Cisco 200-201 Exam Questions [July 2026 Update]

Security Monitoring is the largest domain on the Cisco 200-201 CCNACBR exam at 25%, and it consistently produces the most first-attempt failures among candidates who thought they understood it. The problem is how candidates interpret the word “monitoring.” They study what tools exist: SIEM, IDS, IPS, NetFlow, and packet capture. What the 200-201 CBROPS exam actually tests is what each tool sees, what each tool cannot see, and what the data it produces means in an operational context. A stateful firewall and a deep packet inspection tool both examine traffic, but the CCNACBR exam tests exactly what distinguishes them and why NAT or tunneling reduces the visibility of one but not the other. An IDS in passive tap mode and an IPS in inline mode are both monitoring traffic, but only one can block, and only one creates a potential single point of failure. A true positive and a false positive both generate an alert. Still, the CBROPS exam presents a scenario and asks you to classify which one you are looking at and what the consequences of each classification error are in a SOC environment. Candidates who know tool names without understanding what each tool can and cannot see at the data layer will miss question after question in the highest-weighted domain of the 200-201 CCNACBR exam.

The Cisco 200-201 CBROPS (Understanding Cisco Cybersecurity Operations Fundamentals, also designated CCNACBR v1.2) is the single exam required to earn the Cisco Certified CyberOps Associate certification. It validates the knowledge and skills required to operate as a Tier 1 or Tier 2 Security Operations Center analyst: monitoring security tools, analyzing alerts, investigating suspicious activity across hosts and networks, understanding incident response procedures, and applying the correct frameworks to classify and escalate events. The exam is 120 minutes, costs approximately $300, and is delivered through Pearson VUE. Certification is valid for 3 years.

Cert Empire’s 200-201 CBROPS CCNACBR exam questions are built as SOC analyst decision scenarios: given this alert, this log, this packet capture, or this event, what does it mean, what tool produced it, what action is appropriate, and how does it fit into the frameworks the CBROPS exam tests?

Exam Snapshot

Domain Weights at a Glance

Security Monitoring is the heaviest single domain. Network Intrusion Analysis and Host-Based Analysis together account for another 40%. Candidates who distribute study time equally across all five domains are underinvesting in the two areas where the CCNACBR exam places the most points.

Domain 1: Security Concepts (20%)

CIA Triad

The foundation of the entire 200-201 CCNACBR exam. The exam tests all three components with attack-scenario mapping:

Confidentiality: Information is accessible only to authorized parties. Breached by: unauthorized access, data exfiltration, eavesdropping, credential theft.

Integrity: Information is accurate, complete, and unmodified by unauthorized parties. Breached by: man-in-the-middle attacks that alter data in transit, unauthorized file modification, SQL injection that changes database records.

Availability: Systems and data are accessible to authorized users when needed. Breached by: DoS/DDoS attacks, ransomware locking files, hardware failure, service disruption.

The CBROPS exam presents attack scenarios and asks which CIA component is primarily violated. Ransomware primarily attacks Availability (and secondarily Confidentiality when data is exfiltrated before encryption). DoS attacks exclusively target Availability. MitM attacks primarily target Integrity and Confidentiality.

Security Terms: Threat, Vulnerability, Risk, Exploit

The CCNACBR exam tests these terms with applied precision, not dictionary definitions:

Threat: Any potential danger to a system or data. Threats can be human (malicious insider, external attacker) or non-human (natural disaster, hardware failure).

Vulnerability: A weakness in a system that could be exploited. A vulnerability alone does not create risk unless a threat exists that could exploit it.

Exploit: The code, technique, or method that takes advantage of a vulnerability. An exploit is the mechanism that turns vulnerability into compromise.

Risk: The combination of threat likelihood and impact when a vulnerability is exploited. Risk = Threat × Vulnerability × Impact. Risk management decisions are made based on risk calculations, not individual threat or vulnerability assessments alone.

Threat intelligence: Information about current and emerging threats, threat actors, indicators of compromise (IoCs), and attack tactics that enables defenders to prioritize protection and detection efforts.

Threat hunting: Proactively searching through environments for threats that have evaded automated detection, based on hypotheses derived from threat intelligence.

CVSS (Common Vulnerability Scoring System)

The 200-201 CBROPS exam tests what CVSS measures and what the scoring components mean operationally. CVSS scores range from 0 (informational) to 10.0 (critical).

Base Score metrics the exam tests:

• Attack Vector (AV): How is the vulnerability exploited? Network (remotely exploitable across a network) scores higher than Local (physical access required).
• Attack Complexity (AC): How difficult is exploitation? Low (no special conditions) scores higher than High (specific conditions must exist).
• Privileges Required (PR): What access level does the attacker need before exploiting? None scores higher than High.
• User Interaction (UI): Does the attack require a victim to take action? None scores higher than Required.
• Scope: Does a successful exploit affect only the vulnerable component or other components as well?
• Impact metrics (C/I/A): How much does successful exploitation impact Confidentiality, Integrity, and Availability? Each is scored None/Low/High.

A CVSS 9.8 vulnerability with Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, is far more urgent than a 7.5 vulnerability requiring physical access and administrative privileges.

Access Control Models

The CCNACBR exam tests all four models by how they determine access decisions:

DAC (Discretionary Access Control): The owner of a resource decides who can access it. Standard Unix file permissions (owner/group/other) are DAC. Weakness: if the owner account is compromised, the attacker inherits the owner’s ability to grant access to others.

