Cisco CyberOps Associate Practice Exam

These questions are part of the practice quiz. Start practicing

• Which of the following is an advantage of NGFW over a firewall?
• What is the key objective of "penetration testing"?
• Which identifier is used to describe the application or process that submits a log message?
• What role do smartphones play in emergency preparedness?
• Which type of malware is specifically designed to extort money from victims?
• Which of the following describes a situation where an attacker uses injected scripts to change website content?
• Which protocol maps IP network addresses to MAC hardware addresses?
• What are the advantages of full-duplex transmission mode, as opposed to half-duplex mode? (Select all correct answers.)
• What does "TLS" stand for, and what is its purpose?
• What is the primary goal of a security information and event management (SIEM) system?
• Which security model restricts access based on the owner's policy?
• What threat is posed by "Ransomware"?
• Define "incident response plan."
• What is essential for backup in an emergency situation?
• What does "Doxing" refer to?
• Which term describes unauthorized access to sensitive information by an individual?
• What role does risk assessment play in cybersecurity?
• Which of the following is software that runs on an individual computer to protect it from viruses and malware?
• In the context of emergency management, what is a primary benefit of having multiple communication mechanisms?
• What is an advantage of application visibility and control?
• What is the main function of a secure storage facility in emergency scenarios?
• What is a common use for honeypots in cybersecurity?
• Which of the following terms applies to evidence that supports existing theories derived from an original piece of evidence?
• Which of the following represents an access control model that enables users to perform activities based on the permissions assigned to their roles?
• Which of the following is an IDS that monitors and analyzes data while logging malicious behavior?
• While viewing packet capture data, you notice that an IP is sending and receiving traffic for multiple devices by modifying the IP header. Which of the following makes this behavior possible?
• What is the definition of a fork in the Linux operating system?
• What type of malware disguises itself as legitimate software?
• What is the main purpose of auditing in the field of cybersecurity?
• Which directory is commonly used in Linux systems to store log files, including syslog and Apache access logs?
• How can organizations best implement security awareness training?
• Which code injection technique launches malicious statements via input fields?
• In information security, what does the CIA of data refer to?
• What is the outcome of conducting a thorough audit in a cybersecurity context?
• What does "social engineering" primarily rely on?
• If a web server accepts input from the user and passes it to a Bash shell, to which attack method is it vulnerable?
• As an SOC analyst, which traffic protocol should be investigated for a suspected On-Path attack?
• Which of the following is an example of social engineering?
• When an instruction is issued stating that more than one person must perform a critical task, which principle is being followed?
• How does "two-factor authentication" enhance security?
• What is the primary function of a firewall in network security?
• What is the purpose of an intrusion detection system (IDS)?
• What type of attack can a traditional firewall help protect a system from?
• Which of the following describes multi-factor authentication (MFA)?
• Which of the following describes the benefit of using a load balancer?
• What does the term "phishing" refer to in cybersecurity?
• Which of the following is a safe, isolated environment that replicates an end-user operating environment?
• Indicators of compromise (IOCs) are useful for?
• Which method is commonly used to improve network security?
• What is the role of firewalls in network security?
• What does the acronym 'SSID' stand for in wireless networking?
• What is the primary function of a Security Operations Center (SOC)?
• What is the difference between a vulnerability and a threat?
• What defines a "spear phishing" attack?
• Which of the following is not related to SIEM system activity?
• Which of the following refers to data that email content filtering provides?
• What is the main goal of threat hunting?
• Which of the following is a common technique used in phishing attacks?
• Which is the correct definition of an antivirus program?
• What term describes the process of making data unreadable except to those with a key?
• Which of the following best describes a breach?
• Which technology allows a large number of private IP addresses to be represented by a smaller number of public IP addresses?
• Security awareness training aims to enhance what aspect of an organization?
• What does the term 'malware' encompass?
• What does an effective security policy include regarding data management?
• Which of the following is the case when an IDS does not identify an actual attack?
• Which of the following describes the effect of encryption on data?
• What is the primary objective of threat hunting?
• What are indicators of compromise (IOCs)?
• Which cryptographic key is used by an X.509 certificate?
• Which of the following describes the practice of testing a system's security by simulating an attack?
• Which cryptographic key is contained in an X.509 certificate?
• Code injection can be categorized primarily as what type of threat?
• Which of the following is a hallmark of code injection attacks?
• What function do firewalls serve in a network?
• Which of the following uses a set of rules that filter network traffic and can be configured on network devices with packet filtering capabilities?
• Which of the following describes a computer program designed to infiltrate and damage a computer without user interaction?
• Which of the following describes malware in which rogue software code effectively holds a user's computer hostage until a fee is paid?
• What is a trunk link used for?
• In security terms, which of the following describes the principle of least privilege (POLP)?
• Which directory is commonly used in Linux systems to store log files?
• What is meant by "credential stuffing"?
• What is the primary role of a Security Information and Event Management (SIEM) tool?
