Cisco CyberOps Associate Practice Exam

These questions are part of the practice quiz. Start practicing

• What is the role of encryption in cybersecurity?
• Which definition correctly describes the IIS log parser tool?
• What is essential for backup in an emergency situation?
• Which of the following is the case when an IDS does not identify an actual attack?
• Explain the term "business continuity" in cybersecurity.
• What potential consequences can arise from a security breach?
• While analyzing the network, which type of attack could be indicated by aggressive traffic in the ICMP protocol?
• If a web server accepts input from the user and passes it to a Bash shell, to which attack method is it vulnerable?
• What does the term "malware" encompass?
• Which of the following represents a mechanism that allows users to protect their privacy against a common form of internet surveillance known as traffic analysis?
• Which of the following hash algorithms is the weakest?
• What does the term "phishing" refer to in cybersecurity?
• Which of the following is a safe, isolated environment that replicates an end-user operating environment?
• Which of the following refers to data that web content filtering provides?
• What best describes the IIS Log Parser tool?
• What role does an intrusion detection system (IDS) play in cybersecurity?
• What does the acronym 'VPN' stand for in networking?
• What is the primary objective of threat hunting?
• Which of the following is a code injection technique that launches malicious statements via input fields?
• When an instruction is issued stating that more than one person must perform a critical task, which principle is being followed?
• Which of the following allows you to create a secure connection to another network over the internet?
• John sent an HTTP GET request to get a file from the web server. Which event artifact will identify the request?
• Which of the following describes a situation in which a virus scanner identifies a file as a virus, when it isn't really a virus, and then tries to delete it?
• What is the significance of having a Cybersecurity Framework?
• Which of the following is the practice of specifying an index of approved software applications?
• What type of data is typically found in application server logs?
• In information security, what does the CIA of data refer to?
• Code injection can be categorized primarily as what type of threat?
• What is the role of an intrusion detection system (IDS)?
• What is the primary role of a Security Information and Event Management (SIEM) tool?
• Which of the following best describes a breach?
• Which of the following is a disadvantage of a Brute-force attack?
• What does the term 'zero-day vulnerability' refer to?
• In cybersecurity, which term is used to describe a hidden backdoor allowing unauthorized access?
• Which of the following is an attack that exploits a vulnerable application and executes commands on a remote host?
• What type of malware disguises itself as legitimate software?
• Which identifier is used to describe the application or process that submits a log message?
• Which of the following describes the benefit of using a load balancer?
• What is a "patch management" system?
• What type of attack involves overwhelming a server with too many requests?
• Which directory is commonly used in Linux systems to store log files, including syslog and Apache access logs?
• In computer security, what does PHI refer to?
• What is an example of social engineering?
• Which term refers to disassembling an object to understand how it works?
• Which of the following metrics can measure the effectiveness of a runbook?
• Which of the following describes the run book automation (RBA)?
• Which of the following is an advantage of NGFW over a firewall?
• Which of the following is true if the IDS identifies activity as an attack and the activity is actually an attack?
• Which technology allows a large number of private IP addresses to be represented by a smaller number of public IP addresses?
• In cybersecurity, what is meant by the term "endpoint"?
• Which definition of Windows Registry is correct?
• What is the role of communication during the preparation phase of emergency management?
• What is a common use for honeypots in cybersecurity?
• What is the key objective of "penetration testing"?
• Define the term "incident response."
• What is the maximum size of an IPv4 header?
• Which property of information security does encryption support?
• Which of the following is not related to SIEM system activity?
• Which of the following describes the advantages of application visibility and control?
• What type of attack is characterized by overwhelming a service with traffic to render it unavailable?
• Which of the following describes malware in which rogue software code effectively holds a user's computer hostage until a fee is paid?
• What is a common indication that an indicator of compromise (IOC) exists?
• What are "IoT devices," and why do they pose a security risk?
• Which of the following describes SOAR?
• Which of the following is software that runs on an individual computer to protect it from viruses and malware?
• Which network device is used to separate broadcast domains?
• How can organizations best implement security awareness training?
• Which of the following describes Defense in Depth (DiD)?
• Which property of information security does encryption support?
• Where is a host-based intrusion detection system located?
• What is the definition of code injection?
• Which type of attack occurs when a botnet is used to transmit requests from an NTP server to overwhelm the target?
• For which of the following access control models is the main purpose preserving the confidentiality of data?
• What type of attack involves an attacker intercepting communications between a client and a server?
• What leads to unauthorized data exposure?
• Which of the following occurs when data exceeds its limits and overwrites memory locations?
• Which of the following terms represent types of cross-site scripting attacks? (Choose two.)
• At which OSI layer does a router typically operate?
• What is considered an essential feature of security awareness training?
• Which definition correctly describes the Windows registry?
• Which of the following relate to the preparation phase?
• Which of the following terms applies to evidence that supports existing theories derived from an original piece of evidence?
