SkillTestPro | CyberOps Associate Host-based Analysis Questions

Cisco CyberOps Associate Practice Test 9

Cisco Certified CyberOps Associate

1 / 10

Which protocol header field might you inspect to detect ICMP flood attack?

HTTP method field in HTTP header

ICMP type and code fields in ICMP header

TCP sequence number only

DNS query only

SMTP port field

2 / 10

What is a false negative in intrusion detection systems?

When legitimate traffic is dropped incorrectly

When benign traffic triggers an alert

When an alert is generated for no malicious event

When system fails to start

When an actual attack is not detected

3 / 10

In a PCAP analysis, which fields are essential in the 5-tuple approach?

Username, password, session ID, timestamp, protocol, Source IP

Source IP, destination IP, source port, destination port, protocol

File hash, user agent, URL, IP, timestamp

CIDR block, encryption type, HTTP method, port, process name

MAC address, VLAN, DNS name, IP version, TTL

4 / 10

Which of these is considered a threat actor?

Exploit only

Vulnerability only

SIEM dashboard

Log file

A malicious individual or group performing attacks

5 / 10

What’s a primary challenge of data visibility when monitoring across hosts and cloud environments?

All data is always accessible by default

Agents are never required

Differences in logging formats, lack of centralized logs

Cloud environments disable encryption always

Hosts have no logs at all

6 / 10

Which kind of certificate component indicates which asymmetric algorithm is used and which hash for signing?

X.509 version only

Cipher suite

Key exchange method only

Certificate subject name

Serial number

7 / 10

What does “sliding window anomaly detection” aim to do in security analytics?

Inspect all old logs manually only

Only trigger alerts based on signatures

Continuously compare recent behavior to baseline windows

Ignore statistical deviations

Use antivirus signatures exclusively

8 / 10

In the CVSS framework, what does “attack vector” refer to?

The time required to exploit a vulnerability

Whether user interaction is required

Type of data exposed

Potential financial impact

The environment where an attacker needs to be to exploit

9 / 10

Which technique is part of threat hunting?

Accepting alerts as they come and doing nothing else

Only reviewing signature-based alerts

Disabling antivirus logs

Proactively IoAs or anomalous behavior that hasn't triggered alerts yet

Ignoring endpoint logs

10 / 10

In a firewall context, what is the difference between stateful firewall and packet filtering?

Packet filtering tracks session state; stateful does notv

Stateful firewall maintains information about active connections; packet filtering treats each packet independently

Packet filtering is only for wireless networks

Stateful firewalls cannot block ports

Packet filtering inspects payloads deeply always

Your score is

The average score is 90%