• Define "data loss prevention" (DLP).
• Why is it important to have communication mechanisms that can function if one fails?
• Which of the following is true if the IDS identifies activity as an attack and the activity is actually an attack?
• Which term represents the chronological record of how evidence was collected, analyzed, preserved, and transferred?
• What type of attack is characterized by overwhelming a service with traffic to render it unavailable?
• Which type of attack occurs when a botnet is used to transmit requests from an NTP server to overwhelm the target?
• What type of attack primarily exploits human psychology?
• What makes security monitoring for HTTPS traffic challenging?
• Which of the following is not a characteristic of phishing attacks?
• Which component is essential for maintaining the availability of information systems?
• What is the significance of having a Cybersecurity Framework?
• What is network segmentation?
• Which of the following is a process that allows two computers to use the same cryptographic algorithm?
• What does "malvertising" refer to?
• What does the acronym "CISO" stand for?
• Which of the following is an ideal characteristic of communication in emergencies?
• Which definition of Windows Registry is correct?
• John sent an HTTP GET request to get a file from the web server. Which event artifact will identify the request?
• Which term describes the modification of a message during transmission without detection?
• Which of the following terms represent types of cross-site scripting attacks? (Choose two.)
• Which of the following describes the advantages of application visibility and control?
• What are the five phases of the incident response lifecycle?
• Which definition correctly describes the IIS log parser tool?
• What is the role of an intrusion detection system (IDS)?
• Which of the following describes the Threat Intelligence Platform (TIP)?
• What should be avoided when developing emergency communication strategies?
• What is the role of encryption in cybersecurity?
• What does the term "malware" encompass?
• What is the purpose of a "security assessment"?
• Which type of attack utilizes multiple compromised systems to overwhelm a target system?
• Which method is commonly used for securing wireless networks?
• Define "red teaming" in the context of cybersecurity.
• Where is a host-based intrusion detection system located?
• What type of attack involves an attacker intercepting communications between a client and a server?
• Which of the following is the correct definition of threat actors in cybersecurity?
• Which security condition does an attacker exploit when sending a flood of packets to a victim to disrupt services?
• A user reports difficulty accessing certain external webpages. What might explain the situation if many SYNs have the same sequence number but different payloads?
• Which features must a next-generation firewall include? (Choose two.)
• What does "threat intelligence" refer to?
• Which of the following does NetFlow use to determine if traffic belongs to the same flow? (Select three.)
• Which of the following allows you to create a secure connection to another network over the internet?
• What is meant by "encryption" in the context of data security?
• What is an example of social engineering?
• What does SIEM stand for, and what is its purpose?
• In computer security, what does PHI refer to?
• What best describes the IIS Log Parser tool?
• What does it mean when access to a resource is granted with discretionary control?
• What role does an intrusion detection system (IDS) play in cybersecurity?
• Which type of attack is characterized by overwhelming a system with traffic, rendering it unavailable?
• Define "endpoint security."
• In which of the following cases should an employee return his laptop to the organization?
• What is a significant risk associated with "credential stuffing"?
• Which of the following is most commonly used in PPTP, L2TP/IPsec, SSTP, and OpenVPN?
• Which of the following refers to disassembling an object to see how it works and to study its structure and behavior?
• Which of the following describes Defense in Depth (DiD)?
• What does "penetration testing" involve?
• Which of the following is a key component for effective communication during an emergency?
• What is the purpose of a security policy in an organization?
• What does the principle of least privilege refer to in an organization?
• Which is a characteristic of symmetric encryption?
• What kind of information is typically targeted in social engineering attacks?
• Which of the following describes the effect of encapsulation on data?
• What type of attack involves overwhelming a server with too many requests?
• Which of the following terms is commonly associated with forensic analysis in cybersecurity?
• What is a primary benefit of conducting security awareness training?
• What is a common indication that an indicator of compromise (IOC) exists?
• Which of the following terms refers to a case in which an IDS fails to identify an actual attack?
• What is the primary focus of incident response in cybersecurity?
• What is a primary purpose of a firewall in a network security architecture?
• What is meant by "vulnerability management"?
• What is the function of multi-factor authentication (MFA)?
• In cybersecurity, which term is used to describe a hidden backdoor allowing unauthorized access?
• What is the maximum size of an IPv4 header?
• Which of the following describes the run book automation (RBA)?
• According to RFC 1035, which transport protocol is recommended for use with DNS queries?
• What is considered an essential feature of security awareness training?
• Which of the following is a code injection technique that launches malicious statements via input fields?
• What common impact does a security breach typically have on an organization?
• Which statement about digitally signing a document is true?
• In NetFlow records, which flags indicate that an HTTP connection was stopped by a security appliance, such as a firewall, before it could be fully established?
• Define the term "data breach."
• Which situation best indicates application-level allow listing?
• What is the purpose of a vulnerability assessment?
