Cisco 200-201 Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CBROPS) Exam Practice Test

Port scanning is a technique that an attacker uses to discover which network ports are open, closed, or filtered on a target device. By sending packets to different ports and observing the responses, an attacker can identify the services and applications running on the device, as well as potential vulnerabilities that can be exploited. Port scanning is a common reconnaissance activity that precedes an attack. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 2-6; 200-201 CBROPS - Cisco, exam topic 1.1.a

Agent-based monitoring: With agent-based monitoring, software agents are installed on the monitored systems or devices. These agents collect data locally, perform filtering or preprocessing of the data, and then transmit the relevant or valuable information to the monitoring system. Agent-based monitoring allows for local processing and filtering, which can reduce network utilization by only transmitting essential data. Agentless monitoring: Agentless monitoring, on the other hand, does not require software agents to be installed on the monitored systems or devices. Instead, it relies on leveraging existing protocols and interfaces, such as APIs (Application Programming Interfaces) or SNMP (Simple Network Management Protocol), to remotely access and retrieve monitoring data from the target systems. Agentless monitoring generally involves higher network utilization as the monitoring system needs to gather data from remote systems over the network.

 The category of the Cyber Kill Chain model that this event belongs to is weaponization. This stage occurs after reconnaissance has taken place and the attacker has discovered all necessary information about potential targets, such as vulnerabilities. In the weaponization stage, the attacker’s preparatory work culminates in the creation of malware to be used against an identified target, which in this case is a specific worm tailored to exploit a software flaw and extract saved passwords. References: The Cyber Kill Chain framework, developed by Lockheed Martin, explains the weaponization stage as the process where attackers create or modify cyber weapons based on the intelligence gathered during reconnaissance

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network flow. It provides valuable data about the network sessions occurring within the network, such as source and destination IP addresses, port numbers, and protocols used. This session data is useful for understanding traffic patterns, volume, and usage.

References: Cisco’s training and certification materials on NetFlow would discuss how it is used to obtain session data for network analysis.

A load balancer is the correct technology to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier (URI), and SSL session ID attributes. Load balancers can inspect incoming traffic and make routing decisions to distribute the traffic across multiple servers based on various attributes, including the ones mentioned, to ensure optimal resource use and efficient traffic management12.

References :=

• Cisco Unified Border Element Configuration Guide1.
• URI based outbound Dial-peer configuration on CUBE - Cisco Community

A buffer overflow attack occurs when more data is written to a buffer than it is designed to hold. This excess data can overwrite adjacent memory locations, leading to the execution of malicious code or crashing the system. Buffer overflows are a common vulnerability that attackers exploit to gain unauthorized access to systems.

References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

The Stealthwatch dashboard indicates that there is an active policy violation associated with host 10.201.3.149. Stealthwatch is a security analytics tool that uses network telemetry to detect and respond to threats. In this case, the dashboard has flagged a policy violation, which means that activity from this host has been detected that goes against the defined security policies, potentially indicating a security threat or unauthorized access.

References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) training material, which includes information on how to use tools like Stealthwatch to monitor network traffic and identify potential security threats1.

After a breach has been discovered and the immediate threat has been addressed by identifying and removing the threat’s access, the next step according to the NIST SP 800-61 Incident Handling Guide is to recover from the threat. This involves restoring systems to normal operation, confirming that the systems are functioning normally, and applying patches or other remediation measures to prevent similar breaches in the future1.

References :=

• Understanding NIST SP 800-61: The Computer Security Incident Handling Guide

Digital certificates are electronic documents that use public key cryptography to verify the identity and authenticity of the sender and the receiver of encrypted communications. Digital certificates are issued and signed by trusted entities called certificate authorities (CAs), and they contain information such as the public key, the name, and the expiration date of the certificate. Digital certificates enable network security devices to decrypt perimeter traffic and inspect it for command and control communications or other malicious activity. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 51.

Full packet capture data involves storing the entire content of packets that traverse a network. This type of data is comprehensive and allows for detailed analysis but requires a significant amount of storage space compared to other data types like transaction, statistical, or session data. References := Cisco Cybersecurity Operations Fundamentals - Module 3: Network Data and Event Analysis

 Vulnerability management is a proactive approach to securing systems by identifying and fixing vulnerabilities before they can be exploited by attackers. It involves scanning systems for known weaknesses, prioritizing and assessing the risks of those vulnerabilities, and applying patches or other remediation measures to mitigate them. Vulnerability management helps reduce the attack surface and prevent potential breaches. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 11.

• The image shows a piece of code within a bordered rectangular area.
• It is a string of HTML code that appears to be an example of an attack, specifically “”.
• The code suggests an attempt to execute JavaScript within an image source attribute, indicative of a cross-site scripting attack.

 Social engineering attacks are techniques that exploit human psychology and behavior to manipulate or deceive people into performing actions or divulging information that can compromise the security of the organization. An example of a social engineering attack is receiving an email from human resources requesting a visit to their secure website to update contact information. This could be a phishing attempt to trick the user into clicking on a malicious link or entering their credentials on a fake website that looks like the legitimate one. References := Cisco Cybersecurity Operations Fundamentals - Module 6: Security Incident Investigations

During the examination phase of the forensic process, digital forensic investigators use various tools and techniques to extract and analyze information from the collected data. This phase involves detailed scrutiny of the data to uncover relevant evidence and is critical for the success of the forensic investigation.

References: The explanation aligns with the standard phases of digital forensics, which include identification, preservation, examination, documentation, and presentation as outlined in digital forensics literature and guidelines.

 Behavior-based detection monitors the behavior of programs in real-time. If a piece of software acts similarly to known malware after it’s been executed, behavior-based detection can stop it in its tracks. Signature-based detection involves searching for known patterns of data within executable code; if a pattern matches a “signature” in the system’s database that is considered malicious. References: Cisco Cybersecurity Operations Fundamentals

 Traffic fragmentation is an evasion technique where an attacker splits malicious payloads into smaller packets. This can help avoid detection since some security systems may not reassemble these packets to inspect the complete payload.

Patch management is the process of distributing and managing updates to software and systems. These updates can include patches for security vulnerabilities, bug fixes, and enhancements to improve performance or add new features. It ensures that systems are up-to-date, secure, and performing optimally. References := Cisco Cybersecurity Training

SIEM (Security Information and Event Management) systems are solutions that provide real-time analysis of security alerts generated by applications and network hardware. They collect, store, analyze, and report on log data for incident response, forensics, and regulatory compliance. On the other hand, SOAR (Security Orchestration Automation and Response) platforms allow organizations to collect data about security threats from multiple sources and respond to low-level security events without human assistance. References: Cisco Cybersecurity Operations Fundamentals

A certificate authority (CA) is a trusted entity that issues and manages digital certificates for secure communication over the internet. A digital certificate is a document that contains the public key and the identity of the owner of the key. A CA impacts security by validating the domain identity of the SSL certificate, which is a type of digital certificate that enables encrypted communication between a web server and a web browser. The CA verifies that the domain name in the certificate matches the domain name of the web server, and signs the certificate with its own private key. The web browser can then verify the signature of the CA and trust the identity of the web server. References := Cisco Cybersecurity Operations Fundamentals, Module 2: Security Monitoring, Lesson 2.3: Cryptography and PKI, Topic 2.3.2: Public Key InfrastructureReference: https://en.wikipedia.org/wiki/Certificate_authority

Network Address Translation (NAT) is the technology that allows a single IP address to send and receive traffic for multiple devices by modifying the IP header. NAT remaps one IP address space into another, enabling multiple devices to use a single public IP address to send and receive packets through the Internet2.

References := The concept of NAT and its role in network traffic management is detailed in networking resources and documentation, including those provided by network solution providers2.

The QR field in the DNS header specifies whether the message is a query (QR=0) or a response (QR=1). This bit is set to 0 for query messages and is set to 1 for response messages, allowing the recipient to distinguish between the two.

The user-agent HTTP header field is used in forensics to identify the type of browser used. It contains a characteristic string that allows network protocol peers to identify the operating system and browser of the web-server. This information is crucial in forensic analysis as it can provide insights into the client’s environment1.

References := The importance of the user-agent string in identifying the browser type is discussed in various technical resources, including the Wikipedia page on HTTP header fields2 and articles on GeeksforGeeks1.

