SkillTestPro | CyberOps Associate Security Monitoring Questions

Cisco CyberOps Associate Practice Test 8

Cisco Certified CyberOps Associate

1 / 10

What is a main advantage of having full packet capture in network intrusion analysis?

Lower storage requirements than flow logs

Ability to reconstruct sessions and inspect payloads

Easier compliance than any other logging

No impact on network performance

Always available on cloud environments by default

2 / 10

Which regular expression might help detect suspicious HTTP requests with directory traversal attempts?

^GET /images/.*

^POST /login

../

/index.html$

User-Agent: .*

3 / 10

What is the purpose of a host-based intrusion detection system (HIDS)?

To replace network firewalls

To encrypt data at rest only

To generate phishing campaigns

To route network traffic

To monitor events on the host (file changes, system logs)

4 / 10

When analyzing host-based logs, which type of evidence is considered volatile and should be collected first?

Disk files only

Registry entries

Running process list

Archived backups

User documents

5 / 10

Which of the following is a method attackers use to obfuscate or hide malicious activity in traffic?

Using certificate pinning

Tunneling or encryption or using proxies

Disabling TLS entirely

Using only HTTP on standard ports

Removing SSL/TLS certificates

6 / 10

In security monitoring, what kind of data does NetFlow provide?

Full packet payloads

Encrypted log files only

Host registry entries

Summary of flows

File hashes

7 / 10

Which access control model grants access based on attributes of both user and resource (e.g., environment, time, role)?

DAC

MAC

RBAC

ABAC

RBAC variant

8 / 10

What does “runbook automation (RBA)” refer to in a security operations environment?

Use of automated scripts to execute tasks

Manually writing incident reports only

Randomly selecting security measures

Requiring human approval for everything

Only using runbooks in legal contexts

9 / 10

What is the main difference between agent-based and agentless protection on endpoints?

Agentless requires hardware installation

Agent-based uses software; agentless relies on external monitoring tools

Agentless provides deeper control over files

Agent-based cannot monitor real-time events

Agentless is always more secure

10 / 10

In the CIA triad, which element is primarily concerned with ensuring that data can be accessed when needed?

Confidentiality

Integrity

Authentication

Availability

Authorization

Your score is

The average score is 95%