Cisco CyberOps Sample Questions for 350-201 Exam Mastery

Get exam-ready with expertly designed Cisco CyberOps Sample Questions focused on the 350-201 CBRCOR exam. This practice content covers key domains like threat intelligence, incident response, network intrusion analysis, and security monitoring. Ideal for cybersecurity analysts and SOC professionals preparing for Cisco’s CyberOps Professional certification, these practice tests reflect real exam difficulty and structure. Access 350-201 dumps, updated mock exams, and scenario-based question sets that help you evaluate your readiness and improve your performance. Whether you’re looking for Cisco CyberOps exam dumps or hands-on practice questions, this all-in-one toolkit ensures you’re fully prepared for success in cybersecurity operations.

Cisco CyberOps Sample Questions List :

1. Which command does an engineer use to set read/write/execute access on a folder for everyone who reaches the resource?

1. chmod 666

2. chmod 774

3. chmod 775

4. chmod 777

2. An engineer configured this SOAR solution workflow to identify account theft threats and privilege escalation, evaluate risk, and respond by resolving the threat. This solution is handling more threats than Security analysts have time to analyze. Without this analysis, the team cannot be proactive and anticipate attacks. Which action will accomplish this goal?

1. Exclude the step “BAN malicious IP” to allow analysts to conduct and track the remediation

2. Include a step “Take a Snapshot” to capture the endpoint state to contain the threat for analysis

3. Exclude the step “Check for GeoIP location” to allow analysts to analyze the location and the associated risk based on asset criticality

4. Include a step “Reporting” to alert the security department of threats identified by the SOAR reporting engine

3. The physical security department received a report that an unauthorized person followed an authorized individual to enter a secured premise. The incident was documented and given to a security specialist to analyze. Which step should be taken at this stage?

1. Determine the assets to which the attacker has access

2. Identify assets the attacker handled or acquired

3. Change access controls to high risk assets in the enterprise

4. Identify movement of the attacker in the enterprise

4. An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

1. Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.

2. Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.

3. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.

4. Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.

5. Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system’s startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?

1. Remove the shortcut files

2. Check the audit logs

3. Identify affected systems

4. Investigate the malicious URLs

6. An employee is a victim of a social engineering phone call and installs remote access software to allow an “MS Support” technician to check his machine for malware. The employee becomes suspicious after the remote technician requests payment in the form of gift cards. The employee has copies of multiple, unencrypted database files, over 400 MB each, on his system and is worried that the scammer copied the files off but has no proof of it. The remote technician was connected sometime between 2:00 pm and 3:00 pm over https. What should be determined regarding data loss between the employee’s laptop and the remote technician’s system?

1. No database files were disclosed

2. The database files were disclosed

3. The database files integrity was violated

4. The database files were intentionally corrupted, and encryption is possible

7. A SOC analyst is investigating a recent email delivered to a high-value user for a customer whose network their organization monitors. The email includes a suspicious attachment titled “Invoice RE: 0004489”. The hash of the file is gathered from the Cisco Email Security Appliance. After searching Open Source Intelligence, no available history of this hash is found anywhere on the web. What is the next step in analyzing this attachment to allow the analyst to gather indicators of compromise?

1. Run and analyze the DLP Incident Summary Report from the Email Security Appliance

2. Ask the company to execute the payload for real time analysis

3. Investigate further in open source repositories using YARA to find matches

4. Obtain a copy of the file for detonation in a sandbox

8. An engineer receives an incident ticket with hundreds of intrusion alerts that require investigation. An analysis of the incident log shows that the alerts are from trusted IP addresses and internal devices. The final incident report stated that these alerts were false positives and that no intrusions were detected. What action should be taken to harden the network?