An attack surface is the sum of all the points where an attacker can try to enter or extract data from an environment. It includes all the hardware, software, network, and human components that are exposed to potential threats. An attack vector is the path or means by which an attacker can exploit a vulnerability in the attack surface. It describes the type, source, and technique of an attack, such as phishing, malware, denial-of-service, etc. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 1: Security Concepts, Lesson 1.1: The CIA Triad and Security Concepts, Topic 1.1.3: Threats, Vulnerabilities, and Exploits

The file in question, which contains logs of unsuccessful login attempts from an unknown IP address, is considered indirect evidence. It suggests that there may have been an attempt to gain unauthorized access, but it does not directly prove who was responsible for the attempts. Indirect evidence can be used to support other evidence that may lead to a direct identification of the threat actor. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) and other Cisco cybersecurity resources provide information on how to analyze and categorize different types of evidence in the context of security incidents.

 Statistical detection relies on analyzing data over time to identify patterns and anomalies, without predefined rules. It uses algorithms and statistical models to determine normal behavior and identify deviations. Rule-based detection uses predefined rules or patterns to identify known threats or vulnerabilities, often based on signatures or behaviors associated with specific attacks.

The exhibit shows a Stealthwatch dashboard displaying information on alarming hosts, alarms by type, and today’s alarms. On the left side under “Top Alarming Hosts,” there are five host IP addresses listed with their respective categories indicating different types of alerts including ‘Data Hoarding’ and ‘Exfiltration.’ In “Alarms by Type” section at center top part of image shows bar graphs representing various alarm types including ‘Crypto Violation’ with their respective counts. On right side under “Today’s Alarms,” there’s a table showing the details of each alarm such as the host IP, the alarm type, the severity, and the time. The potential threat identified in this dashboard is that host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91, which is a sign of data exfiltration. Data exfiltration is the unauthorized transfer of data from a compromised system to an external destination, such as a command and control server or a malicious actor. This can result in data loss, breach of confidentiality, and damage to the organization’s reputation and assets. References := Cisco Cybersecurity Operations Fundamentals - Module 7: Network and Host Forensics

 The unauthorized usage of “Tcpdump” tool indicates that the malicious insider was attempting to obtain all information within datagrams passing through a specific interface on the network. Tcpdump allows users to capture packet data from a live network or read packets from a previously saved capture file. References := Cisco CyberOps - Module 3: Network Data and Event Analysis

The log in the exhibit is generated by a firewall. It shows a deny action taken on TCP traffic, specifying the source and destination addresses and ports, which is characteristic of firewall logs. Firewalls are designed to control incoming and outgoing network traffic based on predetermined security rules, and this log entry reflects the enforcement of such a rule.

References :=

• Cisco’s official documentation on firewall technologies and their log formats.

 TOR, or The Onion Router, is designed to conceal a user’s location and usage from anyone conducting network surveillance or traffic analysis. Using TOR makes it more difficult to trace internet activity, including “visits to Web sites, online posts, instant messages, and other communication forms,” back to the user1. It is intended to protect the personal privacy of users, as well as their freedom and ability to conduct confidential communication by keeping their internet activities unmonitored. Within an organization, the use of TOR can decrease visibility into data traffic because it encrypts the data multiple times and routes it through a series of servers operated by volunteers around the globe. This makes network monitoring and data visibility challenging for cybersecurity professionals within the organization. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

The ‘detection and analysis’ phase of incident response includes identifying all hosts affected by an attack. This step involves analyzing the scope of the incident, determining which systems and data are impacted, and understanding the nature of the attack to inform subsequent containment and eradication efforts45.

References :=

• CrowdStrike’s overview of incident response frameworks and steps4.
• VCEGuide’s explanation of incident response steps

A threat is a possible danger that might exploit a vulnerability to breach the security and cause harm to an asset. An asset is anything of value that needs to be protected, such as data, systems, or networks. A vulnerability is a weakness or flaw in the security that can be exploited by a threat. An exploit is a piece of code or a technique that takes advantage of a vulnerability to compromise the security and perform malicious actions on an asset. References := Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.1: The CIA Triad and Security Concepts, Topic 1.1.3: Threats, Vulnerabilities, and Exploits

 Encryption ensures that data is secure and unreadable to unauthorized individuals without the proper decryption key. It is a critical aspect of maintaining data confidentiality and security, especially in the transmission of sensitive information over potentially insecure networks1.

