Free Practice Questions for Cisco 200-201 Exam

According to NIST SP800-61, the incident response lifecycle consists of four phases: Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity.

When a SOC team member checks the Cisco Firepower Manager dashboard for further isolation actions, they are working within the Eradication and Recovery phase.

This phase focuses on removing the threat from the environment and recovering affected systems to normal operations.

References

NIST SP800-61 Computer Security Incident Handling Guide

Incident Response Phases Explained

Role of SOC in Incident Response

The lack of data visibility needed to detect the attack is caused by the threat actor gaining access to the system by known credentials. This means that the threat actor either obtained the employee’s username and password through phishing, social engineering, or other means, or used a compromised account that had legitimate access to the system. This would explain why there were no suspicious logs, alerts, or failed login attempts, as the threat actor appeared to be a normal user. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html (Module 2, Lesson 2.1.2)

 Traffic fragmentation is an evasion technique where an attacker splits malicious payloads into smaller packets. This can help avoid detection since some security systems may not reassemble these packets to inspect the complete payload.

The exhibit indicates that email traffic is being transmitted in clear text, meaning the contents of the communication are readable without encryption. In network intrusion analysis, this is commonly observed when Simple Mail Transfer Protocol (SMTP) traffic is captured on standard ports such as 25 or 587 without Transport Layer Security (TLS) enabled.

Encrypted mail protocols, such as SMTPS on port 465 or SMTP with STARTTLS, protect message contents from being inspected by unauthorized parties. When encryption is not in use, sensitive information such as email headers, message bodies, usernames, and potentially passwords can be exposed to attackers performing packet capture or man-in-the-middle attacks.

Option A is incorrect because port 465 indicates encrypted SMTPS communication, which contradicts the observed plaintext traffic. Option B is incorrect because altered sequence and acknowledgment numbers would indicate session manipulation or injection, not lack of encryption. Option D refers to the function of an SMTP relay but does not describe the observed condition in the traffic.

Cybersecurity operations fundamentals stress the importance of detecting unencrypted protocols during network analysis, as they represent high-risk exposure points. Identifying plaintext email communication is a key responsibility of SOC analysts and often leads to remediation actions such as enforcing TLS or disabling insecure services.

Therefore, the correct conclusion is that mail communication is not encrypted, making Option C the correct answer.

The screenshot shows multiple POP requests with the command PASS, which is typically used for password entry. The rapid succession and variation of these requests suggest an attempt to guess the password, characteristic of a brute-force attack. Remember, always verify with additional data or context when possible, as packet captures can contain vast amounts of information and may require thorough analysis for accurate interpretation.

A vulnerability management framework is a set of processes and tools that helps an organization identify, assess, prioritize, remediate, and mitigate system vulnerabilities. A vulnerability management framework aims to reduce the attack surface and the risk of compromise by applying security patches, hardening configurations, implementing security controls, and monitoring the system status. A vulnerability management framework is an essential component of a security operations center (SOC). References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 2-14; 200-201 CBROPS - Cisco, exam topic 1.2.b

A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. In this scenario, an attacker can observe network traffic exchanged between two users by placing themselves in between their communication channel. References := Cisco Blogs - New Cybersecurity and Cloud Skills to Protect Companies from Cybersecurity Attacks of the Future

 tcpdump is an open-source packet capture tool that uses the libpcap library to capture network traffic on Linux and Mac OS X operating systems. It can display the contents of packets in various formats, filter packets based on criteria, and save packets to a file. tcpdump is a command-line tool that can be run on a terminal or a remote shell1 References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Module 2: Security Monitoring