potential vulnerability?
• What is the role of an intrusion detection system (IDS)?
• Which of the following describes the run book automation (RBA)?
• Which of the following is not a characteristic of phishing attacks?
• Which of the following techniques is commonly used in social engineering attacks?
• What is the role of communication during the preparation phase of emergency management?
• What is a common indication that an indicator of compromise (IOC) exists?
• Define "endpoint security."
• Which of the following are Cisco cloud security solutions? (Choose two.)
• What is the purpose of a DMZ (Demilitarized Zone) in network security?
• What does the term "phishing" refer to in cybersecurity?
• Which of the following represents an access control model that enables users to perform activities based on the permissions assigned to their roles?
• Which of the following best describes a breach?
• What is the outcome of conducting a thorough audit in a cybersecurity context?
• While viewing packet capture data, you notice that an IP is sending and receiving traffic for multiple devices by modifying the IP header. Which of the following makes this behavior possible?
• What is the definition of the virtual address space for a Windows process?
• According to RFC 1035, which transport protocol is recommended for use with DNS queries?
• What is the primary goal of a security information and event management (SIEM) system?
• What is the definition of a fork in the Linux operating system?
• Which term refers to disassembling an object to understand how it works?
• Where is a host-based intrusion detection system located?
• Which of the following describes the practice of testing a system's security by simulating an attack?
• Which of the following is an IDS that monitors and analyzes data while logging malicious behavior?
• What does the acronym 'SSID' stand for in wireless networking?
• Which protocol maps IP network addresses to MAC hardware addresses?
• In computer security, what does PHI refer to?
• Which directory is commonly used in Linux systems to store log files?
• If a web server accepts input from the user and passes it to a Bash shell, to which attack method is it vulnerable?
• What does an effective security policy include regarding data management?
• What is the main function of a secure storage facility in emergency scenarios?
• What threat is posed by "Ransomware"?
• What type of attack can a traditional firewall help protect a system from?
• Which of the following is an attack in which multiple systems flood the bandwidth?
• What is the maximum size of an IPv4 header?
• What is the primary function of a firewall in network security?
• Which tool is commonly used by threat actors to exploit software vulnerabilities and spread malware?
• What is adjusting security according to threats from a hacktivist group known as in NIST SP800-61 r2?
• What is a common use case for a honeypot in network security?
• Which of the following is a key component for effective communication during an emergency?
• Define the term "data breach."
• Which of the following represents the use of a vulnerability in a system that can help hackers breach a system?
• Which of the following occurs when data exceeds its limits and overwrites memory locations?
• What is the primary role of a Security Information and Event Management (SIEM) tool?
• Which of the following describes SOAR?
• What does SIEM stand for, and what is its purpose?
• What is a significant risk associated with "credential stuffing"?
• Which type of attack utilizes multiple compromised systems to overwhelm a target system?
• Why is it important to have communication mechanisms that can function if one fails?
• What role does risk assessment play in cybersecurity?
• Define "red teaming" in the context of cybersecurity.
• What is the purpose of a security policy in an organization?
• What does "penetration testing" involve?
• What is the key objective of "penetration testing"?
• What common impact does a security breach typically have on an organization?
• What is meant by "encryption" in the context of data security?
• In the context of emergency management, what is a primary benefit of having multiple communication mechanisms?
• Which of the following is a hallmark of code injection attacks?
• Which of the following represents an access control model that enables users to perform activities based on the permissions assigned to their roles?
• What is meant by "vulnerability management"?
• What is considered an essential feature of security awareness training?
• Which term represents the chronological record of how evidence was collected, analyzed, preserved, and transferred?
• Which directory is commonly used in Linux systems to store log files, including syslog and Apache access logs?
• What is the function of multi-factor authentication (MFA)?
• Security awareness training aims to enhance what aspect of an organization?
• Which of the following describes the effect of encapsulation on data?
• Cisco pxGrid is used to enable the sharing of contextual-based information from which devices?
• Define "incident response plan."
• What is the role of encryption in cybersecurity?
• In cybersecurity, what does the term 'phishing' refer to?
• What is the primary objective of threat hunting?
• If a router has four interfaces and each interface is connected to four switches, how many broadcast domains are present on the router?
• In which of the following cases should an employee return his laptop to the organization?
• Which term describes unauthorized access to sensitive information by an individual?
• What are the five phases of the incident response lifecycle?
• Which of the following refers to data that web content filtering provides?
• Indicators of compromise (IOCs) are useful for?
• What potential consequences can arise from a security breach?
• Which protocol is used to encrypt data between the client and server in an SSL/TLS connection?
• Which of the following is a safe, isolated environment that replicates an end-user operating environment?
• Which type of attack occurs when an attacker successfully eavesdrops on a conversation between two IPS phones?
• What is a common tool used in penetration testing?
• Which of the following describes a situation where an attacker uses injected scripts to change website content?
• Which of the following describes the Threat Intelligence Platform (TIP)?
• Which of the following is the correct definition of threat actors in cybersecurity?
• Which of the following describes Defense in Depth (DiD)?
• Which of the following represents the use of a vulnerability to breach a system?
• Define the term "incident response."
• Which of the following hash algorithms is the weakest?
• What type of malware disguises itself as legitimate software?
• What type of attack primarily exploits human psychology?
• Which identifier is used to describe the application or process that submits a log message?
• What makes security monitoring for HTTPS traffic challenging?
• What does the concept of "zero trust" in cybersecurity entail?
• How can organizations best implement security awareness training?
• Which communication tool is recommended for emergency planning?
• What can be determined by analyzing logs of a traditional stateful firewall?
• Which of the following describes the benefit of using a load balancer?
• While analyzing the network, which type of attack could be indicated by aggressive traffic in the ICMP protocol?
• Which component is essential for maintaining the availability of information systems?