References := What Is Encryption? Explanation and Types - Cisco

According to NIST SP800-61, the incident response phase called “Containment, Eradication, and Recovery” involves containing the incident, eradicating the threat, and recovering from the incident2. In the scenario described, the engineer worked on containing the DDoS attack by identifying the attacker and the technique used, which is part of the containment process. The recommendation to implement Blackhole filtering is part of the eradication process, where measures are taken to prevent the attack from happening again. Finally, restoring the server is part of the recovery process, where normal operations are resumed. Therefore, the engineer finished work during the “Containment, Eradication, and Recovery” phase. References: NIST SP800-61 Computer Security Incident Handling Guide2.

Threat hunting is a proactive cybersecurity technique that involves searching for indicators of compromise or signs of intrusion within an organization’s network or systems. Unlike automated detection systems, threat hunting is typically carried out by security analysts who use their knowledge and intuition to identify subtle, unusual patterns that may indicate a security breach. The goal of threat hunting is to identify and mitigate threats before they can cause significant damage.

References: The CBROPS course material covers the concept of threat hunting as part of the skill set required for cybersecurity operations analysts, who are responsible for identifying and mitigating cyber threats

Privileges required is a metric in the Common Vulnerability Scoring System (CVSS) that measures the level of access needed to launch a successful attack. The higher the privileges required, the lower the severity of the vulnerability. The privileges required metric has three possible values: none, low, and high. None means that the attacker does not need any privileges to exploit the vulnerability. Low means that the attacker needs privileges that provide basic user capabilities. High means that the attacker needs privileges that provide significant or administrative control over the target. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 2-17; 200-201 CBROPS - Cisco, exam topic 1.3.c

SQL injection is a type of vulnerability that allows an attacker to execute malicious SQL statements on a database server. This can result in reading, writing, or erasing information from the database, as well as bypassing authentication, executing commands, or compromising the server. SQL injection exploits the lack of input validation or output encoding in web applications that interact with databases. References := Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.3: Common Network Application Operations and Attacks, Topic 1.3.2: Web Application Attacks

A screenshot of a computer Description automatically generated

NIST Special Publication 800-61 r2 outlines the incident response process including detection and analysis, which involves identifying and validating the occurrence of incidents, and post-incident activity that focuses on lessons learned and improvements to be made after an incident has occurred. References := NIST Special Publication 800-61 r2

 Application-level whitelisting is a security technology that allows only a set of pre-approved applications to run on a system, and blocks any other unauthorized or malicious programs. This can prevent malware, ransomware, zero-day exploits, and other threats from compromising the system. Application-level whitelisting is also known as application control or application allowlisting. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 3: Host-Based Analysis, Lesson 3.2: Endpoint Security Technologies, Topic 3.2.3: Application Whitelisting, page 3-20.

Corroborative evidence is the type of evidence that supports a theory or an assumption that results from initial evidence. It provides additional support to the initial findings, strengthening the theory or assumption by confirming the same facts or pointing towards the same conclusion with independent pieces of evidence4567.

References := Types of evidence (article) | Lessons | Khan Academy, Evidence: Fundamental Concepts and the Phenomenal Conception, Navigating Scientific Evidence: Types and Definitions, How Courts Work - American Bar Association

 Inline mode is used for monitoring the traffic path and can examine any traffic at wire speed. This means that it can analyze data packets as they pass through in real-time. On the other hand, tap mode is used for monitoring traffic as it traverses across the network but does not have the capability to examine data at wire speed like inline mode. References: The information can be referenced from Cisco’s official documentation on cybersecurity operations and fundamentals.

A dictionary attack is a method used to break into a password-protected computer or server by systematically entering every word in a dictionary as a password. In the context of an authentication system that uses only 4-digit numeric passwords, a dictionary attack would involve trying all possible combinations of 4-digit numbers until the correct one is found.

References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course materials discuss various attack methods, including dictionary attacks, and how they can be used to compromise networks

The regular expression that matches both “color” and “colour” is colo?ur. In this expression, the ? denotes that the preceding character u is optional, meaning it may appear zero or one time. This allows the expression to match both the American spelling “color” and the British spelling “colour”.

References := Understanding regular expressions is fundamental in various computing tasks, including cybersecurity operations. The Cisco Cybersecurity Operations Fundamentals (CBROPS) material covers the use of regular expressions for searching through logs and data, which is a critical skill for a cybersecurity analyst.

 Indicators of Compromise (IoC) are pieces of forensic data, such as system log entries or files, that suggest an intrusion may have occurred. Indicators of Attack (IoA) are signs that an attack may be underway, allowing organizations to take action before any potential breach occurs.

References: The CBROPS course materials cover the concepts of IoC and IoA, explaining how they are used in cybersecurity operations to detect and prevent security incidents.

What Are Ports 139 And 445? SMB has always been a network file sharing protocol. As such, SMB requires network ports on a computer or server to enable communication to other systems. SMB uses either IP port 139 or 445. Port 139 - SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network. Port 445 - Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet. https://www.varonis.com/blog/smb-port SMB Ports 139 and 445 are open Email Ports 25 and 110 are closed Therefore "D. Email Ports are closed on the Server."

A command and control server (C2 or C&C) is a server that is used by attackers to communicate with and control compromised systems, such as bots, zombies, or backdoors. The C2 server can send instructions to the compromised systems, such as executing commands, downloading files, uploading data, or launching attacks. The C2 server can also receive information from the compromised systems, such as system information, keystrokes, screenshots, or credentials. References:

• Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 3: Network Intrusion Analysis, Lesson 3.4: Malware
• Cisco Certified CyberOps Associate Overview, Exam Topics, 3.4 Compare and contrast types of malware

The Uniform Resource Identifier (URI) is used to identify specific resources on the internet, including files. In the context of HTTP GET requests, the URI specifies the path to the file being requested.

References: This explanation is based on standard web protocols and practices, as the current page does not provide specific Cisco documentation.

According to the NIST SP 800-61 incident handling process, the SOC team should first isolate the affected endpoints to prevent further spread of the attack and take disk images for analysis (A). This helps in preserving evidence for a thorough investigation. The next step would be to block the connection to the C&C server on the perimeter next-generation firewall ©, which helps to cut off the communication between the compromised endpoint and the attacker’s server, thereby mitigating the threat123.

References: The answers are based on the guidelines provided in the NIST SP 800-61 Computer Security Incident Handling Guide, which outlines the steps for incident handling, including detection, analysis, containment, eradication, recovery, and post-incident activities

The source IP address from an audit log that indicates a session which may have exploited a vulnerability is considered corroborative evidence. This type of evidence supports other evidence that suggests a security breach occurred. In the context of cybersecurity, corroborative evidence can help establish that an attack was carried out and can be used in conjunction with other data points to build a case during an investigation.

References := The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) training material discusses the types of data needed to investigate security incidents, which includes understanding the role of different types of evidence in building a security incident case1.

 Protected data refers to any information that is legally guarded or sensitive due to its nature. In the context of the organization described, the main database contains Intellectual Property (IP), which includes patents that are legally protected forms of inventions and designs. The secondary database holds Personally Identifiable Information (PII), which comprises data that can be used to identify individuals, such as names and contact details. Both IP and PII are considered protected data and should be identified during an internal audit to ensure they are handled according to legal and regulatory standards. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

 The attack surface is the sum of all paths for data into and out of the environment, such as network interfaces, applications, services, protocols, ports, and user accounts. The attack surface represents the exposure of the environment to potential threats and attacks. A vulnerability is an exploitable weakness in a system or its design that can allow an attacker to compromise the system or its data. A vulnerability is a subset of the attack surface, as not all paths for data are vulnerable. References: [Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Module 1: Security Concepts]

Ransomware is a type of malware that encrypts the victim’s data and demands a ransom for the decryption key. The attacker may also threaten to publish or delete the data if the ransom is not paid. In this case, the Egregor malware is distributed through a Cobalt Strike, which is a penetration testing tool that can be used to deploy payloads on compromised systems. The malware exfiltrates the victim’s data to a command and control server and uses it as leverage to extort money from the victim. References := Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.3: Common Network Application Operations and Attacks, Topic 1.3.3: Malware Attacks