MAC (Mandatory Access Control): The system enforces access based on labels (classification levels: Unclassified, Secret, Top Secret) assigned to both subjects (users) and objects (files). Users cannot change access controls even on resources they create. Used in high-security government and military environments.

RBAC (Role-Based Access Control): Access is assigned to roles, not individual users. Users are assigned to roles. A new employee in the “Finance Analyst” role automatically receives all permissions assigned to that role. Easier to administer at scale than DAC.

ABAC (Attribute-Based Access Control): Access decisions use multiple attributes simultaneously: user attributes (department, clearance level, location), resource attributes (classification, owner), and environmental attributes (time of day, network location). Most flexible and granular. Supports zero-trust architecture principles.

The 200-201 CBROPS exam tests which model is appropriate for which organizational scenario and what the limitation of each model is.

Defense-in-Depth

Multiple overlapping layers of security controls so that the failure of one layer does not expose the organization to compromise. The CCNACBR exam tests the three control type categories:

• Preventive controls: Stop an attack before it succeeds (firewalls, access control, encryption).
• Detective controls: Identify that an attack has occurred or is occurring (IDS, SIEM, log analysis).
• Corrective controls: Restore normal operation after an attack (backups, incident response, patch management).

Rule-Based vs. Behavioral and Statistical Detection

This distinction appears repeatedly across the Security Concepts and Security Monitoring domains.

Rule-based (signature) detection: Compares activity against a database of known attack patterns (signatures). High precision for known threats. Zero effectiveness against novel attacks, zero-days, or variants that modify the signature slightly.

Behavioral detection: Establishes a baseline of normal activity. Alerts on statistically significant deviations. Can detect unknown threats. Generates more false positives because “unusual” does not always mean “malicious.” Requires tuning and baselining before it produces reliable results.

The CBROPS exam presents detection scenarios and asks which approach would detect the activity and which would miss it.

5-Tuple Approach

The 5-tuple (source IP address, destination IP address, source port, destination port, transport protocol) uniquely identifies a network flow. The 200-201 CCNACBR exam tests how SOC analysts use the 5-tuple to isolate a specific compromised host’s communication from a large set of logged network events. Given a group of logs spanning hundreds of flows, applying the 5-tuple filters to a specific suspect flow reveals exactly who that host was communicating with, on which protocol, and for how long.

Domain 2: Security Monitoring (25%) — Highest-Weighted Domain

The Security Monitoring domain is where most CCNACBR candidates lose points. Understanding tool names is not enough. The exam tests what data each technology type produces, what it cannot see, how visibility is affected by encryption or NAT, and how a SOC analyst interprets that data operationally.

Attack Surface vs. Vulnerability

The CBROPS exam tests this as a specific paired concept. Attack surface is the collection of all entry points an attacker could attempt to use: open ports, running services, web application interfaces, email systems, physical access points, and human targets. Vulnerabilities are specific, exploitable weaknesses within that attack surface. Reducing the attack surface (disabling unused services, removing unnecessary accounts, minimizing public-facing systems) decreases the number of vulnerabilities that exist to be exploited.

What Each Technology Produces (and Cannot Produce)

This is the most heavily tested area in the Monitoring domain. The CCNACBR exam presents a monitoring scenario and asks which technology type would produce the described data, or presents a data type and asks what technology generated it.

Traditional firewalls (stateful inspection): Examine traffic through Layer 4. Track TCP connection state (SYN, established, FIN). Log source/destination IP, port, protocol, and action (permit/deny). Cannot inspect Layer 7 payload content. An HTTPS session permitted by the firewall is treated as a permitted TCP connection on port 443 regardless of what the payload contains.

Next-Generation Firewalls (NGFW) with Deep Packet Inspection (DPI): Inspect traffic through Layer 7. Identify application identity regardless of port (a backdoor running on port 443 is identified as non-HTTPS). Enforce policy based on application, user identity, and content. The CBROPS exam tests the specific distinction: DPI reads application-layer content; stateful inspection reads only transport-layer session state. Both log sessions, but the depth of what each can see differs fundamentally.

IDS (Intrusion Detection System) in passive/tap mode: Receives a copy of network traffic (via a network tap or span port) and analyzes it for attack signatures or anomalies. Can detect and alert. Cannot block traffic. If the IDS sensor fails, traffic continues to flow normally. The exam tests this as the key advantage of tap mode: no impact on traffic flow.

IPS (Intrusion Prevention System) in inline mode: Sits directly in the traffic path. Analyzes traffic and can block matching flows before they reach the destination. The exam tests the trade-off: inline IPS can prevent attacks, but if the IPS fails without a hardware bypass (failopen) mechanism, all traffic stops. This is the single point of failure concern.

SIEM (Security Information and Event Management): Collects logs and events from firewalls, IDS/IPS, endpoints, servers, and applications. Normalizes event formats (converting different log schemas to a common format). Correlates events across sources (firewall sees an outbound connection at the same time endpoint logs show a suspicious process launch — SIEM connects these as related events). Provides alerting, dashboards, and long-term storage for forensic analysis. The 200-201 CCNACBR exam tests that SIEM provides a centralized platform managing numerous devices simultaneously and performing correlation that individual point tools cannot perform in isolation.

