Skip to main content
Cisco ⭐ Premium ⭐ Featured

Cisco CyberOps Associate (200-201 CBROPS)

By Webmaster Certland English 📝 340 questions ❤️ 0 likes

Practice exam for the Cisco Certified CyberOps Associate (CBROPS 200-201). Covers security concepts, security monitoring, host-based analysis, network intrusion analysis, and security policies and procedures.

⭐ Premium Updated Mar 2026

Unlock all 340 Cisco CyberOps Associate (200-201 CBROPS) questions

Full simulation · Detailed explanations · Unlimited attempts

  • 340 questions — ~5 full-length simulations
  • Detailed explanations — why each answer is right or wrong
  • Unlimited attempts — retake as many times as needed
  • Smart Practice + Focus Mode + no ads
340
Questions
All certifications
from $4.90/mo

Sample Questions — Cisco CyberOps Associate (200-201 CBROPS)

5 free sample questions from this practice exam. Correct answers are highlighted.

1. A security team is classifying data based on sensitivity. Which access control model assigns data labels (Top Secret, Secret, Confidential) and restricts access based on a subject's clearance level?

A Discretionary Access Control (DAC)
B Mandatory Access Control (MAC) ✓ Correct
C Role-Based Access Control (RBAC)
D Attribute-Based Access Control (ABAC)

2. An organization implements a proxy server to inspect outbound web traffic. When a client sends a web request, the proxy makes the request on behalf of the client. What is this type of proxy called?

A Forward proxy ✓ Correct
B Reverse proxy
C Transparent proxy
D SOCKS proxy

3. Which NetFlow field distinguishes between two different flows that share the same source and destination IP addresses?

A IP Time-to-Live (TTL)
B IP identification field
C IP protocol number only
D Source and destination port numbers ✓ Correct

4. An analyst is reviewing IDS/IPS alerts in the SIEM and notices that a high-priority alert for 'SQL Injection Attempt' fires 500 times per hour against the company's web application servers. The security team has previously confirmed these are all false positives generated by a specific WAF testing tool. What is the BEST approach to handle this situation?

A Disable the SQL injection detection rule to eliminate the false positives
B Accept the 500 false positive alerts per hour as an unavoidable operational reality
C Tune the rule to suppress alerts from the authorized testing tool's IP with documented exception approval ✓ Correct
D Escalate all 500 alerts per hour to Tier 2 analysts for individual investigation

5. A SOC analyst uses Volatility to analyze a memory dump from a compromised Windows workstation. The analyst runs the 'pstree' plugin and notices that 'powershell.exe' has 'winword.exe' as its parent process. What does this parent-child relationship most likely indicate?

A The user manually opened PowerShell from within a Word document as a legitimate action
B A malicious macro in a Word document likely spawned PowerShell to execute a payload ✓ Correct
C Word routinely spawns PowerShell during spell-check operations
D PowerShell was used by an administrator to remotely manage the Word process

Want to test yourself for real?

Create a free account and run our exam simulation engine.

Free No credit card
  • Simulation engine
  • Up to 10 questions per attempt
  • Score & basic stats
Create free account Already have an account? Sign in
Best
Premium Premium
  • All 340 questions
  • Detailed explanations
  • Smart Practice + Focus Mode
⭐ Get Premium

Information

Questions 340
Time 2h
Difficulty Medium
Minimum Score 72.00%


💰 ROI

Official exam $300.00
CertLand $4.90/mo
Prepare for $300 for less than a coffee/mo

Study Guides & Articles

Related Exams

Discussion

No comments yet. Be the first to start the discussion!

Sign in to join the discussion.