The exhibit displays a sys log which is used in computer systems for messaging logs. It provides messaging tracking services from different devices like routers, switches etc., which helps in tracking and identifying potential issues. References := Cisco Cybersecurity source documents or study guide 

Indirect evidence is evidence that does not directly prove a fact, but rather implies or infers it from other facts or circumstances. Indirect evidence is also known as circumstantial evidence or corroborating evidence. A video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor is an example of indirect evidence, because it does not directly show that the suspect was involved in the file transfer, but rather suggests a possible connection or correlation between the two events. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 5: Security Policies and Procedures, Lesson 5.3: Digital Forensics, Topic 5.3.1: Evidence, page 5-24.

 DNS amplification is a type of Distributed Denial of Service (DDoS) attack where an attacker uses publicly accessible open DNS servers to flood a target with DNS response traffic. The goal is to overwhelm the target with traffic, causing a denial of service.

 Profiling a network involves various elements that provide insights into its characteristics and behaviors. Total throughput is crucial as it measures the amount of data passing from a source to a destination in a given period, reflecting the network’s capacity and usage patterns1. Listening ports are also essential for profiling because they represent the entry points for network services, indicating which services are available and potentially vulnerable1.

References :=

• Network profiling tools and techniques discussed in online resources23.
• Direct explanations of network profile elements

 In the context of phishing emails, the threat actor is the entity that is responsible for initiating the threat, which in this case is the sender of the phishing emails. The sender is impersonating the HR department to deceive the receiver into believing that the emails are legitimate

https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/windo ws-registry-advanced-users

 Tampered images are disk images that have been modified or altered in some way after they were captured from the original source. Tampered images may have different stored and computed hash values, which indicate that the integrity of the image has been compromised. Tampered images are not reliable or valid sources of evidence for forensic investigations, as they may contain false or misleading information. Untampered images are disk images that have not been changed or manipulated after they were acquired from the original source. Untampered images have the same stored and computed hash values, which verify that the image is an exact copy of the original disk. Untampered images are used for forensic investigations, as they preserve the original state and content of the disk and provide accurate and trustworthy evidence. References:

• Contrasting tampered and untampered disk images
• What is a difference between tampered and untampered disk images?

The exhibit shows a network diagram with a switch, a router, and two hosts. The switch has a MAC address table that maps the MAC addresses of the connected devices to the corresponding ports. A MAC flooding attack is a type of attack that aims to overload the switch’s MAC address table by sending a large number of frames with spoofed source MAC addresses. This causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, effectively turning it into a hub. This allows the attacker to sniff the traffic between the hosts and the router, or launch other attacks such as ARP spoofing or man-in-the-middle

 The alert from the Cisco ASA device and the numerous activity logs are examples of circumstantial evidence. Circumstantial evidence is evidence that relies on an inference or deduction to connect it to a conclusion of fact, such as a security incident or an attack. Circumstantial evidence does not directly prove the fact in question, but rather suggests or implies it. In this case, the alert and the logs indicate that a TCP connection attempt was denied by an access group, but they do not directly prove that an attack occurred or who was behind it. There could be other explanations for the denied connection, such as a misconfiguration, a network error, or a legitimate request. Therefore, this type of evidence is circumstantial and requires further investigation and analysis to confirm or rule out the possibility of an attack. References := Circumstantial evidence - Wikipedia; Circumstantial Evidence - Definition, Examples, Cases, Processes; Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 92.

 The regex [a−z]+ matches one or more lowercase letters from a to z. The plus sign (+) indicates that the preceding character set [a−z] can appear one or more times, thus matching strings of only lowercase letters1.

References := This explanation is consistent with standard regex syntax as described in various programming and scripting languages documentation

In a PCAP file, which is used to capture network packets, each packet contains various pieces of information that can be analyzed. The source and destination addresses refer to the IP addresses of the sender and receiver of the packets. The source and destination ports refer to the port numbers used for the communication, with common ports like 443 indicating HTTPS traffic. The network protocol here is TCP, which is responsible for establishing a connection and ensuring the delivery of packets. The transport protocol is IPv4, which is the underlying protocol for routing packets across the network. Lastly, the application protocol is TLS v1.2, which is used for secure communication over the internet.

References := The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course material covers the analysis of network traffic and the interpretation of PCAP files, which includes identifying the different elements within a packet capture1.

 A vulnerability refers to a weakness or flaw in a system that can be exploited by threats (such as hackers or malware) to gain unauthorized access, cause damage, etc. Threats exploit these vulnerabilities to impact the confidentiality, integrity, or availability of information and systems. References: Cisco Cybersecurity Associate

An attack vector is the method or technique that an attacker uses to exploit a vulnerability in a system or network. An attack vector can be a software, hardware, or human component that can be manipulated to gain unauthorized access, execute malicious code, or cause damage. An attack surface is the sum of all the possible attack vectors that are exposed by a system or network. An attack surface can be reduced by applying security measures such as patching, hardening, firewalling, and encrypting. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 1-4; 200-201 CBROPS - Cisco, exam topic 1.1.c

 Agent-based protection is a type of endpoint security that uses software agents installed on the devices to monitor and protect them. Agent-based protection can collect and detect all traffic locally, which means it can operate without relying on a network connection or a centralized server. Agent-based protection can also provide more granular and comprehensive visibility and control over the devices. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1.0/CSCU-LP-CBROPS-V1-028093.html (Module 2: Security Concepts, Lesson 2.3: Endpoint Security)

The #netstat -an command output typically displays a list of all open ports and associated connections. If the web application is slowed down, the engineer would look for unusual patterns such as an excessive number of connections to the web server which could indicate a denial-of-service attack. However, without specific details from the #netstat -an output, it’s not possible to determine the exact cause of the issue. Therefore, the engineer would need to gather more data, possibly including checking server logs, resource usage, and network traffic patterns to diagnose the problem accurately.

References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) provides knowledge on network monitoring tools and interpreting their output to identify potential security incidents.

NetFlow provides a more efficient way of recording and analyzing network traffic patterns over an extended period of time compared to syslog messages, full packet capture, or firewall event logs. It collects metadata about traffic flows traversing the network devices which can be used for understanding normal baseline behavior as well as identifying anomalies. References := Cisco Certified CyberOps Associate Overview

A screenshot of a computer Description automatically generated

 Full packet capture provides the complete recording of all the packets that are transmitted over the network. This data is essential for in-depth analysis during an investigation, as it allows investigators to reconstruct the session, observe the content of the traffic, and determine if data exfiltration has occurred.

References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) study materials would typically cover the importance of full packet capture in network forensics and incident response.

The Zero Trust security model operates on the principle that no one is trusted by default from inside or outside the network, and verification is required from everyone trying to gain access to resources on the network. It emphasizes continuous monitoring, validation, and least-privilege access to minimize exposure to sensitive parts of the network.

References: Zero Trust security | What is a Zero Trust network? | Cloudflare, Zero Trust Model: Unveiling 3 Core Principles for Enhanced Security, The Evolution of Zero Trust and the Frameworks that Guide It

 Cyber attribution is the process of identifying the source, motive, and methods of a cyberattack. Cyber attribution can help investigators to determine the responsibility, intent, and capability of the threat actors, as well as to prevent, deter, or respond to future attacks. One of the pieces of information that is needed for cyber attribution is known threat actor behavior, which refers to the patterns, techniques, tools, and tactics that are characteristic of a specific threat actor or group. Known threat actor behavior can help investigators to narrow down the suspects, link different incidents, and understand the objectives and strategies of the attackers. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 5: Security Policies and Procedures, Lesson 5.2: Incident Response, Topic 5.2.3: Cyber Attribution, page 5-14.

 Phishing is considered a low-bandwidth attack because it does not require the use of significant network resources. Instead, it relies on social engineering to deceive individuals into providing sensitive information or clicking on malicious links, often through email or other communication methods1.

A host-based intrusion detection system (HIDS) monitors a computer system for suspicious activity by analyzing events occurring within that host. It can detect malicious activities and security policy violations by examining system calls, application logs, file-system modifications (such as rootkit installations), and other host activities. HIDS is an essential component in safeguarding the IT infrastructure against unauthorized access and security breaches.

