Cisco 200-201: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Last checked October 22, 2026 against the official Cisco exam page.

1. Question 1Host-Based Analysis

   Which Windows Security event ID is recorded when an account logon succeeds?

   1. A4688
   2. B4624
   3. C4625
   4. D1102
   Show answer and explanationHide answer

   Correct answer: B

   Event ID 4624 records a successful logon. Event 4625 records a failed logon, 4688 records process creation when auditing is enabled, and 1102 shows that the audit log was cleared.

2. Question 2Security Monitoring

   A SIEM receives a syslog message with severity level 0. What does this indicate?

   1. ADebug, informational messages only
   2. BEmergency, the system is unusable
   3. CWarning, a warning condition exists
   4. DNotice, a normal but significant condition
   Show answer and explanationHide answer

   Correct answer: B

   Syslog severity 0 is emergency, the highest priority. Notice is level 5, warning is level 4, and debug is level 7, the lowest priority.

3. Question 3Security Concepts

   A hospital team ensures that patient records can be changed only by authorised staff, and that unauthorised edits are detected. Which security principle is most directly addressed?

   1. AConfidentiality
   2. BAvailability
   3. CIntegrity
   4. DNon-repudiation
   Show answer and explanationHide answer

   Correct answer: C

   Integrity means data is accurate and cannot be altered without authorisation. Availability concerns access when needed, confidentiality limits disclosure, and non-repudiation proves who performed an action.

4. Question 4Network Intrusion Analysis

   A packet capture shows a SYN from a client, a SYN-ACK from the server, and an ACK from the client. What does this sequence establish?

   1. AA DNS query and its response
   2. BAn ICMP echo exchange
   3. CA TLS session with negotiated cipher suites
   4. DA TCP connection using the three-way handshake
   Show answer and explanationHide answer

   Correct answer: D

   SYN, SYN-ACK and ACK is the TCP three-way handshake that opens a connection. TLS negotiation starts after TCP is established, DNS uses query and response messages, and ICMP echo is the ping exchange.

5. Question 5Security Policies and Procedures

   In the NIST incident response lifecycle, which phase includes identifying the scope and impact of a suspected incident?

   1. APost-incident activity
   2. BRecovery
   3. CPreparation
   4. DDetection and Analysis
   Show answer and explanationHide answer

   Correct answer: D

   Detection and Analysis covers confirming an incident and determining its scope and impact. Preparation builds capability before incidents, Recovery restores systems, and Post-incident activity captures lessons learned.