Free 200-201 Practice Test Questions and Answers (2026)

The primary benefit of asymmetric cryptography is its ability to facilitate secure data transfer over untrusted networks. It uses a mathematically linked key pair: a public key for encryption and a private key for decryption. This system solves the fundamental challenge of secure key distribution that exists with symmetric cryptography. By allowing the public key to be shared openly, it enables secure key establishment (e.g., Diffie-Hellman) and digital signatures for authentication and non-repudiation. These capabilities are foundational for protocols like TLS/SSL, which secure modern communications and data transfers.

A. decrypts data with one key

This describes symmetric cryptography. Asymmetric cryptography uses a different key (the private key) for decryption than the one used for encryption (the public key).

B. fast data transfer

This is incorrect. Asymmetric cryptography involves complex mathematical operations, making it significantly slower than symmetric cryptography. It is a known drawback, not a benefit.

D. encrypts data with one key

This describes symmetric cryptography, where the same key is used for both encryption and decryption. Asymmetric cryptography uses a public key to encrypt.

1. Official Vendor Documentation (Cisco Press):

Santos

O. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. In Chapter 4

"Cryptography

" the section "Asymmetric Encryption" states

"Asymmetric algorithms use a pair of keys to encrypt and decrypt data... The public key can be freely distributed

while the private key is kept secret... Asymmetric encryption algorithms are essential for data confidentiality

integrity

authentication

and nonrepudiation." This directly supports that its function is to enable secure communication.

2. Peer-reviewed Academic Publications (NIST):

National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-57 Part 1 Rev. 5: Recommendation for Key Management. In Section 2.1.3

"Asymmetric (Public Key) Cryptography

" it is explained that "Public-key cryptography is a source of the security services of confidentiality

data integrity

authentication

and non-repudiation." These services are the components of secure data transfer.

3. University Courseware:

Katz

J.

& Lindell

Y. (n.d.). Introduction to Modern Cryptography (Courseware based on the textbook). University of Maryland. Chapter 10

"Public-Key Cryptography

" introduces the concept by highlighting the key-distribution problem in the symmetric-key setting and explains how public-key systems solve this

thereby enabling secure communication between parties who have never met.

Role-based access control (RBAC) is designed to simplify security administration in large, complex organizations. By assigning permissions to roles (e.g., 'Accountant', 'Network Admin') rather than to individual users, it becomes highly scalable and manageable, making it ideal for enterprises that may be geographically diverse. In contrast, rule-based access control applies policies (rules) based on specific conditions, such as source/destination IP addresses or time of day. While it can be complex, it is often implemented in a straightforward manner for smaller or simply structured environments where a few static rules can effectively govern access without the overhead of defining a complete role hierarchy.

A. The simplicity of a rule-based system is not guaranteed; a complex set of rules can be very difficult to manage and audit.

C. Rule-based access control is generally more granular, not less, as it can evaluate multiple attributes (like time, location, device) beyond just a user's job function.

D. The primary administrative benefit of role-based access control is realized in large, complex organizations, not small workgroups where direct permission assignment might be simpler.

1. Official Vendor Documentation: Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 2

"Security Concepts

" the section "Access Control Models" explains

"In large organizations with hundreds or thousands of employees

assigning permissions to each individual is a very difficult task. Role-BAC simplifies the administration of permissions." This supports the suitability of RBAC for large

diverse workgroups.

2. Peer-reviewed Academic Publications: Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. In Proceedings of the 15th National Computer Security Conference (pp. 554-563). This foundational NIST paper establishes that RBAC is intended to "reduce the complexity and cost of security administration in large networked applications." This aligns with its use in large and diverse organizations.

3. University Courseware: Myers

A. C.

& Schneider

F. B. (2021). CS 5430: System Security

Lecture 7: Access Control. Cornell University. The lecture notes state that a key motivation for RBAC is to "Simplify management

especially in large organizations." This contrasts with simpler models that may be sufficient for less complex structures.

Wireshark can re-assemble application-layer payload that crosses multiple TCP segments and expose each complete object through File → Export → Objects → HTTP (or Follow TCP Stream).

In the capture shown, only frames 7, 14, and 21 carry the initial TCP segments of three separate HTTP responses whose headers include 200 OK, Content-Type, and a non-zero Content-Length. Because each of those responses contains an entire file that can be re-assembled from their associated TCP streams, Wireshark lists exactly three extractable objects—one beginning at each of those frames.

