Cisco : 200-201 Questions & Answers

Target Audience for Cisco 200-201 Exam

The Cisco 200-201 exam is designed for the IT experts who are involved in cybersecurity operations. It is made for those professionals who have the practical technical skills and knowledge of mitigation of risk from cybercriminals, tracker, hackers, Trojans, malware, and all other online threats. The candidates need to possess the foundational skills and knowledge related to the processes needed to detect, analyze, respond, and prevent cybersecurity incidents and issues as part of a security operations centers (SOCs) team. In addition, the individuals should be conversant with the access control models for digital assets, understand the key COC metrics, as well as identify protected data, malware analysis, and prevention to expedite containment and detection of breaches.

There are no specific formal prerequisites for the Cisco 200-201 exam, but the applicants need to have a thorough understanding of its topics.

Reference: https://www.cisco.com/c/en/us/training-events/training-certifications/exams/current-list/200-201-cbrops.html

Understanding functional and technical aspects of Cisco Cybersecurity Operations Fundamentals v1.0 (200-201 CBROPS) Security Policies and Procedures

The following will be discussed in CISCO 200-201 exam dumps:

• Running processes
• Data preservation
• Critical asset address space
• Session duration
• Asset management
• Map elements to these steps of analysis based on the NIST.SP800-61
• Explain the need for event data normalization and event correlation.
• Identify these elements used for server profiling
• Configuration management
• Applications
• Explain the use of SOC metrics to measure the effectiveness of the SOC.
• PII
• Describe management concepts
• Logged in users/service accounts
• Preparation
• Preparation
• Explain the use of a workflow management system and automation to improve the effectiveness of the SOC.
• Total throughput
• Post-incident analysis (lessons learned)
• Post-incident analysis (lessons learned)
• Identify the common attack vectors.
• Running tasks
• Map the organization stakeholders against the NIST IR categories (CMMC, NIST.SP800-61)
• PHI
• Mobile device management
• Explain the use of a typical playbook in the SOC.
• Describe a typical incident response plan and the functions of a typical Computer Security Incident Response Team (CSIRT).
• Identify these elements used for network profiling
• Detection and analysis
• Detection and analysis
• Identify protected data in a network
• Evidence collection order
• Containment, eradication, and recovery
• Containment, eradication, and recovery
• Ports used
• Volatile data collection
• Patch management
• Identify patterns of suspicious behaviors.
• PSI
• Vulnerability management
• Intellectual property
• Listening ports
• Classify intrusion events into categories as defined by security models, such as Cyber Kill Chain Model and Diamond Model of Intrusion
• Describe concepts as documented in NIST.SP800-86
• Data integrity
• Describe the elements in an incident response plan as stated in NIST.SP800-61
• Identify resources for hunting cyber threats.
• Apply the incident handling process (such as NIST.SP800-61) to an event
• Conduct security incident investigations.
• Identify malicious activities.
• Explain the use of Vocabulary for Event Recording and Incident Sharing (VERIS) to document security incidents in a standard format.
• Describe the relationship of SOC metrics to scope analysis (time to detect, time to contain, time to respond, time to control)

Certification Path for Cisco Cybersecurity Operations Fundamentals v1.0 (200-201 CBROPS)

This exam is designed for individuals seeking a role as an associate-level cybersecurity analyst and IT professionals desiring knowledge in Cybersecurity operations or those in pursuit of the Cisco Certified CyberOps Associate certification including:

• Current IT professionals
• Students pursuing a technical degree
• Recent college graduates with a technical degree

It has no pre-requisite.

Skills Outline of Cisco 200-201 Exam

Cisco has divided the syllabus of the 200-201 exam into various sections. Each of them evaluates the applicants’ knowledge and ability to perform a range of technical tasks. The detailed skills outline is mentioned below:

• Security Concepts (20%)

  This is the first domain of the Cisco 200-201 exam that you need to learn. Within this first topic, the students need to show their ability and knowledge of describing the CIA triad, principles of a defense-in-depth strategy, and security terms as well as comparing security deployments, security concepts, and access control models. You should also have the relevant skills in identifying the challenges of data visibility (Cloud, host, and network), comparing the rule-based detection vs. statistical and behavioral detection, and interpreting the 5-tuple approach in order to isolate any compromised host in a given group set of logs. The evaluation process also includes the measurement of your knowledge of the identification of potential data loss from the provided traffic profiles. This part also covers the description of terms as defined in CVSS, including attack vector, scope, user interaction, privileges required, and attack complexity. It also includes role-based access control, time-based access control, rule-based access control, authentication, accounting, and authorization. It is important to know about non-discretionary access control, mandatory access control, discretionary access control, threat intelligence platform (TIP), threat intelligence (TI), malware analysis, reverse engineering, and threat hunting as well. Your knowledge of legacy antivirus and antimalware, run book automation (RBA), and sliding window anomaly detection will also help you answer the questions.

• Security Policies and Procedures (15%)

  This last part is all about the description of the management concepts and elements in the incident response plan as specified in NIST.SP800-601 as well as mapping the organization stakeholders against any NIST IR categories and applying the incident handling process to an event.

• Network Intrusion Analysis (20%)

  This objective encompasses interpreting basic regular expressions, extracting files from a TCP stream from a Wireshark and PCAP file, and comparing the qualities of data acquired from traffic or taps monitoring and transactional data, especially in the analysis of network traffic. The test takers needs to have the skills in comparing inline traffic interrogation and traffic monitoring or taps, comparing deep pocket inspection with stateful firewall operation, as well as comparing impact vs. no impact for false positive, benign, and true negative. The ability to map the provided events in order to source technologies is also important.

• Security Monitoring (25%)

  Within this second subject area, the individuals taking the 200-201 exam need to demonstrate that they possess the abilities to compare attack surface and vulnerability, identify the certificate components in a specific scenario, describe the impact of the certificates on security (includes asymmetric/symmetric, private/public crossing the network, and PKI). The potential candidates should be able to describe the obfuscation and evasion techniques, such as proxies, encryption, and tunneling as well as describe endpoint-based attacks, involving malware, ransomware, command and control, and buffer overflows. If you are also knowledgeable of how to describe the social engineering attacks and web application attacks, such as cross-site scripting, and command injections, you will succeed. Knowing the SQL injection and cross-site scripting, being able to describe network attacks, such as man-in-the-middle, distributed denial of service, denial of service, and protocol-based, are the skills you should possess. You must also know howto describe the use of various data types in monitoring security, which includes full packet capture, alert data, metadata, statistical data, transaction data, and session data.

• Host-Based Analysis (20%)

  This section includes interpreting an application, operating system, or command line logs in order to identify events, comparing tempered and untampered disk image, and interpreting the output report of the malware analysis tool such as denotation chamber or sandbox. Describing the role of attribution in any investigation, identifying the types of evidence used depending on the provided log, and identifying the components of a given operating system such as Linux and Windows in a given scenario are the skills you need to have. They also include your ability to describe the functionality of a wide range of endpoint technologies in respect to security monitoring.

Cisco 200-201 Exam Syllabus Topics: