CyberOps Associate Network Intrusion Analysis Questions

Cisco CyberOps Associate Practice Test 10

Cisco Certified CyberOps Associate

1 / 10

A company uses containers in its environment. Which of these security challenges is most specific to containers compared to traditional VMs or bare metal?

2 / 10

Suppose you examine a PCAP and see a TCP stream that includes an HTTP POST to “/upload” with a large file transfer, followed within minutes by FTP connections to an external server. What might this pattern suggest?

3 / 10

What is a behavior that would indicate evasion when monitoring encrypted traffic?

4 / 10

Which access control model would allow an organization to enforce rules like “employees can access financial data only during business hours” effectively?

5 / 10

A SOC is investigating an incident. They have memory dump, disk image, and log files. Which of these evidences is considered corroborative evidence?

6 / 10

During monitoring of network flow data, you see many short flows (just a few packets) from internal hosts to external IPs on unusual ports, followed by no return traffic. What kind of activity might this be?

7 / 10

A log source shows DNS queries from internal IPs to domains like “abcd1234.randomstring.com” which don’t resolve normally. What kind of threat does this pattern most likely suggest?

8 / 10

When evaluating the risk associated with a vulnerability, which CVSS metric reflects how much user interaction is needed for an exploit?

9 / 10

You’re using a SIEM that flags a high number of TLS certificate handshake failures across multiple endpoints. Which of these interpretations is most plausible?

10 / 10

A SOC analyst sees that user login events from a server are being logged in two different formats: one as “sshd: Accepted password” and another as “sshd: Accepted publickey”. What could this indicate in the context of host-based analysis?

Your score is

The average score is 70%

0%