B. Frame 14 also begins an extractable object; omitting it leaves only two files.

C. Frames 16, 18, 19 are continuation segments; they lack HTTP response headers and cannot start a new exportable file.

D. Only three specific frames start complete objects; the remaining frames 8–20 are data or ACKs, not new files.

1. Wireshark User’s Guide

sec. 9.7 “Exporting Objects from a Capture”; note on “Each listed object corresponds to the first packet of the HTTP response carrying full headers.” (https://www.wireshark.org/docs/wsughtmlchunked/)

2. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

Ch. 10 “Using Wireshark for Network Forensics”

pp. 310-312: discussion and example of identifying frames that initiate an HTTP object and exporting it.

3. MIT OpenCourseWare 6.858 Computer Systems Security

Lecture 20 notes

p. 4: explanation of TCP stream re-assembly and file recovery with Wireshark.

A timing attack, in the context of network intrusion evasion, involves deliberately slowing down the rate of an attack to avoid detection. Security monitoring systems, such as an Intrusion Detection System (IDS), often use thresholds and time-based correlation to identify malicious patterns (e.g., a port scan). By sending packets or performing actions very slowly over an extended period, an attacker can make the malicious activity appear as normal, low-priority traffic, thus staying "under the radar" of the detection mechanism. This is also commonly referred to as a "low-and-slow" attack.

B. traffic fragmentation: This technique involves splitting a malicious payload into multiple smaller packets, making it difficult for an IDS to reassemble and inspect the full data stream for a signature. The primary mechanism is division, not speed reduction.

C. resource exhaustion: This is a type of denial-of-service attack that aims to overwhelm a system by consuming all its resources (CPU, memory, etc.). It is characterized by high-volume traffic, the opposite of a slow attack.

D. tunneling: This method encapsulates malicious traffic within a legitimate protocol (e.g., HTTPS, DNS) to bypass inspection. The evasion relies on encryption or protocol masking, not on the timing of the actions.

---

1. Official Vendor Documentation (Cisco Press):

Santos

O.

& Stuppi

J. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 17

"Network Intrusion Analysis

" the section "Evasion Techniques" describes timing attacks: "In a timing attack

the attacker sends packets at a very slow rate to evade detection. For example

a port scanner can be configured to send a single packet every few minutes to a different port on the target host." (p. 461). This directly supports the definition used in the correct answer.

2. Peer-reviewed Academic Publications:

Lippmann

R.

& Cunningham

R. K. (2000). Improving Intrusion Detection Systems Using Keyword Selection and Neural Networks. MIT Lincoln Laboratory. In the section on "Attack and Evasion Taxonomy

" the paper discusses attacks that are "spread out over time to avoid detection by IDSs that look for many similar events in a short time window." This describes the principle of a timing attack. (Section 2.2

"Evasion").

3. Official Vendor Documentation (Cisco):

Cisco. (2016). Cisco ASA 5500-X Series Next-Generation Firewalls: Intrusion Prevention System (IPS) Evasion Techniques. Cisco White Paper. The document discusses various evasion techniques that IPS systems must counter. It implicitly covers timing attacks by explaining how IPS systems use statefulness and correlation over time to detect "low and slow" reconnaissance and attacks that would otherwise be missed. (Section: "Stateful Inspection and Protocol Awareness").

NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide," defines a four-phase lifecycle for incident response. These phases are: (1) Preparation; (2) Detection & Analysis; (3) Containment, Eradication, & Recovery; and (4) Post-Incident Activity. The options "detection and analysis" and "post-incident activity" directly correspond to the second and fourth phases of this officially documented process. These phases represent the core activities of identifying an incident and learning from it after it has been resolved.

C. vulnerability management: This is a continuous security process focused on identifying and mitigating vulnerabilities, which is part of the "Preparation" phase, not a distinct incident response phase itself.

D. risk assessment: This is a foundational security activity that informs the overall security program and the "Preparation" phase, but it is not a reactive phase within the incident response lifecycle.

E. vulnerability scoring: This is a specific sub-process within vulnerability management used to prioritize vulnerabilities (e.g., CVSS), not a major phase of the incident response process.

1. National Institute of Standards and Technology (NIST). (2012). Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide. Section 2.3

"Incident Response Life Cycle

" Page 7. "The life cycle has four phases: 1. Preparation

2. Detection and Analysis

3. Containment

Eradication

and Recovery

4. Post-Incident Activity."

2. Santos

O.

Stuppi

J.

& Pirc

J. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. Chapter 16

"Incident Response

" section "NIST Incident Response Life Cycle

" Page 466. This section explicitly lists and describes the four phases from NIST SP 800-61r2

including "Detection and Analysis" and "Post-Incident Activity."