• Which of the following uses a set of rules that filter network traffic and can be configured on network devices with packet filtering capabilities?
• What is the main purpose of auditing in the field of cybersecurity?
• What are indicators of compromise (IOCs)?
• Which of the following best describes a "phishing attack"?
• What does the concept of "zero trust" in cybersecurity entail?
• Which of the following techniques is commonly used in social engineering attacks?
• Which security condition does an attacker exploit when sending a flood of packets to a victim to disrupt services?
• Which of the following terms is commonly associated with forensic analysis in cybersecurity?
• What is the primary goal of a security information and event management (SIEM) system?
• What function do firewalls serve in a network?
• Which protocol is used to encrypt data between the client and server in an SSL/TLS connection?
• What does "Doxing" refer to?
• Which tool is commonly used by threat actors to exploit software vulnerabilities and spread malware?
• Which type of attack utilizes multiple compromised systems to overwhelm a target system?
• In NetFlow records, which flags indicate that an HTTP connection was stopped by a security appliance, such as a firewall, before it could be fully established?
• Which of the following describes the practice of testing a system's security by simulating an attack?
• What type of attack can a traditional firewall help protect a system from?
• What does "TLS" stand for, and what is its purpose?
• Which of the following is a benefit of using a variety of communication tools during an emergency?
• Which of the following is not a characteristic of phishing attacks?
• Which type of malware is specifically designed to extort money from victims?
• What does the principle of least privilege entail?
• While viewing packet capture data, you notice that an IP is sending and receiving traffic for multiple devices by modifying the IP header. Which of the following makes this behavior possible?
• What can be determined by analyzing logs of a traditional stateful firewall?
• What is the primary function of a Security Operations Center (SOC)?
• What does the principle of least privilege refer to in an organization?
• Which of the following is a common technique used in phishing attacks?
• What is a trunk link used for?
• Which of the following protocols are used for email?
• What is a potential effect of a buffer overflow attack?
• Define "red teaming" in the context of cybersecurity.
• What role do smartphones play in emergency preparedness?
• What does the acronym 'SSID' stand for in wireless networking?
• Which acronym refers to a method used to analyze network traffic flow for security monitoring?
• What defines a "spear phishing" attack?
• Which of the following is an IDS that monitors and analyzes data while logging malicious behavior?
• What is the difference between a vulnerability and a threat?
• Which method is commonly used to improve network security?
• Which security monitoring data type requires the most storage space?
• What does the acronym "CISO" stand for?
• What is a common use case for a honeypot in network security?
• What does "threat intelligence" refer to?
• Indicators of compromise (IOCs) are useful for?
• Which of the following is a hallmark of code injection attacks?
• Which term describes the modification of a message during transmission without detection?
• What is the primary focus of incident response in cybersecurity?
• Which of the following describes the Zero Trust model?
• What is a zero-day vulnerability?
• Which of the following terms refers to a case in which an IDS fails to identify an actual attack?
• Which of the following are Cisco cloud security solutions? (Choose two.)
• Which of the following does NetFlow use to determine if traffic belongs to the same flow? (Select three.)
• What is the purpose of a "security assessment"?
• What does SIEM stand for, and what is its purpose?
• What is network segmentation?
• Which type of attack can a traditional firewall protect a system against?
• What refers to a situation in which computers in an organization are redirected to false websites?
• How would you describe a "brute force" attack?
• What are the five phases of the incident response lifecycle?
• Define "endpoint security."
• Which is a characteristic of symmetric encryption?
• Which of the following refers to disassembling an object to see how it works and to study its structure and behavior?
• Which of the following answers best describes the purpose of the preparation phase?
• What does an effective security policy include regarding data management?
• Cisco pxGrid is used to enable the sharing of contextual-based information from which devices?
• Which of the following describes the effect of encryption on data?
• Define "incident response plan."
• What term describes the process of making data unreadable except to those with a key?
• What type of attack primarily exploits human psychology?
• What is a primary purpose of a firewall in a network security architecture?
• Which term represents the chronological record of how evidence was collected, analyzed, preserved, and transferred?
• What role does risk assessment play in cybersecurity?
• Which communication tool is recommended for emergency planning?
• What is the definition of the virtual address space for a Windows process?
• What is the outcome of conducting a thorough audit in a cybersecurity context?
• If a router has four interfaces and each interface is connected to four switches, how many broadcast domains are present on the router?
• Which of the following best describes the purpose of a cybersecurity policy?
• What constitutes a successful brute force attack?
• Which is the correct definition of an antivirus program?
• Which of the following is a technique used by cybercrooks to trick users into revealing confidential information?
• Which features must a next-generation firewall include? (Choose two.)
• Which of the following is most commonly used in PPTP, L2TP/IPsec, SSTP, and OpenVPN?
• What is a significant risk associated with "credential stuffing"?
• What is the function of multi-factor authentication (MFA)?
• Define "data loss prevention" (DLP).
• What is the definition of a fork in the Linux operating system?