SOAR (Security Orchestration, Automation, and Response): Automates the response actions that follow SIEM alerts. Where SIEM detects and notifies, SOAR detects and acts: automatically isolating a compromised endpoint, blocking an IP address across multiple firewalls, creating a ticket, and notifying the analyst. The exam tests SIEM vs. SOAR as detect-and-notify versus detect-and-respond.

NetFlow: Router and switch telemetry that records flow metadata: source/destination IP, source/destination port, protocol, interface, byte count, packet count, flow start/end time. NetFlow does not capture the payload. The exam tests what NetFlow can reveal (communication patterns: who talked to whom, for how long, how much data was transferred) and what it cannot reveal (what the payload contained). NetFlow is used for network baselining, anomaly detection, and data exfiltration detection based on volume anomalies.

Packet capture (PCAP): Full packet capture captures both headers and payload. Provides maximum visibility but is resource-intensive at scale. The exam tests that PCAP is needed when payload content must be analyzed (malware extraction, protocol anomaly inspection, evidence collection) and that it is typically applied selectively to high-value or suspicious flows rather than all traffic.

Inline vs. Tap Monitoring: The Visibility and Risk Trade-Off

The 200-201 CBROPS exam explicitly tests this deployment choice:

True Positive, False Positive, True Negative, False Negative

This is a confirmed high-frequency CCNACBR exam topic. The exam presents a scenario and requires classification into one of these four categories.

True Positive (TP): An alert fires on genuinely malicious activity. Correct detection. Requires investigation and response.

False Positive (FP): An alert fires on benign activity that resembles an attack. Wrong detection. Wastes analyst time, causes alert fatigue, erodes confidence in the detection system. SOC teams tune detection rules to reduce false positives.

True Negative (TN): No alert fires on genuinely benign activity. Correct non-detection. Expected and desirable for most traffic.

False Negative (FN): No alert fires on genuinely malicious activity. The most dangerous outcome. An attack proceeds undetected. Improving detection coverage (new signatures, behavioral baselines, threat hunting) reduces false negatives.

The CBROPS exam also tests whether different organizations tolerate these error types differently. A highly regulated environment may prefer more false positives (rather than risk a false negative that causes a compliance breach). A high-volume SOC may prioritize reducing false positives to maintain analyst productivity.

Network Attacks on the Security Monitoring Domain Tests

Protocol-based DoS: Exploiting protocol behavior to exhaust resources. SYN flood (sending large volumes of SYN packets without completing handshakes, exhausting the server’s connection table). Smurf attack (sending ICMP echo requests to a broadcast address with the victim’s IP as the source, causing an amplified flood of ICMP replies to the victim).

Distributed DoS (DDoS): Coordinating attack traffic from many sources (often a botnet) simultaneously to overwhelm a target. The distributed nature makes source-based blocking insufficient.

Man-in-the-Middle (MitM): Intercepting communications between two parties. ARP cache poisoning (sending gratuitous ARP responses to associate the attacker’s MAC address with a legitimate IP, causing traffic to be sent to the attacker’s machine). SSL stripping (downgrading HTTPS connections to HTTP to intercept cleartext traffic).

Web application attacks:

• SQL injection: Inserting SQL command fragments into input fields that are not properly sanitized. The injected SQL modifies the query executed against the database. Used for unauthorized data access, authentication bypass, and data destruction.
• Cross-site scripting (XSS): Injecting malicious JavaScript into trusted web pages. When another user loads the page, the script executes in their browser, potentially stealing session cookies or redirecting to attacker-controlled sites.
• Cross-site request forgery (CSRF): Tricking an authenticated user’s browser into sending unintended requests to a trusted site. Exploits the trust a site has in the user’s authenticated session.
• Command injection: Inserting operating system commands into input fields that are passed to a shell. Allows arbitrary command execution on the server.

Endpoint-based attacks:

• Buffer overflow: Writing data beyond the boundaries of an allocated buffer to overwrite adjacent memory, potentially redirecting code execution to attacker-supplied shellcode.
• Command-and-Control (C2): Compromised systems beaconing outbound to attacker infrastructure for instructions. C2 traffic is often disguised as legitimate protocols (HTTP, HTTPS, DNS) to evade detection.
• Ransomware: Encrypts victim files and demands payment for decryption keys. Often combines data exfiltration with encryption for double-extortion leverage.
• Rootkit: Malware that modifies the OS to hide its presence from standard detection tools by subverting system calls, file listings, and process enumeration.

Evasion and Obfuscation Techniques

The CCNACBR exam tests how attackers reduce monitoring visibility:

Encryption: Attackers encrypt C2 communications and payloads to prevent payload-based detection. DPI cannot inspect encrypted payloads without SSL interception. Traffic metadata (volume, timing, destination) may still reveal anomalies even when the payload is encrypted.

Tunneling: Encapsulating malicious traffic inside permitted protocols. DNS tunneling encodes data within DNS queries and responses (DNS is rarely blocked outbound). HTTPS tunneling hides C2 inside normal HTTPS traffic to avoid port-based blocking.

Fragmentation: Splitting attack payloads across multiple packets to evade signature matching on any single packet. IDS systems must reassemble fragmented traffic to apply signatures accurately.

Encoding: Using base64, URL encoding, or custom encoding to disguise payload content from string-matching detection rules.

The exam tests that these techniques reduce specific monitoring tool visibility, and what analyst techniques (protocol analysis, behavioral baseline deviation, DNS query volume analysis) can still detect activity despite evasion.

Domain 3: Host-Based Analysis (20%)

Endpoint Security Technologies

Agent-based vs. agentless protection: The 200-201 CBROPS exam tests the specific advantage of agent-based protection: agents installed on endpoints provide real-time, granular visibility into process execution, file system changes, registry modifications, and network connections made by individual processes. Agentless protection queries the endpoint remotely via protocols like WMI or SSH; it is less intrusive but provides less depth and is typically limited to periodic snapshots rather than continuous monitoring.

EDR (Endpoint Detection and Response): Records continuous endpoint activity at the process, file, network, and registry levels. Enables SOC analysts to query historical endpoint data, identify attack indicators, trace lateral movement, and remotely isolate or remediate compromised endpoints. The CCNACBR exam positions EDR as more capable than traditional antivirus software because it provides visibility into behavior, not just file signatures.

Host-based IDS/IPS (HIDS/HIPS): Monitors operating system calls, file system integrity, and network connections on a single endpoint. Can detect attacks that network-layer monitoring misses entirely because they never generate external traffic (privilege escalation, insider threat, local malware execution).

Windows OS Artifacts

Windows artifacts are a high-frequency topic in the CCNACBR exam’s Host-Based Analysis domain. SOC analysts must know where evidence lives on a Windows system.

Windows Registry: A hierarchical database storing operating system and application configuration. Attackers frequently use registry keys for persistence. The most commonly abused keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run execute programs at user logon or system startup, respectively. The exam tests that finding unfamiliar entries in these keys is an indicator of persistence-focused malware.

Windows Event Logs: The CBROPS exam tests specific Windows Event IDs:

• 4624: Successful account logon. The logon type field distinguishes interactive (type 2), network (type 3), and service (type 5) logons.
• 4625: Failed account logon. High frequency from a single source IP is an indicator of brute force.
• 4688: A new process has been created. Records the parent process, the new process name, and the command line arguments. Critical for detecting unusual process spawning (cmd.exe spawned by a web server process, for example).
• 4698: A scheduled task was created. Attackers use scheduled tasks for persistence.
• 4720: A user account was created. Unexpected account creation is an indicator of lateral movement or persistence.

Prefetch files: Located in C:\Windows\Prefetch\. Windows creates a prefetch file the first time an executable runs, recording the program name, run count, and last run time. Prefetch files persist after the executable is deleted, making them valuable evidence that a program was executed, even if an attacker attempts to cover tracks by deleting the malware file.

Browser artifacts: Browser history, cookies, cached web content, and download records are stored in user profile directories. Browser artifacts can establish what websites a user or malware visited and what files were downloaded.

Memory artifacts (volatile data): Running processes, active network connections, clipboard contents, and decrypted credentials exist only in RAM and are lost when the system is powered off. The CBROPS exam tests that volatile data must be collected first in digital forensics because it is the most fragile evidence.

Linux OS Artifacts

System logs in /var/log: Authentication events are logged to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (Red Hat/CentOS). Failed SSH logins, sudo usage, and su commands all appear in authentication logs.

bash history: ~/.bash_history records commands typed in the bash shell. Attackers sometimes delete or clear this file to remove evidence, but the deletion itself may be logged. The CBROPS exam tests bash history as an artifact that reveals attacker commands and the clearing of the history file as an anti-forensics indicator.

/etc/passwd and /etc/shadow: /etc/passwd contains user account information (username, UID, GID, home directory, shell). /etc/shadow contains hashed passwords and is readable only by root. Attackers who obtain a copy of /etc/shadow can perform offline password hash cracking.

Cron jobs: Scheduled tasks in /etc/cron.daily/, /etc/cron.hourly/, /var/spool/cron/crontabs/. Attackers use cron for persistent backdoor execution. Reviewing cron configurations for unfamiliar entries is a standard step in Linux host investigation.

File Types and Malware Analysis

Windows PE (Portable Executable) format: .exe, .dll, .sys, and .scr files are PE format. PE header analysis reveals: compilation timestamp (can indicate when malware was compiled), imported DLLs (functions the executable calls at runtime reveal intended behavior), section names and characteristics (packed or obfuscated executables show unusual section entropy). The CCNACBR exam tests what PE header analysis reveals to an analyst investigating suspicious executable files.

Malware categories in the exam tests:

• Virus: Attaches to and modifies legitimate files. Requires execution of the host file to activate and spread.
• Worm: Self-replicating without a host file. Spreads autonomously across networks.
• Trojan: Disguises itself as legitimate software. Does not self-replicate. Requires the user to execute it.
• Rootkit: Hides its presence by modifying the operating system. Subverts normal detection tools.
• Ransomware: Encrypts files and demands payment. May also exfiltrate data before encryption (double extortion).
• Spyware: Monitors user activity and exfiltrates information silently.
• Adware: Delivers unwanted advertisements; may also collect browsing data.

Disk images in forensics: Creating a forensic image (bit-for-bit copy) of a storage device preserves evidence for analysis without modifying the original. The CBROPS exam tests that investigators work with images, not the original media, to maintain evidence integrity.

Domain 4: Network Intrusion Analysis (20%)

Protocol Headers and Network Traffic Analysis

The 200-201 CCNACBR exam tests candidates’ ability to interpret network protocol headers as a SOC analyst reviewing packet captures or alert data.

Ethernet frame: Destination MAC, Source MAC, EtherType. MAC addresses identify Layer 2 devices. EtherType identifies the Layer 3 protocol (0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6).

IPv4 header fields in the exam tests:

• Time to Live (TTL): Decrements at each router hop. Initial TTL values (128 for Windows, 64 for Linux, 255 for network devices) can indicate the operating system of the source. A TTL of 1 on a received packet typically indicates a local network sender.
• Protocol field: Identifies the Layer 4 protocol (6 = TCP, 17 = UDP, 1 = ICMP).
• Flags: Used for fragmentation control. The DF (Don’t Fragment) bit, when set, prevents router fragmentation.
• Identification field: Used to reassemble fragmented packets. Attackers abusing fragmentation for evasion generate fragments with matching identification values.

TCP header fields:

• SYN, ACK, FIN, RST flags: The three-way handshake is SYN → SYN-ACK → ACK. Connection termination is FIN → FIN-ACK → ACK. RST terminates a connection abruptly. A large volume of SYN packets without corresponding SYN-ACKs indicates a SYN flood DoS attack.
• Sequence and Acknowledgment numbers: Used to track byte ordering and detect TCP session hijacking attempts.

ICMP: Used for network diagnostic messages (echo request/reply, destination unreachable, time exceeded). The CBROPS exam tests ICMP in the context of ping of death (malformed oversized ICMP), ICMP tunneling (encoding data in ICMP payload for covert communication), and ICMP unreachable messages as indicators of port scanning responses.

DNS: Port 53 UDP (queries) and TCP (large responses/zone transfers). DNS queries include the queried name and query type (A, AAAA, MX, TXT, PTR). The CBROPS exam tests DNS in the context of DNS tunneling (unusually long subdomain queries that encode data) and DNS as a C2 channel.

HTTP/HTTPS headers: The exam tests HTTP request methods (GET, POST, PUT, DELETE) and how malicious activity appears in HTTP logs: unusual User-Agent strings, large POST bodies to unexpected URIs, repeated 4xx responses indicating reconnaissance, and 200 responses to unexpected file types (web shell execution).

PCAP Analysis with Wireshark

The 200-201 CCNACBR exam tests candidates’ ability to extract information from packet capture data.

Identifying protocol in Wireshark: The Protocol column identifies the captured protocol. Display filters allow analysts to isolate specific protocols, source/destination IPs, or port numbers. http, dns, tcp.flags.syn==1, ip.src==10.0.0.1 are example Wireshark display filters that the CBROPS exam may reference.

Extracting files from TCP streams: Wireshark can reassemble TCP streams and export transferred files (HTTP downloads, FTP transfers, SMTP attachments). The CBROPS exam tests that file extraction from PCAP enables malware sample recovery even after the file is deleted from the host.

Identifying intrusion elements in a PCAP: The exam tests how to identify key elements of an intrusion from a PCAP file: the attacker’s source IP and port, the target destination, the protocol used, the payload content (for unencrypted traffic), and the sequence of events.

Regular Expressions for Pattern Matching

The CCNACBR exam tests the ability to interpret basic regular expressions used in IDS rules and SIEM detection logic.

Basic regex patterns:

• . matches any single character.
• * matches zero or more of the preceding character.
• + matches one or more of the preceding character.
• ? matches zero or one of the preceding character.
• [abc] matches any single character listed in the brackets.
• \d matches any digit (0-9).
• ^ anchors to the start of a string.
• $ anchors to the end of a string.

The 200-201 CBROPS exam presents a regular expression and asks what pattern it would match, or presents a pattern of activity and asks what regex expression would detect it in a log search or IDS rule. Knowing how to read and interpret regex (not necessarily write complex expressions from scratch) is the skill tested.

Network Artifacts and Intrusion Indicators

5-tuple in PCAP analysis: Source IP, destination IP, source port, destination port, and protocol identify each flow. The CBROPS exam tests using the 5-tuple to isolate individual flows within a large capture file.

Identifying C2 beaconing patterns: C2 traffic often shows regular time intervals (beaconing at fixed intervals), consistent packet sizes, outbound connections to external IPs on unusual ports, or connections to recently registered/low-reputation domains. The exam tests how an analyst recognizes beaconing behavior in NetFlow or PCAP data.

Port scanning indicators: A single source IP attempting connections to many destination ports on the same host (vertical scan) or to the same port across many hosts (horizontal scan). Large numbers of TCP RST or ICMP unreachable responses to a scanning source are indicators visible in firewall or NetFlow logs.

Domain 5: Security Policies and Procedures (15%)

Incident Response: NIST SP 800-61

The CBROPS exam tests the incident response lifecycle defined in NIST Special Publication 800-61 (Computer Security Incident Handling Guide). The four phases and what each contains:

Preparation: Establishing and maintaining the capability to respond. Incident response plans, playbooks, contact lists, tools, and training. Preparation happens before incidents occur.

Detection and Analysis: Identifying and confirming that a security incident has occurred. Triaging alerts, correlating events, determining severity, and documenting initial findings. The exam tests the analyst’s role in this phase: reviewing SIEM alerts, examining logs, and escalating confirmed incidents.

Containment, Eradication, and Recovery:

• Containment: Limiting the damage. Short-term containment (isolating a compromised host) followed by long-term containment (applying patches or changes to prevent reinfection).
• Eradication: Removing the root cause. Deleting malware, removing attacker-created accounts, patching the exploited vulnerability.
• Recovery: Restoring systems to normal operation. Monitoring restored systems for signs of re-infection.

Post-Incident Activity: Lessons learned review, updating procedures and detection rules based on what the incident revealed. The after-action review is how the SOC improves its future detection and response.

Digital Forensics: NIST SP 800-86

NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) defines evidence collection priorities for digital forensics.

Order of volatility: Evidence must be collected from most volatile to least volatile to preserve the most ephemeral data before it is lost:

1. CPU registers and cache (lost immediately on power cycle)
2. RAM (running processes, network connections, decrypted credentials — lost on shutdown)
3. Network connections and routing tables (current state, changes frequently)
4. Disk (persistent, survives shutdown)
5. Removable media
6. Remote logging servers (most persistent)

The CBROPS exam tests this order and why it matters: memory must be captured before pulling a power cord.

Evidence preservation: The forensic process requires maintaining data integrity. Cryptographic hashing (MD5, SHA-256) of collected evidence proves that the collected data has not been altered after collection. The hash of the original evidence is computed immediately after collection and compared at each subsequent step. Any difference indicates tampering or corruption.

Chain of custody: Documents who collected evidence, when, how, and who had possession at each subsequent point. Required to maintain admissibility of evidence in legal proceedings.

SOC Metrics and Scope Analysis

The CCNACBR exam tests four key SOC performance metrics and what each measures:

Time to Detect (TTD): How long between the start of an attack and when the SOC becomes aware of it. Shorter TTD means the organization detected the threat earlier in the attack lifecycle.

Time to Contain (TTC): How long between detection and successful containment of the incident. Shorter TTC limits the damage an attacker can cause after detection.

Time to Respond (TTR): How long between detection and the start of an active response effort. Measures SOC responsiveness.

Time to Control (TTCon): How long until the threat is fully neutralized and the organization has regained control of affected systems.

The exam tests these as a framework for measuring SOC effectiveness. Organizations that struggle with long TTD have detection gaps. Long TTC typically indicates insufficient automation or poor playbook clarity.

Cyber Kill Chain Model

Lockheed Martin’s Cyber Kill Chain defines the stages of a targeted cyberattack. The CBROPS exam tests which stage a described activity belongs to:

1. Reconnaissance: Gathering information about the target (OSINT, scanning, social media research).
2. Weaponization: Creating the attack tool (pairing malware with an exploit, crafting a phishing document).
3. Delivery: Transmitting the weapon to the target (phishing email, watering hole, USB drop).
4. Exploitation: Triggering the exploit on the target system (exploiting a vulnerability, executing the malicious document).
5. Installation: Establishing a persistent foothold (installing backdoor, creating scheduled task, modifying registry run keys).
6. Command and Control (C2): Establishing communication between the attacker and the compromised system.
7. Actions on Objectives: Achieving the attacker’s goal (data exfiltration, data destruction, lateral movement, ransomware deployment).

The CCNACBR exam tests at which Kill Chain stage specific activities occur. Exfiltration of data occurs at Actions on Objectives (stage 7), not at Delivery or Exploitation. Installing a backdoor occurs at Installation (stage 5). A phishing email arriving in a victim’s inbox represents Delivery (stage 3).

Diamond Model of Intrusion Analysis

The Diamond Model provides a framework for intrusion analysis using four core features connected in a diamond shape:

Adversary: The threat actor or group behind the attack. May be unknown initially; is developed through attribution research.

Infrastructure: The technical infrastructure the adversary uses (C2 servers, IP addresses, domains, email accounts).

Capability: The tools, techniques, and procedures (TTPs) the adversary employs (specific malware, exploit framework, social engineering technique).

Victim: The target organization, system, or individual.

Analysts use the Diamond Model to organize intelligence about an intrusion: connecting what they know about the adversary’s infrastructure and capabilities to develop better detection and attribution. The CCNACBR exam tests how analysts use the Diamond Model to classify and understand intrusion events.

Asset, Configuration, Vulnerability, and Patch Management

Asset management: Maintaining an accurate inventory of hardware, software, and data assets. You cannot protect what you do not know exists. Asset management underpins all other security programs.

Configuration management: Establishing and maintaining secure baseline configurations for all systems. Deviation from baseline is itself a security indicator.

Vulnerability management: Identifying, prioritizing, and remediating known vulnerabilities. CVSS scoring guides prioritization. The CBROPS exam tests the vulnerability management lifecycle: scan, assess, prioritize, remediate, verify.

Patch management: Systematically applying software updates to address known vulnerabilities. Patch management reduces attack surface by eliminating known exploitable vulnerabilities.

Protected data categories the exam tests:

• PII (Personally Identifiable Information): Data that identifies an individual.
• PCI-DSS (Payment Card Industry Data Security Standard): Cardholder data protection standard.
• PHI (Protected Health Information): Health data protected by HIPAA.
• Intellectual Property: Proprietary business information, trade secrets, patents.

What to Expect on Exam Day

• 120 minutes for the full exam. Budget time carefully: scenario-based questions require more reading than single-concept questions.
• Questions include multiple-choice (single correct answer), multiple-select (choose N of M), drag-and-drop (matching concepts to categories or placing items in correct sequence), and scenario-based (exhibit shown followed by questions about the scenario).
• Expect at least several PCAP exhibit questions where Wireshark output is displayed and you must identify the attack type, the intrusion element, or the data being extracted.
• Kill Chain stage classification questions appear regularly. Know all seven stages and a representative activity for each.
• True/false positive/negative classification scenarios appear across both Security Monitoring and Security Policies domains.
• Cisco scaled scoring: passing score is not publicly disclosed as a fixed number. Pass/fail status available immediately.

5 Study Tips for Cisco 200-201 CBROPS CCNACBR

• Tip 1: Allocate preparation time proportional to domain weights. Security Monitoring at 25% deserves significantly more study time than Security Policies and Procedures at 15%. Many candidates study all five domains equally and underperform in the domains that matter most.
• Tip 2: Study each monitoring technology through the lens of what data it produces and what it cannot see. For every tool (firewall, IDS/IPS, SIEM, NetFlow, PCAP), know the data type it generates, its blind spots (encryption, NAT), and how inline differs from tap/passive deployment.
• Tip 3: Memorize the Cyber Kill Chain stages by name and a concrete example of a defender or attacker action at each stage. Kill Chain classification questions appear in both Security Monitoring and Security Policies domains.
• Tip 4: Practice true positive / false positive / true negative / false negative classification with realistic SOC scenarios. The exam does not ask for definitions — it presents a scenario and asks you to classify the outcome and identify the consequence.
• Tip 5: Practice with Cert Empire’s 200-201 CBROPS CCNACBR exam questions in scenario format under 120-minute timed sessions, with exhibit-based questions and domain-weighted question distribution matching the actual CCNACBR exam blueprint.

Best Study Resources

• Cert Empire 200-201 CBROPS CCNACBR exam questions PDF and practice simulator (June 2026 v1.2 aligned edition).
• Official Cisco 200-201 CCNACBR exam topics (learningnetwork.cisco.com/s/ccnacbr-exam-topics).
• Cisco Official Cert Guide: Cisco Cybersecurity Operations Fundamentals CBROPS 200-201 by Omar Santos (Cisco Press).
• Cisco U. learning path for Cisco Certified CyberOps Associate.
• NIST SP 800-61 (Incident Handling) and NIST SP 800-86 (Forensics Integration) — both free from csrc.nist.gov.
• Wireshark documentation and practice PCAPs for network intrusion analysis preparation.

Career Opportunities After 200-201 CBROPS CCNACBR

• SOC Analyst (Tier 1 / Tier 2)
• Cybersecurity Analyst
• Security Operations Engineer
• Incident Responder (Junior)
• Network Security Analyst
• Threat Intelligence Analyst (Entry Level)

The Cisco Certified CyberOps Associate is the recognized entry point into security operations roles. Entry-level SOC analysts with this credential earn between USD 60,000 and USD 90,000. The credential opens a clear path toward the Cisco Certified CyberOps Professional (350-201 CBRCOR) for analysts advancing toward senior SOC, incident response, and threat hunting roles.

Certifications to Pursue After 200-201 CBROPS

• Cisco 350-201 CBRCOR: Performing Cybersecurity Using Cisco Security Technologies — the Professional-level CyberOps exam for senior SOC analysts, threat hunters, and incident responders.
• CompTIA CySA+: Complementary vendor-neutral cybersecurity analyst certification.
• CompTIA Security+: Foundational security certification recognized across industries.
• GIAC GCIH (Certified Incident Handler): Specialized incident handling credential.
• EC-Council CEH: For those moving toward ethical hacking alongside defensive operations.

How 200-201 CBROPS CCNACBR Compares to Adjacent Cisco Security Certifications

The 200-201 CCNACBR is the only Cisco certification focused specifically on defensive security operations. All other Cisco security certifications focus on configuring and implementing security technologies. The CBROPS/CCNACBR tests how a SOC analyst uses those technologies to detect, analyze, and respond to threats.

Why Candidates Choose Cert Empire for 200-201 CBROPS CCNACBR Preparation

✔ Monitoring technology visibility questions at data-layer depth. Our CBROPS CCNACBR questions test what each tool sees and cannot see (DPI vs. stateful inspection, NetFlow vs. PCAP, inline IPS vs. tap IDS) rather than just what tools are named. These are the questions that distinguish candidates who understand the technology from those who know the terminology.

✔ True/false positive/negative classification scenarios. Our question bank presents realistic SOC alert scenarios and requires candidates to classify the outcome and identify the consequence of each error type, matching the real CCNACBR exam question format.

✔ Kill Chain stage classification questions across all seven stages. We test specific activities against all seven Kill Chain stages, including the frequently confused Installation vs. Exploitation vs. Actions on Objectives distinctions.

✔ PCAP and network artifact questions with exhibit-style formatting. Our simulator includes questions that present packet-level data or log excerpts and ask candidates to identify attack types, intrusion elements, and protocol anomalies, matching the exhibit-based question format the real 200-201 CBROPS exam uses.

✔ Domain-weighted question distribution aligned to the CCNACBR blueprint. Security Monitoring accounts for 25% of our question bank, Host-Based Analysis and Network Intrusion Analysis each account for 20%, Security Concepts for 20%, and Security Policies for 15%, exactly matching the official exam domain weights.

✔ Practice under real exam conditions with the Cert Empire Exam Simulator. Our 200-201 CBROPS CCNACBR simulator runs full 120-minute timed sessions with domain-level performance tracking so you know exactly which SOC analyst knowledge areas need strengthening before exam day.

✔ Instant access, 90-day free updates, and 24/7 support. As Cisco updates the 200-201 CCNACBR v1.2 exam objectives, your materials update automatically. Our support team is available around the clock.

✔ Backed by a full money-back guarantee. If our exam questions do not help you pass, we refund your purchase with no conditions.

Readiness Check

1. A SOC analyst receives two simultaneous alerts. Alert A: an IDS signature matched a known SQL injection pattern against the web application on port 443. Alert B: the same web application shows an unusual spike in database query volume over the past 30 minutes. The IDS is in passive tap mode. Classify each alert (true positive, false positive, possible false positive, corroborating evidence), explain what the analyst should do next with each alert, and explain what additional tool would provide the payload-level visibility needed to confirm whether the HTTPS traffic contains the SQL injection attempt.

2. A NetFlow analysis shows a single internal host (192.168.10.55) initiating connections to an external IP (198.51.100.12) on TCP port 443 exactly every 300 seconds, consistently for 72 hours. Each session transfers approximately 1 KB of data. No other hosts show this pattern. Using only the NetFlow metadata, identify what attack technique this pattern most likely represents, explain what additional evidence would confirm your hypothesis, and state what information NetFlow cannot provide about these sessions.

3. A Windows forensics investigation reveals a registry entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a file in C:\Users\jsmith\AppData\Local\Temp\svchost32.exe. The file is no longer present on disk, but a Windows Prefetch file exists for SVCHOST32.EXE-B3C4D1A2.pf. What does each of these two artifacts indicate independently, and what is the combined conclusion about what happened on this system?

4. A network analyst examines a PCAP file and observes DNS queries from an internal host containing subdomains like dGhpcy1pcy1leGZpbA==.attacker.com, dHJhdGlvbi1kYXRh.attacker.com, and YmFzZTY0LWVuY29kZWQ=.attacker.com. The queries are sent at 5-second intervals. Identify what attack technique is being used, what the subdomain strings represent (describe their format), and at which stage of the Cyber Kill Chain this activity falls.

5. A SOC receives an alert indicating that a host has connected to a newly registered domain (registered 3 days ago) flagged as suspicious by threat intelligence. The analyst investigates and finds that the connection was made by the IT team’s automated patch management system checking a vendor update server that recently migrated to a new domain. Classify this outcome (true positive, false positive, true negative, or false negative), explain the impact this classification type has on the SOC, and identify what process change would prevent this alert from recurring unnecessarily.

FAQS

What is the Cisco 200-201 CBROPS CCNACBR exam? 

The Cisco 200-201 is the Understanding Cisco Cybersecurity Operations Fundamentals exam, designated CBROPS (CBROPS is the course designation) and CCNACBR (the exam designation in Cisco’s updated naming). It is the sole exam required to earn the Cisco Certified CyberOps Associate certification. It validates the knowledge and skills needed for a Tier 1 or Tier 2 Security Operations Center analyst role.

What is the difference between CBROPS and CCNACBR? 

They refer to the same exam. CBROPS (CyberOps Fundamentals) is the course and original exam designation used when the exam launched in 2020. CCNACBR is the updated exam designation that Cisco now uses for this credential as part of the broader CCNA branding family. The exam content (v1.2 blueprint) is the same under both names.

What is the highest-weighted domain on the 200-201 exam? 

Security Monitoring at 25%. This domain covers security monitoring technologies, what data each produces, inline versus tap deployment, true/false positive/negative classification, network attack types, and evasion techniques. Candidates who underestimate this domain’s depth perform consistently below expectation on their first attempt.

What is the difference between IDS and IPS on the CCNACBR exam? 

An IDS (Intrusion Detection System) in passive/tap mode receives a copy of traffic, analyzes it, and generates alerts. It cannot block traffic and creates no single point of failure. An IPS (Intrusion Prevention System) in inline mode sits in the traffic path, analyzes all traffic, and can block matching flows in real time. If an inline IPS fails without a bypass mechanism, traffic stops flowing. The CBROPS exam tests both what each does and the deployment risk trade-off between them.

What NIST publications does the 200-201 exam reference? 

NIST SP 800-61 (Computer Security Incident Handling Guide) for incident response procedures and lifecycle, and NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) for digital evidence collection order (order of volatility), data integrity, preservation, and volatile data collection.

How does the CBROPS exam test the Cyber Kill Chain? 

The CCNACBR exam presents descriptions of attacker or defender activities and asks at which of the seven Kill Chain stages (Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, Actions on Objectives) they fall. Exam questions also ask candidates to classify intrusion events using both the Kill Chain Model and the Diamond Model of Intrusion Analysis.

What is the cost and format of the Cisco 200-201 exam? 

The exam costs approximately $300 USD and is 120 minutes in length. It is delivered through Pearson VUE (online proctored or at a test center). The format includes multiple-choice, drag-and-drop, and scenario-based questions. The certification is valid for 3 years.

Related Certifications Worth Exploring

SOC analysts who earn the CyberOps Associate credential and want to advance into senior analyst, threat hunting, and incident response roles will find our Cisco 350-201 CBRCOR CyberOps Professional exam questions page covers the Professional-level exam that builds directly on the 200-201 CBROPS foundation with advanced security operations, automation, and threat analysis content. For analysts also pursuing vendor-neutral credentials alongside the Cisco path, our CompTIA CySA+ exam questions page covers the complementary cybersecurity analyst certification that many CyberOps Associate holders pursue for broader industry recognition.