The 5-tuple is a standard, fundamental concept in TCP/IP networking used to uniquely identify a communication session or "flow" between two endpoints. It consists of five specific data points from the packet headers: the protocol (e.g., TCP, UDP), the source IP address, the source port number, the destination IP address, and the destination port number. When analyzing network logs, such as NetFlow data, security analysts use this exact combination to isolate and track specific conversations. This allows them to distinguish a malicious actor's traffic from all other legitimate network activity and trace it to the compromised host.

A: This option includes non-standard 5-tuple elements like "event name" and "log source," which describe the log entry itself, not the network flow.

C: This option is more representative of an authentication or application event log, lacking essential network identifiers like protocol and port numbers.

D: This option incorrectly replaces the critical source and destination port numbers with "log source" and "host name," which are not part of the 5-tuple definition.

1. Official Vendor Documentation: Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 13

"Network Intrusion Analysis

" the section on NetFlow explicitly defines a network flow as a unidirectional sequence of packets that share the following five values: source IP address

destination IP address

source port

destination port

and Layer 3 protocol type. This collection of values is commonly referred to as the 5-tuple.

2. University Courseware: Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 3

"Transport Layer

" Section 3.2

"Multiplexing and Demultiplexing

" the text explains that a TCP socket is identified by a four-tuple (source IP

source port

destination IP

destination port). The addition of the protocol field (e.g.

TCP or UDP) completes the 5-tuple that uniquely identifies the session.

3. Peer-reviewed Academic Publications: Estan

C.

& Varghese

G. (2003). New directions in traffic measurement and accounting. In Proceedings of the 2003 conference on Applications

technologies

architectures

and protocols for computer communications (pp. 323-336). ACM. DOI: https://doi.org/10.1145/863955.863998. This foundational paper on network traffic analysis discusses flows

which are traditionally defined by the 5-tuple (source/destination addresses

source/destination ports

and protocol).

To definitively determine if data exfiltration has occurred, an investigator must be able to inspect the actual content of the network traffic. Full packet capture (PCAP) is the only data type among the options that records the entire packet, including the payload. The payload contains the raw data being transmitted, such as files, emails, or database contents. By analyzing the payload, an investigator can reconstruct the transferred data and confirm if it was sensitive information being stolen, thus verifying exfiltration. Other data types only provide metadata about the communication, not the content itself.

B. NetFlow data: Provides traffic metadata like source/destination IPs, ports, and byte counts, but it does not capture the packet payload, making it impossible to see the actual data.

C. session data: Represents a summary of a conversation between two endpoints. Like NetFlow, it is metadata and lacks the payload needed to inspect the content.

D. firewall logs: Record decisions to permit or deny traffic based on rules. They log connection details (IPs, ports) but not the content of the traffic that is allowed to pass.

1. Cisco Press

Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Chapter 1

Section: "Network Security Monitoring Data". The text distinguishes between different data types

stating

"Full packet capture is a recording of all the packets that cross a point in the network... NetFlow is a protocol that provides metadata about network traffic." This highlights that only PCAP contains the full data for content analysis.

2. Cisco

Introduction to Cisco IOS NetFlow - A Technical Overview. Section: "What Is NetFlow?". This official Cisco white paper explicitly states

"NetFlow provides valuable information about network users and applications

peak usage times

and traffic routing. Cisco IOS NetFlow does not collect the data payload of the packets." This confirms that NetFlow is unsuitable for inspecting the content of exfiltrated data.

3. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 3.3.2

"Network-Based". This document discusses evidence gathering for incident response. It describes packet captures ("network sniffers") as a source for detailed analysis of network activity

which is essential for confirming the specifics of an attack like data exfiltration

whereas logs provide more summary-level information.

4. SANS Institute

Network Forensics: Tracking Hackers Through Cyberspace. Course FOR572. The course materials consistently emphasize that while flow data is useful for identifying anomalies

"full packet capture is the ultimate source of evidence" because it allows for the reconstruction of the entire data stream

which is necessary to prove what was taken during an exfiltration event.

To effectively analyze and minimize network latency, an engineer must identify two key things: where delays are occurring (bottlenecks) and what traffic is causing them.

1. Total throughput on the interface of the router: High interface utilization, where throughput approaches the link's capacity, is a primary cause of network latency due to queuing delays. Monitoring throughput helps pinpoint congested interfaces that are acting as bottlenecks.

2. NetFlow records: NetFlow provides detailed, aggregated data about traffic flows, including source/destination IPs, ports, protocols, and the volume of traffic. This information allows the engineer to understand which applications are consuming the most bandwidth and their paths through the network, enabling targeted optimization like QoS policies or traffic rerouting.

B. Routing protocol authentication failures are a specific security or stability issue, not a primary metric for analyzing general network latency and traffic movement.

C. This information relates to endpoint (server/application) performance, whereas the question specifically asks for an analysis of the network and traffic movement.

D. Deep packet capture is extremely resource-intensive and not scalable for a broad network analysis; it is better suited for deep-dive troubleshooting of a specific, pre-identified issue.

1. Official Vendor Documentation: Cisco

Cisco IOS Flexible NetFlow Configuration Guide

"Overview of Cisco IOS Flexible NetFlow". This guide states

"Flexible NetFlow facilitates the creation of more complex configurations for traffic analysis and data export... Flexible NetFlow provides valuable information about network users and applications

peak usage times

and traffic routing." This supports using NetFlow to understand traffic movement for optimization.

2. Official Vendor Documentation: Cisco

Enterprise QoS Solution Reference Network Design Guide

Chapter 2

"Enterprise QoS Overview"

Section: "Queuing and Dropping". This document explains that when a network link is congested (high throughput)

packets are placed in a queue

which "adds to the delay that a packet experiences." This directly links high throughput to latency

validating its importance in the analysis.

3. Academic Publication: Dainotti

A.

Pescape

A.

& Claffy

K. (2012). A Survey of Network Traffic Monitoring and Analysis Tools. IEEE Communications Surveys & Tutorials

14(4)

921-941. https://doi.org/10.1109/SURV.2012.010912.00046. Section III-B

"Flow-level Monitoring

" discusses how flow-based tools like NetFlow are scalable and provide the necessary visibility for traffic engineering and capacity planning

unlike resource-intensive packet-level monitoring (Option D).

The scenario describes the core principle of Discretionary Access Control (DAC). In a DAC model, the owner of a resource has the explicit authority (discretion) to decide who can access it and what permissions they have. This owner-centric approach is highly flexible and is the basis for access control in most common operating systems. Compared to more rigid models like Mandatory Access Control (MAC), DAC is generally simpler to implement and manage, which translates to easier maintenance and lower operational costs, fulfilling all requirements of the question.

A. mandatory access control, due to automate scaling: Mandatory Access Control (MAC) is not owner-based; access is determined by system-wide security labels and is not at the owner's discretion.

C. discretionary access control, due to high security: While DAC is the correct model, it is generally considered less secure than MAC because the decentralized control can lead to inconsistent policy application or errors by owners.

D. mandatory access control, due to low granularity: MAC is not an owner-based model. Furthermore, MAC systems can be highly granular, depending on the complexity of the security labeling scheme used.

1. Official Vendor Documentation (Cisco Press): Santos, O. (2020). Understanding Cisco Cybersecurity Fundamentals (200-201) Official Cert Guide. Cisco Press. In Chapter 10, "Access Control Fundamentals," the section on "Access Control Models" states, "In the DAC model, the owner of the resource specifies which subjects can access the resource... DAC is easy to implement and maintain..." This directly supports the choice of DAC for its ease of maintenance.

2. Peer-reviewed Academic Publications (NIST): National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. In Appendix D, "Glossary," Discretionary Access Control is defined as: "The access control policy is determined by the owner of an object." This confirms the owner-based responsibility described in the question.

3. University Courseware: Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE, 63(9), 1278-1308. (Widely cited foundational paper, often used in university curricula like MIT's 6.858 Computer Systems Security). Section 4.A.1, "Access Control Mechanisms," describes the principles of an access control matrix, the conceptual foundation for DAC, where entries are set at the discretion of the resource owner. This highlights the flexibility and owner-centric nature of the model. DOI: https://doi.org/10.1109/PROC.1975.9939

The exhibit displays a packet capture of an HTTP session, with the details of a specific packet expanded. The highlighted section shows the Hypertext Transfer Protocol (HTTP) headers. Among these headers, the User-Agent field is clearly visible, and its value begins with Mozilla/5.0. This header is used by the client (a web browser in this case) to identify itself to the server. The detailed view in the packet capture explicitly presents this information, making it a correct observation of what is shown.

A. There is no indication in the exhibit that the timestamps are erroneous; they appear in a standard format for packet capture software.

B. While the transport protocol is indeed TCP, this is a general statement. The detailed view focuses on the application layer (HTTP), making option C a more specific and accurate description of the highlighted content.

D. The HTTP GET request (GET / HTTP/1.1) is shown in plain text. There is no evidence of encoding applied to the request line itself.

---

1. Official Vendor Documentation (IETF RFC):

Fielding

R.

Ed.

and J. Reschke

Ed.

"RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

" June 2014. Section 5.5.3

"User-Agent

" defines this header field. It states

"The 'User-Agent' header field contains information about the user agent originating the request... This is for statistical purposes

the tracing of protocol violations

and automated recognition of user agents for the sake of tailoring responses to avoid particular user agent limitations." This confirms the presence and purpose of the User-Agent field shown in the exhibit.

2. Official Vendor Documentation (Cisco Press):

Santos

O.

Stuppi

J.

& Pirc

A. (2020). Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) 200-201 Official Cert Guide. Cisco Press. Chapter 12

"Network Intrusion Analysis

" discusses analyzing packet captures to identify traffic details. It specifically covers the examination of HTTP headers

including the User-Agent

to understand the client's characteristics

which is precisely what is shown in the exhibit.

3. University Courseware:

MIT OpenCourseWare

"6.857 Computer and Network Security

Fall 2017

" Lecture 14: "Web Security." The course materials discuss the HTTP protocol

including the headers sent by a client in a request. The User-Agent header is explained as a standard field that identifies the browser and operating system

aligning with the information presented in the packet capture.

Role-Based Access Control (RBAC) is a method of restricting system access to authorized users based on their roles within an organization. Permissions are assigned to specific roles, and users are granted access by being assigned to the appropriate role. These roles are created to align with the job functions and responsibilities of personnel, such as "network administrator," "auditor," or "help desk agent." This model simplifies administration by managing permissions for roles rather than for individual users.

A. discretionary access control: Incorrect. Access is determined by the data owner's discretion, who can grant permissions to any user, irrespective of their job function.

B. nondiscretionary access control: Incorrect. This is a broad category of access control where a central authority manages access. While RBAC is a type of nondiscretionary control, it is not the specific answer.

D. rule-based access control: Incorrect. Access is granted or denied based on a set of environmental or operational rules (e.g., time of day, location), not directly on the user's organizational job function.

1. Official Vendor Documentation: Cisco Identity Services Engine Administrator Guide

Release 3.1

"Cisco ISE Administrators and RBAC Policies" section. It states

"Role-based access control (RBAC) restricts network access based on a person's role within an organization. These permissions are then assigned to specific roles." This directly links RBAC to organizational roles (job functions).

2. Peer-Reviewed Academic Publication: Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-based access control. In Proceedings of the 15th National Computer Security Conference (pp. 554-563). This foundational paper defines RBAC

stating on page 554

"In this model

access decisions are based on the roles individual users have as part of an organization."

3. University Courseware: MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014. Lecture 4 Notes

"Access Control

" Section 3. The notes describe RBAC with the core idea: "Permissions are associated with a role. Users are assigned to roles. Roles often correspond to job functions."

According to NIST Special Publication 800-61 Revision 2, a "precursor" is a sign that a security incident may occur in the future. The scenario describes an organization receiving online threats from a hacktivist group. This threat serves as a warning or an indication of a potential future attack. The organization's adjustment of its security stance is a direct response to this precursor event. This aligns perfectly with the NIST definition, which explicitly lists "an announcement made by a group that it will be conducting attacks" as an example of a precursor.

A. online assault: This term describes an actual attack in progress, not a threat or a sign of a future incident.

C. trigger: A trigger is an event or condition that initiates the incident response process, such as an alert from an IDS, not the preceding threat itself.

D. instigator: This refers to the actor or entity initiating the threat (the hacktivist group), not the event or sign of the potential incident.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61

Rev. 2). U.S. Department of Commerce.

Section 2.3.1

"Precursors"

Page 9: This section defines a precursor as "a sign that an incident may occur in the future." It provides a direct example relevant to the question: "An announcement made by a group that it will be conducting attacks against an organization." (DOI: https://doi.org/10.6028/NIST.SP.800-61r2)

2. Purdue University. (n.d.). Incident Response [Courseware for CS42600 - Computer Security]. Purdue University Department of Computer Science.

Lecture Notes on Incident Response: Course materials frequently reference NIST SP 800-61

defining precursors as early warnings of potential incidents

such as hacker group announcements

which contrasts with indicators that signify an incident is likely occurring or has already occurred.

The internal network data contains "addresses," "gender," and "product preferences by age." This information, especially when combined, can be used to distinguish or trace an individual's identity, which classifies it as Personally Identifiable Information (PII). The external perimeter data includes "records, writings, and artwork," which are forms of original works of authorship. This type of intellectual property is legally protected by copyright law. Therefore, the engineer must identify both PII and copyright-protected data for compliance purposes.

A. SOX: This regulation applies to financial reporting for public companies, which is not described in the scenario.

C. PHI: This is Protected Health Information. The data described does not contain any medical or health-related details.

D. PCI: This standard protects payment cardholder data. The scenario does not mention any credit card or payment information.

1. PII: National Institute of Standards and Technology (NIST)

Special Publication 800-122

"Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

" Section 2.1

Definition of PII. This document defines PII as information that can be used to trace an individual's identity

such as name

address

or other linked data.

2. Copyright: U.S. Copyright Office

"Copyright in General (Circular 1)

" page 1

"What Is Copyright?". This official document states that copyright protects "original works of authorship

" including literary (writings) and artistic (artwork) works.

3. PHI: U.S. Department of Health & Human Services (HHS.gov)

"Summary of the HIPAA Privacy Rule

" page 5

"Protected Health Information." This defines PHI as individually identifiable health information

which is absent from the scenario.

An application greylist is a security control mechanism used for items whose reputation is undetermined. Unlike a whitelist (known good) or a blacklist (known bad), a greylist contains applications that have not yet been classified. These unknown applications are typically subjected to further analysis, such as sandboxing or behavioral monitoring, to determine if they are safe or malicious before being permanently allowed or blocked. This approach provides a layer of defense against zero-day threats or new, unclassified software.

A. Items that have been established as malicious: This describes a blacklist (or blocklist), which is a list of applications that are explicitly denied execution because they are known threats.

B. Items that have been established as authorized: This describes a whitelist (or allowlist), which is a list of applications that are explicitly permitted to run because they are known to be safe.

C. Items that have been installed with a baseline: Applications included in a secure baseline are considered authorized and trusted; therefore, they would be part of a whitelist, not a greylist.

1. Official Vendor Documentation (Cisco): Santos

O. (2020). Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. Chapter 15

"Endpoint Security Technologies

" in the section "Application Blacklisting and Whitelisting

" explains that applications not on a whitelist or blacklist are considered "unknown." Cisco AMP for Endpoints (now Secure Endpoint) treats these unknown files with suspicion and uses sandboxing to analyze them

which is the functional principle of greylisting.

2. Peer-reviewed Academic Publications (NIST): Souppaya

M.

& Scarfone

K. (2015). Guide to Application Whitelisting (NIST Special Publication 800-167). National Institute of Standards and Technology. Section 2.1

"Basic Concepts

" discusses the operational modes of whitelisting. The handling of applications not explicitly on the whitelist or blacklist (i.e.

unknown applications) is the core concept of greylisting

where they are monitored or audited before a final policy is applied.

3. University Courseware: The concept is a fundamental part of layered defense taught in cybersecurity curricula. For instance

materials on host-based security controls often differentiate between allowlists

blocklists

and the intermediate "gray" or "unknown" category that requires further inspection. This aligns with principles taught in courses like MIT's 6.858 Computer Systems Security. While not using the term "greylist" explicitly

the functional description of handling unknown executables is identical.

The packets show the default client User-Agent string copied both in the HTTP header and again inside the request payload. Automated tools that try to force every request to be forwarded to the origin server often reuse the default User-Agent and then embed (or echo) that same string or other random tokens in the URL/body together with Cache-Control or pragma directives that mark the object “non-cacheable.” This technique—called cache bypassing or cache-busting—defeats web-proxy/CDN caching, lets an attacker enumerate content, and can be used as a pre-cursor to further abuse. The presence of the unchanged, default User-Agent in header and data is therefore a strong indicator of a cache-bypassing attack.

A. DoS indicators are high connection or packet rates, not repetition of a default User-Agent in payload.

B. Garbage-flood DoS sends random binary to sockets; analysis showed valid HTTP, not raw binary noise.

C. Data-exfiltration usually hides or encodes data; merely seeing default User-Agent in cleartext does not prove exfiltration.

1. Cisco Press – “Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CBROPS) OCG”

Ch.4

p.117–118: abnormal default User-Agent + non-cacheable requests identified as cache-bypass indicator.

2. Cisco Live BRKSEC-3396

2020

slides 40-43: detection of cache-busting traffic; reuse of default User-Agent.

3. RFC 7234

HTTP/1.1 Caching

Sect.4.2: ‘no-store’

‘no-cache’ directives force cache bypass.

4. Chen et al.

“Characterizing Web-Cache Deception Attacks”

IEEE S&P 2019

§3.2 (https://doi.org/10.1109/SP.2019.00064) – describes attacker embedding tokens to evade caches.

5. MIT OCW 6.858 “Computer Systems Security”

Lecture 11 notes

pp.5-6: cache-busting techniques and observable indicators (default script User-Agent

unique URLs).