• Which of the following represents a mechanism that allows users to protect their privacy against a common form of internet surveillance known as traffic analysis?
• Which of the following is a disadvantage of a Brute-force attack?
• By introducing malicious code into a program, what is the primary goal of a code injection attack?
• Explain what "sandboxing" means in cybersecurity.
• Which property of information security does encryption support?
• How would you describe a "brute force" attack?
• Which of the following relate to the preparation phase?
• In cybersecurity, what does the term 'phishing' refer to?
• Which of the following is the correct definition of tcpdump?
• Which of the following are Cisco cloud security solutions? (Choose two.)
• What is adjusting security according to threats from a hacktivist group known as in NIST SP800-61 r2?
• Which of the following protocols are used for email?
• Which acronym refers to a method used to analyze network traffic flow for security monitoring?
• What is the role of communication during the preparation phase of emergency management?
• Explain the term "business continuity" in cybersecurity.
• What is the primary function of access control lists (ACL)?
• What is the maximum size of an IPv4 header?
• Which of the following answers best describes the purpose of the preparation phase?
• Which communication tool is recommended for emergency planning?
• In cybersecurity, what is meant by the term "endpoint"?
• Which of the following is the practice of specifying an index of approved software applications?
• What constitutes a successful brute force attack?
• What does CIA stand for in the context of information security?
• Which of the following describes SOAR?
• Which of the following is an attack in which multiple systems flood the bandwidth?
• Which of the following is an attack in which the attacker secretly relays and possibly alters communication between two parties?
• What does the principle of least privilege entail?
• While analyzing the network, which type of attack could be indicated by aggressive traffic in the ICMP protocol?
• What is a "security policy"?
• What is a potential effect of a buffer overflow attack?
• Which definition correctly describes the Windows registry?
• What term describes a weakness in a system that could lead to compromise?
• Which of the following represents an access control model that enables users to perform activities based on the permissions assigned to their roles?
• Which of the following best defines incident response?
• What is "DNS Spoofing"?
• Which of the following describes the Zero Trust model?
• Which of the following VPN protocols is known for its strong security and encryption capabilities?
• What are "IoT devices," and why do they pose a security risk?
• Which of the following best describes the purpose of a cybersecurity policy?
• Which protocol is used to encrypt data between the client and server in an SSL/TLS connection?
• Which network device is used to separate broadcast domains?
• Which type of attack occurs when an attacker successfully eavesdrops on a conversation between two IPS phones?
• In cybersecurity, what does "phishing" typically involve?
• What refers to a situation in which computers in an organization are redirected to false websites?
• Which of the following is a technique used by cybercrooks to trick users into revealing confidential information?
• What does the term 'zero-day vulnerability' refer to?
• Which tool is commonly used by threat actors to exploit software vulnerabilities and spread malware?
• Which of the following occurs when data exceeds its limits and overwrites memory locations?
• At which OSI layer does a router typically operate?
• How should coordination mechanisms be designed in emergency plans?
• Which of the following describes a situation in which a virus scanner identifies a file as a virus, when it isn't really a virus, and then tries to delete it?
• If a router has four interfaces and each interface is connected to four switches, how many broadcast domains are present on the router?
• Which type of attack can a traditional firewall protect a system against?
• Which term refers to disassembling an object to understand how it works?
• Which of the following is a benefit of using a variety of communication tools during an emergency?
• Which of the following techniques is commonly used in social engineering attacks?
• What is a common use case for a honeypot in network security?
• Which of the following metrics can measure the effectiveness of a runbook?
• What is a zero-day vulnerability?
• Which of the following hash algorithms is the weakest?
• What potential consequences can arise from a security breach?
• What is a "patch management" system?
• What is a common tool used in penetration testing?
• Which security model incorporates the concepts of confidentiality, integrity, and availability?
• What can be determined by analyzing logs of a traditional stateful firewall?
• Which property of information security does encryption support?
• Which of the following best describes a "phishing attack"?
• What does the acronym 'VPN' stand for in networking?
• What does the concept of "zero trust" in cybersecurity entail?
• Cisco pxGrid is used to enable the sharing of contextual-based information from which devices?
• What type of data is typically found in application server logs?
• What is the purpose of a DMZ (Demilitarized Zone) in network security?
• Which of the following is an indication of a potential vulnerability?
• Which of the following represents the use of a vulnerability to breach a system?
• For which of the following access control models is the main purpose preserving the confidentiality of data?
• Which of the following refers to data that web content filtering provides?
• What is the purpose of logging in cybersecurity?
• What leads to unauthorized data exposure?
• Define the term "incident response."
• What is the definition of the virtual address space for a Windows process?
• Which of the following is NOT a characteristic of a secure storage facility in emergency planning?
• Which of the following is an attack that exploits a vulnerable application and executes commands on a remote host?
• Which of the following represents the use of a vulnerability in a system that can help hackers breach a system?
• Which security monitoring data type requires the most storage space?
• What is the definition of code injection?