1. Move the IPS to after the firewall facing the internal network

2. Move the IPS to before the firewall facing the outside network

3. Configure the proxy service on the IPS

4. Configure reverse port forwarding on the IPS

9. A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?

1. Identify the business applications running on the assets

2. Update software to patch third-party software

3. Validate CSRF by executing exploits within Metasploit

4. Fix applications according to the risk scores

10. A company launched an e-commerce website with multiple points of sale through internal and external e- stores. Customers access the stores from the public website, and employees access the stores from the intranet with an SSO. Which action is needed to comply with PCI standards for hardening the systems?

1. Mask PAN numbers

2. Encrypt personal data

3. Encrypt access

4. Mask sales details

11. What is a limitation of cyber security risk insurance?

1. It does not cover the costs to restore stolen identities as a result of a cyber attack

2. It does not cover the costs to hire forensics experts to analyze the cyber attack

3. It does not cover the costs of damage done by third parties as a result of a cyber attack

4. It does not cover the costs to hire a public relations company to help deal with a cyber attack

12. Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?

1. customer data

2. internal database

3. internal cloud

4. Internet

13. An engineer is investigating a case with suspicious usernames within the active directory. After the engineer investigates and cross-correlates events from other sources, it appears that the 2 users are privileged, and their creation date matches suspicious network traffic that was initiated from the internal network 2 days prior. Which type of compromise is occurring?

1. compromised insider

2. compromised root access

3. compromised database tables

4. compromised network

14. A threat actor attacked an organization’s Active Directory server from a remote location, and in a thirty-minute timeframe, stole the password for the administrator account and attempted to access 3 company servers. The threat actor successfully accessed the first server that contained sales data, but no files were downloaded. A second server was also accessed that contained marketing information and 11 files were downloaded. When the threat actor accessed the third server that contained corporate financial data, the session was disconnected, and the administrator’s account was disabled. Which activity triggered the behavior analytics tool?

1. accessing the Active Directory server

2. accessing the server with financial data

3. accessing multiple servers

4. downloading more than 10 files

15. An organization had a breach due to a phishing attack. An engineer leads a team through the recovery phase of the incident response process. Which action should be taken during this phase?

1. Host a discovery meeting and define configuration and policy updates

2. Update the IDS/IPS signatures and reimage the affected hosts

3. Identify the systems that have been affected and tools used to detect the attack

4. Identify the traffic with data capture using Wireshark and review email filters

16. A security expert is investigating a breach that resulted in a $32 million loss from customer accounts. Hackers were able to steal API keys and two-factor codes due to a vulnerability that was introduced in a new code a few weeks before the attack. Which step was missed that would have prevented this breach?

1. use of the Nmap tool to identify the vulnerability when the new code was deployed

2. implementation of a firewall and intrusion detection system

3. implementation of an endpoint protection system

4. use of SecDevOps to detect the vulnerability during development

17. An engineer is utilizing interactive behavior analysis to test malware in a sandbox environment to see how the malware performs when it is successfully executed. A location is secured to perform reverse engineering on a piece of malware. What is the next step the engineer should take to analyze this malware?

1. Run the program through a debugger to see the sequential actions

2. Unpack the file in a sandbox to see how it reacts

3. Research the malware online to see if there are noted findings

4. Disassemble the malware to understand how it was constructed

18. An engineer receives an incident ticket with hundreds of intrusion alerts that require investigation. An analysis of the incident log shows that the alerts are from trusted IP addresses and internal devices. The final incident report stated that these alerts were false positives and that no intrusions were detected. What action should be taken to harden the network?

1. Move the IPS to after the firewall facing the internal network

2. Move the IPS to before the firewall facing the outside network

3. Configure the proxy service on the IPS

4. Configure reverse port forwarding on the IPS

19. A payroll administrator noticed unexpected changes within a piece of software and reported the incident to the incident response team. Which actions should be taken at this step in the incident response workflow?

1. Classify the criticality of the information, research the attacker’s motives, and identify missing patches

2. Determine the damage to the business, extract reports, and save evidence according to a chain of custody

3. Classify the attack vector, understand the scope of the event, and identify the vulnerabilities being exploited

4. Determine the attack surface, evaluate the risks involved, and communicate the incident according to the escalation plan

20. What is a benefit of key risk indicators?

1. clear perspective into the risk position of an organization

2. improved visibility on quantifiable information

3. improved mitigation techniques for unknown threats

4. clear procedures and processes for organizational risk

21. An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?

1. diagnostic

2. qualitative

3. predictive

4. statistical

22. A company launched an e-commerce website with multiple points of sale through internal and external e- stores. Customers access the stores from the public website, and employees access the stores from the intranet with an SSO. Which action is needed to comply with PCI standards for hardening the systems?

1. Mask PAN numbers

2. Encrypt personal data

3. Encrypt access

4. Mask sales details

23. An engineer is developing an application that requires frequent updates to close feedback loops and enable teams to quickly apply patches. The team wants their code updates to get to market as often as possible. Which software development approach should be used to accomplish these goals?

1. continuous delivery

2. continuous integration

3. continuous deployment

4. continuous monitoring

24. Where do threat intelligence tools search for data to identify potential malicious IP addresses, domain names, and URLs?

1. customer data

2. internal database

3. internal cloud

4. Internet

25. What is a principle of Infrastructure as Code?

1. System maintenance is delegated to software systems

2. Comprehensive initial designs support robust systems

3. Scripts and manual configurations work together to ensure repeatable routines

4. System downtime is grouped and scheduled across the infrastructure

26. Where does it signify that a page will be stopped from loading when a scripting attack is detected?

1. x-frame-options

2. x-content-type-options

3. x-xss-protection

4. x-test-debug

27. A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?

1. Identify the business applications running on the assets

2. Update software to patch third-party software

3. Validate CSRF by executing exploits within Metasploit

4. Fix applications according to the risk scores

28. An engineer wants to review the packet overviews of SNORT alerts. When printing the SNORT alerts, all the packet headers are included, and the file is too large to utilize. Which action is needed to correct this problem?

1. Modify the alert rule to “output alert_syslog: output log”

2. Modify the output module rule to “output alert_quick: output filename”

3. Modify the alert rule to “output alert_syslog: output header”

4. Modify the output module rule to “output alert_fast: output filename”

29. According to GDPR, what should be done with data to ensure its confidentiality, integrity, and availability?

1. Perform a vulnerability assessment

2. Conduct a data protection impact assessment

3. Conduct penetration testing

4. Perform awareness testing

30. A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must the analyst do next to detect an abnormal behavior?

1. Create a rule triggered by 3 failed VPN connection attempts in an 8-hour period

2. Create a rule triggered by 1 successful VPN connection from any nondestination country

3. Create a rule triggered by multiple successful VPN connections from the destination countries

4. Analyze the logs from all countries related to this user during the traveling period

31. A threat actor behind a single computer exploited a cloud-based application by sending multiple concurrent API requests. These requests made the application unresponsive. Which solution protects the application from being overloaded and ensures more equitable application access across the end-user community?

1. Limit the number of API calls that a single client is allowed to make

2. Add restrictions on the edge router on how often a single client can access the API

3. Reduce the amount of data that can be fetched from the total pool of active clients that call the API

4. Increase the application cache of the total pool of active clients that call the API

32. A malware outbreak is detected by the SIEM and is confirmed as a true positive. The incident response team follows the playbook to mitigate the threat. What is the first action for the incident response team?

1. Assess the network for unexpected behavior

2. Isolate critical hosts from the network

3. Patch detected vulnerabilities from critical hosts

4. Perform analysis based on the established risk factors

33. A security analyst receives an escalation regarding an unidentified connection on the Accounting A1 server within a monitored zone. The analyst pulls the logs and discovers that a Powershell process and a WMI tool process were started on the server after the connection was established and that a PE format file was created in the system directory. What is the next step the analyst should take?