This regular expression correctly identifies the structure of an IPv4 address.

- ^ anchors the pattern to the beginning of the string.

- (?:[0-9]{1,3}\.){3} is a non-capturing group that matches a sequence of one to three digits ([0-9]{1,3}) followed by a literal dot (\.). This group is repeated exactly three times ({3}) to match the first three octets (e.g., "192.168.20.").

- [0-9]{1,3} matches the final octet, which consists of one to three digits (e.g., "232").

This combination accurately captures the entire IP address string 192.168.20.232.

B. ^ (?:[0-9]f1,3}\.){1,4}

This expression is syntactically flawed (f1,3}). Even if corrected to {1,3}, it would incorrectly require a trailing dot after the final octet, failing to match the target string.

C. ^ (?:[0-9]{1,3}\.)'

This expression is syntactically incomplete due to the trailing apostrophe. It would only match the initial octets followed by a dot, not the complete IP address.

D. ^ ([0-9]-{3})

This expression is syntactically incorrect. A likely interpretation, ^([0-9]{3}), would only match the first three digits of the IP address ("192"), not the entire string.

---

1. Cisco Systems

Inc.

"Configuring Regular Expressions

" Terminal Services Configuration Guide

Cisco IOS XE Gibraltar 16.12.x. This guide's "Regular Expression Pattern Matching Characters" table defines the metacharacters used in the correct answer

such as ^ (matches at the beginning of the string)

[0-9] (matches a range of single digits)

and . (matches any single character

requiring \. for a literal dot).

2. Python Software Foundation

"re — Regular expression operations

" Python 3.11.4 Documentation. The section on "Regular Expression Syntax" details the usage of quantifiers like {m

n} (matches from m to n repetitions) and the non-capturing group syntax (?:...)

both of which are essential components of the correct regular expression.

3. Guttag

J. V. (2016)

6.0001 Introduction to Computer Science and Programming in Python

MIT OpenCourseWare. Lecture 11 materials on "Regular Expressions" explain the principles of constructing patterns to match specific data formats

such as email addresses or IP addresses

using the fundamental building blocks present in the correct answer.

In cybersecurity, these terms have distinct meanings. A vulnerability is a weakness, flaw, or gap in security design, implementation, or internal controls that can be exploited by a threat actor. Risk is the potential for loss or damage when a threat exploits a vulnerability. Risk is commonly understood as a function of the likelihood of a threat event occurring and the probable impact or damage that would result. Therefore, a vulnerability is the flaw itself, while risk quantifies the potential negative outcome associated with that flaw.

A. A vulnerability is a specific flaw, not a "sum of entry points." Risk is a measure of potential damage and likelihood, not just the possibility of entry.

B. This option incorrectly defines a vulnerability as a threat. A threat (e.g., a hacker) is an agent that can exploit a vulnerability (e.g., unpatched software).

D. This option incorrectly equates a vulnerability with an exploit. An exploit is the specific code or technique used to take advantage of a vulnerability.

1. Santos

O. (2020). CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide. Cisco Press. In the context of risk management

the guide defines a vulnerability as "a weakness in a system or its design that could be exploited by a threat" and risk as "the likelihood of a threat agent exploiting a vulnerability and the corresponding impact." (Chapter 23

"Risk Management

" Section: "Threats

Vulnerabilities

and Exploits").

2. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30

Revision 1).

Vulnerability is defined as a "flaw or weakness in system security procedures

design

implementation

or internal controls that could be exercised... and result in a security breach..." (Section 2.2.3

Page 8).

Risk is defined as "a measure of the extent to which an entity is threatened by a potential circumstance or event

and is typically a function of: (i) the adverse impacts [damage] that would arise... and (ii) the likelihood of occurrence." (Section 2.2.1

Page 7).

In the context of a cybersecurity investigation and attribution, an asset is an item of value. A laptop (C) is a tangible IT asset that can be compromised and from which digital evidence is collected to trace an attack. Attribution is the process of identifying and assigning responsibility for an attack to a specific threat actor (E). The detailed information and profile compiled about a threat actor, including their motives, capabilities, and TTPs (Tactics, Techniques, and Procedures), is considered a critical and valuable intelligence asset for an organization's security posture.

A. context: Context is situational information that provides meaning to data and evidence; it is not considered a tangible or intangible asset itself.

B. session: A session is a transient state of communication. While session data can be valuable evidence, the session itself is not a persistent asset.

D. firewall logs: Firewall logs are data artifacts or evidence generated by an asset (the firewall), not the asset itself in this context.

