2026 Actual Cisco 200-201 Dumps, Updated Exam Questions for Guaranteed Pass

200-201 free sample questions and answers

Cisco 200-201 practice quiz with correct answers for search indexing.

1. Question 1

   Refer to the exhibit.

   

   Refer to the exhibit. Where is the executable file?

   Ainfo
   

   Btags
   

   CMIME
   

   Dname
   

   Correct answer: D

   The executable file is identified in the ''name'' section of the exhibit, which lists the file name ''VAC-Bypass-Loader.exe''. This indicates that the file is an executable, as denoted by the ''.exe'' extension commonly associated with executable files in Windows operating systems.

   
   

2. Question 2

   While analyzing an IDS alert generated by your network intrusion detection system, a junior analyst asks how to distinguish between a true positive and a false positive in the context of this alert. The alert triggered on outbound traffic matching a known malware command-and-control signature. The destination IP is an internal test server, and the traffic pattern matches a benign automated backup process. Which statement correctly characterizes this alert?

   AThis is a false positive because the alert was generated by a known signature, but the actual destination and activity are benign, not indicative of a true security incident
   

   BThis is a true positive because the traffic matched a known malware C2 signature in the IDS database
   

   CThis is a true negative because the system is functioning normally and no malicious traffic was detected
   

   DThis is a benign alert that should be ignored since the destination is internal to the organization
   

   EThis is a false negative because the IDS failed to identify the traffic as malicious on the first attempt
   

   Correct answer: A

   A false positive occurs when a security system generates an alert for activity that is not actually malicious or harmful—the activity appears suspicious (matches a rule/signature) but upon investigation is determined to be benign. In this case, the IDS correctly identified traffic matching a known signature (the rule functioned), but the context reveals the traffic is legitimate automated backup activity to an internal test server, not actual malware command-and-control. A true positive would mean the alert correctly identified actual malicious activity. A true negative is when the system correctly identifies benign traffic and does not alert. A false negative would be undetected malicious traffic. The distinction between a true positive and false positive depends on ground truth (what actually happened), not just whether a signature matched. This is fundamental to understanding detection accuracy and the management of alert fatigue in SOC operations.

3. Question 3

   What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

   AUntampered images are used in the security investigation process
   

   BTampered images are used in the security investigation process
   

   CThe image is tampered if the stored hash and the computed hash match
   

   DTampered images are used in the incident recovery process
   

   EThe image is untampered if the stored hash and the computed hash match
   

   Correct answer: A, E

   Untampered images are crucial for security investigations as they provide original evidence that has not been altered or corrupted; their integrity and authenticity can be verified by comparing the stored hash and the computed hash of the image. If they match, the image is untampered and can be used for analysis. Tampered images, on the other hand, are useless for security investigations as they may contain false or misleading information; their integrity and authenticity are compromised by the modification of the image data. Tampered images may be used for incident recovery purposes, such as restoring a system to a previous state, but not for forensic purposes.Reference:=Cisco Cybersecurity Operations Fundamentals - Module 6: Security Incident Investigations

   
   

4. Question 4

   What is a characteristic of a temporal score in CVSS?

   AIt can change over time
   

   BIt depends on the environment
   

   CIt has a vendor fixed value
   

   DIt is defined by impacted users
   

   Correct answer: B

   The temporal score in CVSS (Common Vulnerability Scoring System) adjusts the base vulnerability score based on time-dependent factors. It accounts for the current state of exploits (whether public exploits exist), availability of patches or workarounds, and level of confidence in the vulnerability reports. Unlike the static base score, the temporal score changes over time as exploit code becomes public, patches are released, and the threat landscape evolves, providing a more dynamic assessment of current risk.

5. Question 5

   A SOC team is analyzing an alert from their SIEM indicating suspicious outbound connections from a server to an external IP address. The team extracts the 5-tuple data from the logs: source IP 10.15.3.42, source port 43,521, destination IP 203.0.113.55, destination port 443, and protocol TCP.

   Using the 5-tuple approach to isolate the compromised host in grouped logs, which of the following would be the MOST appropriate next step for threat hunting?

   AQuery all logs for any traffic originating from 203.0.113.55 to identify other victims on the network
   

   BSearch the SIEM for ALL activities involving the source IP 10.15.3.42 across all ports and protocols to establish a complete activity baseline and timeline
   

   CBlock the destination port 443 on the firewall immediately to prevent further exfiltration
   

   DFilter logs to show only other connections using source port 43,521 to find related compromised systems
   

   Correct answer: B

   The 5-tuple (source IP, source port, destination IP, destination port, protocol) uniquely identifies a specific connection. However, once you have isolated a single suspicious connection, the most effective threat hunting approach is to expand the scope and examine ALL activities associated with the compromised host (the source IP in this case: 10.15.3.42) across all ports, protocols, and timeframes. This provides visibility into the full scope of the compromise—other lateral movements, data exfiltration attempts, C2 communications, or suspicious process executions that may have originated from that host.

   Querying by the external destination IP may find other victims, but it doesn't help investigate THIS compromise. The source port is ephemeral and won't reliably identify related activity. Immediate blocking without investigation can destroy forensic evidence and overlooks other potential compromises. The correct approach is to use the 5-tuple to identify the single suspicious connection, then pivot to broad investigation of that compromised asset.