1. Isolate the server and perform forensic analysis of the file to determine the type and vector of a possible attack

2. Identify the server owner through the CMDB and contact the owner to determine if these were planned and identifiable activities

3. Review the server backup and identify server content and data criticality to assess the intrusion risk

4. Perform behavioral analysis of the processes on an isolated workstation and perform cleaning procedures if the file is malicious

34. An employee who often travels abroad logs in from a first-seen country during non-working hours. The SIEM tool generates an alert that the user is forwarding an increased amount of emails to an external mail domain and then logs out. The investigation concludes that the external domain belongs to a competitor. Which two behaviors triggered UEBA? (Choose two.)

1. domain belongs to a competitor

2. log in during non-working hours

3. email forwarding to an external domain

4. log in from a first-seen country

35. An organization installed a new application server for IP phones. An automated process fetched user credentials from the Active Directory server, and the application will have access to on-premises and cloud services. Which security threat should be mitigated first?

1. aligning access control policies

2. exfiltration during data transfer

3. attack using default accounts

4. data exposure from backups

36. The incident response team was notified of detected malware. The team identified the infected hosts, removed the malware, restored the functionality and data of infected systems, and planned a company meeting to improve the incident handling capability. Which step was missed according to the NIST incident handling guide?

1. Contain the malware

2. Install IPS software

3. Determine the escalation path

4. Perform vulnerability assessment

37. A new malware variant is discovered hidden in pirated software that is distributed on the Internet. Executives have asked for an organizational risk assessment. The security officer is given a list of all assets. According to NIST, which two elements are missing to calculate the risk assessment? (Choose two.)

1. incident response playbooks

2. asset vulnerability assessment

3. report of staff members with asset relations

4. malware analysis report

38. Employees report computer system crashes within the same week. An analyst is investigating one of the computers that crashed and discovers multiple shortcuts in the system’s startup folder. It appears that the shortcuts redirect users to malicious URLs. What is the next step the engineer should take to investigate this case?

1. Remove the shortcut files

2. Check the audit logs

3. Identify affected systems

4. Investigate the malicious URLs

39.  An engineer is utilizing interactive behavior analysis to test malware in a sandbox environment to see how the malware performs when it is successfully executed. A location is secured to perform reverse engineering on a piece of malware. What is the next step the engineer should take to analyze this malware?

1. Run the program through a debugger to see the sequential actions

2. Unpack the file in a sandbox to see how it reacts

3. Research the malware online to see if there are noted findings

4. Disassemble the malware to understand how it was constructed

40. An engineer must tune the Cisco IOS device to mitigate an attack that is broadcasting a large number of ICMP packets. The attack is sending the victim’s spoofed source IP to a network using an IP broadcast address that causes devices in the network to respond back to the source IP address. Which action does the engineer recommend?

1. Use command ip verify reverse-path interface

2. Use global configuration command service tcp-keepalives-out

3. Use subinterface command no ip directed-broadcast

4. Use logging trap 6

41. An engineer returned to work and realized that payments that were received over the weekend were sent to the wrong recipient. The engineer discovered that the SaaS tool that processes these payments was down over the weekend. Which step should the engineer take first?

1. Utilize the SaaS tool team to gather more information on the potential breach

2. Contact the incident response team to inform them of a potential breach

3. Organize a meeting to discuss the services that may be affected

4. Request that the purchasing department creates and sends the payments manually

42. Which two steps mitigate attacks on the webserver from the Internet? (Choose two.)

1. Create an ACL on the firewall to allow only TLS 1.3

2. Implement a proxy server in the DMZ network

3. Create an ACL on the firewall to allow only external connections

4. Move the webserver to the internal network

43. An organization had several cyberattacks over the last 6 months and has tasked an engineer with looking for patterns or trends that will help the organization anticipate future attacks and mitigate them. Which data analytic technique should the engineer use to accomplish this task?