1. Cisco Press

Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

1st ed.

by Omar Santos.

Chapter 1

"Cybersecurity Operations Fundamentals

" Section "Assets

Vulnerabilities

and Threats

" p. 10: Defines an asset as "anything of value to an organization" and explicitly lists "laptops" as an example of a physical asset. This directly supports option C.

Chapter 2

"The SOC

" Section "Threat Intelligence

" p. 45: Discusses attribution as a key component of threat intelligence

which involves identifying the actor behind an attack. The resulting intelligence on the threat actor is a valuable asset for predicting and preventing future attacks

supporting the classification of the threat actor's profile as an asset (E).

2. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations.

Appendix A

"Glossary

" p. 231: Defines an asset as "An item of value to stakeholders. An asset may be tangible (e.g.

a physical item such as hardware...) or intangible (e.g.

data

information...)." This definition supports a laptop (tangible) and the detailed information profile of a threat actor (intangible information) as assets.

3. Caltagirone

S.

Pendergast

A.

& Betz

C. (2013). The Diamond Model of Intrusion Analysis. Center for Threat-Informed Defense. https://www.mitre.org/sites/default/files/publications/13-1038-mitre-diamond-model.pdf

Section 2

"The Diamond Model

" p. 4: This foundational paper on intrusion analysis identifies four core vertices of any event: adversary

capability

infrastructure

and victim. The "Adversary" (threat actor) and the "Victim" (who possesses assets like laptops) are presented as fundamental elements of an investigation

reinforcing their central role in attribution.

The mappings are derived directly from the packet details pane for Frame 23 in the provided Wireshark image.

1. Network Protocol: The header shows "Internet Protocol Version 4" (IPv4). The Source Address is listed as 10.0.2.15 and the Destination Address is 192.124.249.9.
2. Transport Protocol: The header shows "Transmission Control Protocol" (TCP). The Source Port is the ephemeral port 50588 used by the client, and the Destination Port is 443, the standard port for HTTPS traffic.
3. Application Protocol: The payload is identified as "Transport Layer Security v1.2" (TLSv1.2), which operates on top of the transport layer to provide encryption.

Postel, J. (1981). Internet Protocol (RFC 791). Internet Engineering Task Force. (Defines IPv4, Source Address, and Destination Address fields). https://doi.org/10.17487/RFC0791

Postel, J. (1981). Transmission Control Protocol (RFC 793). Internet Engineering Task Force. (Defines TCP, Source Port, and Destination Port fields). https://doi.org/10.17487/RFC0793

Dierks, T., & Rescorla, E. (2008). The Transport Layer Security (TLS) Protocol Version 1.2 (RFC 5246). Internet Engineering Task Force. (Defines TLS v1.2). https://doi.org/10.17487/RFC5246

Wireshark Foundation. (n.d.). Wireshark User’s Guide: 6.2. The "Packet Details" Pane. Retrieved from https://www.wireshark.org/docs/wsug_html_chunked/ChWorkPacketDetailsPane.html

DAC (Discretionary Access Control): In this model, the object owner creates the file or resource and has the discretion to assign access rights (permissions) to other users, usually via Access Control Lists (ACLs).

MAC (Mandatory Access Control): The system (specifically the Operating System or Trusted Computing Base) enforces access based on immutable security labels (e.g., Top Secret) assigned to subjects and objects. Users cannot override these policies.

RBAC (Role-Based Access Control): Access permissions are associated with specific job functions or roles. Users acquire permissions only by being assigned to a role, rather than directly.

ABAC (Attribute-Based Access Control): Access is granted dynamically based on policies evaluating attributes of the subject (e.g., seniority), the object, and the environment (context).

Hu, V. C., Ferraiolo, D. F., & Kuhn, D. R. (2006). NIST Special Publication 800-192: Assessment of Access Control Systems. National Institute of Standards and Technology.

DAC: Page 8, Section 2.1 ("...controls access based on the identity of the user and the access rules... The owner of the object specifies the subjects...").

MAC: Page 9, Section 2.2 ("...access control decisions are made by a central authority, not by the individual owner...").

RBAC: Page 11, Section 2.3 ("Access decisions are based on the roles that individual users have...").

Hu, V. C., et al. (2014). NIST Special Publication 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. National Institute of Standards and Technology.

ABAC: Page vii, Executive Summary ("ABAC... grants access rights... through the use of policies that combine attributes together.").

Sandhu, R. S., et al. (1996). "Role-Based Access Control Models." IEEE Computer, 29(2), 38-47. https://doi.org/10.1109/2.485845 (Foundational academic source for RBAC mechanics).