References := The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course material covers the monitoring of alerts and breaches, and the understanding and following of established procedures for response to alerts converted to incidents, which includes the use of host-based intrusion detection systems

The engineer engaged with the service component by enabling “Audiosrv,” which is the Windows Audio Service responsible for managing audio for Windows-based programs. By setting it to auto-start, the engineer ensured that the service would run automatically upon system startup. Additionally, the engineer interacted with process and thread management by using the Task Manager to modify the behavior of the “Audiosrv” service.

References: The information is based on standard operating procedures for troubleshooting audio issues in Windows OS, which involves services and processes management.

The presence of a default user agent in the headers of requests and data being transmitted suggests a cache bypassing attack. In this scenario, the attacker is likely requesting noncacheable content to avoid detection by caching mechanisms that could otherwise identify and block malicious traffic.

Symmetric encryption is a type of encryption that uses the same key to encrypt and decrypt data. Asymmetric encryption is a type of encryption that uses a pair of keys: a public key and a private key. The public key can be used to encrypt data, but only the private key can decrypt it, and vice versa. An advantage of symmetric encryption over asymmetric encryption is that it is faster and more efficient for encrypting large amounts of data, such as in sessions or bulk transfers. Asymmetric encryption is slower and more computationally intensive, but it is more secure and suitable for key exchange or digital signatures. References := Cisco Cybersecurity Operations Fundamentals, Module 2: Security Monitoring, Lesson 2.3: Cryptography and PKI, Topic 2.3.1: Cryptography

The /var/log/auth.log file contains information about authentication and authorization events on a Linux system, such as successful and failed logins, sudo commands, and SSH sessions. The output in the exhibit shows a failed login attempt from a user named “root” using SSH. References: https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01101.html

Host-based firewalls are designed to protect individual workstations from unwanted traffic by filtering incoming and outgoing network communications based on predefined security rules. They can block unauthorized access attempts and prevent potentially harmful traffic from reaching the system.

 Running all processes as root or administrator violates the principle of least privilege, which states that users and processes should be granted only the minimum permissions necessary to perform their specific role or function within an organization. Running all processes as root or administrator gives them full access and control over the system, which increases the risk of unauthorized actions, malicious attacks, and accidental errors. It also makes it easier for attackers to escalate their privileges and compromise the system. References:

• Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 1: Security Concepts, Lesson 1.2: Security Principles
• Cisco Certified CyberOps Associate Overview, Exam Topics, 1.1 Explain the CIA triad

Decision making is a principle that guides an analyst to gather information relevant to a security incident to determine the appropriate course of action. Decision making involves identifying the problem, defining the criteria, analyzing the alternatives, and choosing the best solution. Decision making helps an analyst to respond to an incident effectively and efficiently, while minimizing the impact and risk to the organization. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1.0/CSCU-LP-CBROPS-V1-028093.html (Module 3: Security Monitoring, Lesson 3.1: Security Operations Center)

The 5-tuple refers to the five different values that are used to define a specific communication session in a network. These values include the source IP address, destination IP address, source port, destination port, and the protocol in use. In this case, option D (Source Port) and option E (Initiator IP) are parts of the 5-tuple. References := Cisco Cybersecurity Operations Fundamentals

Vishing is an attack where fraudsters impersonate legitimate entities via phone calls to deceive individuals into providing sensitive information or performing actions that compromise security. References := Cisco Cybersecurity Source Documents

The attack described is a DNS amplification attack. It involves infected endpoints sending DNS requests with spoofed IP addresses to external DNS servers. The DNS servers then send large responses to the spoofed addresses, which are actually the targets of the attack. This can result in a significant amount of traffic being directed at the target, overwhelming their network resources. DNS amplification is a type of Distributed Denial of Service (DDoS) attack that leverages the DNS protocol to amplify the attack traffic.

 In Wireshark, to filter traffic for a specific LAN, the correct syntax uses ip.src== and ip.dst== to specify the source and destination IP addresses. The /16 denotes the subnet mask, indicating that we are interested in the entire 10.11.x.x range. This filter will show all traffic where both the source and destination IP addresses fall within the specified LAN, excluding any internet traffic. References: The information is based on the Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course, which covers network intrusion analysis and the use of tools like Wireshark for traffic analysis1.