• What makes security monitoring for HTTPS traffic challenging?
• What are the advantages of full-duplex transmission mode, as opposed to half-duplex mode? (Select all correct answers.)
• How should coordination mechanisms be designed in emergency plans?
• What is meant by "vulnerability management"?
• Which directory is commonly used in Linux systems to store log files?
• Security awareness training aims to enhance what aspect of an organization?
• Which of the following is a key component for effective communication during an emergency?
• Explain what "sandboxing" means in cybersecurity.
• What is a "security policy"?
• What is the maximum size of an IPv4 header?
• Which of the following is an indication of a potential vulnerability?
• What is the purpose of a security policy in an organization?
• What is adjusting security according to threats from a hacktivist group known as in NIST SP800-61 r2?
• Which of the following represents an access control model that enables users to perform activities based on the permissions assigned to their roles?
• Which component is essential for maintaining the availability of information systems?
• What is the purpose of logging in cybersecurity?
• Which cryptographic key is used by an X.509 certificate?
• What is the primary function of a firewall in network security?
• Which of the following is NOT a characteristic of a secure storage facility in emergency planning?
• What does "social engineering" primarily rely on?
• Which of the following describes the effect of encapsulation on data?
• Which of the following is an attack in which the attacker secretly relays and possibly alters communication between two parties?
• What is meant by "encryption" in the context of data security?
• Which cryptographic key is contained in an X.509 certificate?
• Which of the following represents the use of a vulnerability in a system that can help hackers breach a system?
• Which of the following best defines incident response?
• In the context of emergency management, what is a primary benefit of having multiple communication mechanisms?
• Which statement about digitally signing a document is true?
• What is "DNS Spoofing"?
• What is meant by "credential stuffing"?
• By introducing malicious code into a program, what is the primary goal of a code injection attack?
• Which code injection technique launches malicious statements via input fields?
• What is a common tool used in penetration testing?
• Which term describes unauthorized access to sensitive information by an individual?
• In cybersecurity, what does "phishing" typically involve?
• What is the primary function of access control lists (ACL)?
• Which of the following describes multi-factor authentication (MFA)?
• Which method is commonly used for securing wireless networks?
• Which of the following describes a situation where an attacker uses injected scripts to change website content?
• What is the purpose of a vulnerability assessment?
• Which of the following is an ideal characteristic of communication in emergencies?
• Which of the following VPN protocols is known for its strong security and encryption capabilities?
• In which of the following cases should an employee return his laptop to the organization?
• What is the purpose of a DMZ (Demilitarized Zone) in network security?
• What should be avoided when developing emergency communication strategies?
• Which of the following is an example of social engineering?
• What threat is posed by "Ransomware"?
• Which of the following is the correct definition of tcpdump?
• How does "two-factor authentication" enhance security?
• What does the term 'malware' encompass?
• According to RFC 1035, which transport protocol is recommended for use with DNS queries?
• Define the term "data breach."
• In cybersecurity, what does the term 'phishing' refer to?
• What does "malvertising" refer to?
• Which of the following describes the Threat Intelligence Platform (TIP)?
• What does it mean when access to a resource is granted with discretionary control?
• What is a primary benefit of conducting security awareness training?
• Which of the following describes a computer program designed to infiltrate and damage a computer without user interaction?
• What is the main goal of threat hunting?
• What is the role of firewalls in network security?
• Which security model incorporates the concepts of confidentiality, integrity, and availability?
• What term describes a weakness in a system that could lead to compromise?
• Which of the following is a process that allows two computers to use the same cryptographic algorithm?
• What is an advantage of application visibility and control?
• Which of the following is an attack in which multiple systems flood the bandwidth?
• Why is it important to have communication mechanisms that can function if one fails?
• Which type of attack is characterized by overwhelming a system with traffic, rendering it unavailable?
• Which of the following represents an access control model that enables users to perform activities based on the permissions assigned to their roles?
• Which of the following represents the use of a vulnerability to breach a system?
• Which security model restricts access based on the owner's policy?
• Which protocol maps IP network addresses to MAC hardware addresses?
• As an SOC analyst, which traffic protocol should be investigated for a suspected On-Path attack?
• What is the purpose of an intrusion detection system (IDS)?
• Which of the following is the correct definition of threat actors in cybersecurity?
• What does "penetration testing" involve?
• Which type of attack occurs when an attacker successfully eavesdrops on a conversation between two IPS phones?
• What common impact does a security breach typically have on an organization?
• Which of the following refers to improving data integrity by removing IPS events?
• What does CIA stand for in the context of information security?
• A user reports difficulty accessing certain external webpages. What might explain the situation if many SYNs have the same sequence number but different payloads?
• Which of the following refers to data that email content filtering provides?
• Which situation best indicates application-level allow listing?
• What is the main function of a secure storage facility in emergency scenarios?
• In security terms, which of the following describes the principle of least privilege (POLP)?
• What kind of information is typically targeted in social engineering attacks?