1. diagnostic

2. qualitative

3. predictive

4. statistical

44. How does Wireshark decrypt TLS network traffic?

1. with a key log file using per-session secrets

2. using an RSA public key

3. by observing DH key exchange

4. by defining a user-specified decode-as

45. Where are the browser page rendering permissions displayed?

1. x-frame-options

2. x-xss-protection

3. x-content-type-options

4. x-test-debug

46. Cisco Rapid Threat Containment using Cisco Secure Network Analytics (Stealthwatch) and ISE detects the threat of malware-infected 802.1x authenticated endpoints and places that endpoint into a Quarantine VLAN using Adaptive Network Control policy. Which telemetry feeds were correlated with SMC to identify the malware?

1. NetFlow and event data

2. event data and syslog data

3. SNMP and syslog data

4. NetFlow and SNMP

47. A SOC analyst is notified by the network monitoring tool that there are unusual types of internal traffic on IP subnet 103.861.2117.0/24. The analyst discovers unexplained encrypted data files on a computer system that belongs on that specific subnet. What is the cause of the issue?

1. DDoS attack

2. phishing attack

3. virus outbreak

4. malware outbreak

48. A security architect is working in a processing center and must implement a DLP solution to detect and prevent any type of copy and paste attempts of sensitive data within unapproved applications and removable devices. Which technical architecture must be used?

1. DLP for data in motion

2. DLP for removable data

3. DLP for data in use

4. DLP for data at rest

49. An organization is using a PKI management server and a SOAR platform to manage the certificate lifecycle. The SOAR platform queries a certificate management tool to check all endpoints for SSL certificates that have either expired or are nearing expiration. Engineers are struggling to manage problematic certificates outside of PKI management since deploying certificates and tracking them requires searching server owners manually. Which action will improve workflow automation?

1. Implement a new workflow within SOAR to create tickets in the incident response system, assign problematic certificate update requests to server owners, and register change requests.

2. Integrate a PKI solution within SOAR to create certificates within the SOAR engines to track, update, and monitor problematic certificates.

3. Implement a new workflow for SOAR to fetch a report of assets that are outside of the PKI zone, sort assets by certification management leads and automate alerts that updates are needed.

4. Integrate a SOAR solution with Active Directory to pull server owner details from the AD and send an automated email for problematic certificates requesting updates.

50. An audit is assessing a small business that is selling automotive parts and diagnostic services. Due to increased customer demands, the company recently started to accept credit card payments and acquired a POS terminal. Which compliance regulations must the audit apply to the company?

1. HIPAA

2. FISMA

3. COBIT

4. PCI DSS

FAQs

1. What is the Cisco CyberOps 350-201 certification exam?

It is the core exam for the Cisco Certified CyberOps Professional credential, testing advanced knowledge in cybersecurity operations, threat analysis, and incident response.

2. How do I become Cisco CyberOps 350-201 certified?

To earn the CyberOps Professional certification, you must pass the 350-201 CBRCOR (core exam) and one Cisco concentration exam focused on cybersecurity operations.

3. What are the prerequisites for the Cisco CyberOps 350-201 exam?

There are no formal prerequisites, but Cisco recommends 3–5 years of experience in cybersecurity operations or security analysis.

4. How much does the Cisco CyberOps 350-201 certification cost?

The 350-201 CBRCOR exam costs $400 USD, and each concentration exam costs $300 USD.

5. How many questions are in the Cisco CyberOps 350-201 exam?

The exam typically includes 90–110 questions.

6. What topics are covered in the Cisco CyberOps 350-201 CBRCOR exam?

It covers threat hunting, digital forensics, security monitoring, network intrusion analysis, and automation.

7. How difficult is the Cisco CyberOps 350-201 exam?

It is an advanced-level exam, requiring strong knowledge of cybersecurity tools, analytics, and response frameworks.

8. How long does it take to prepare for the Cisco CyberOps 350-201 certification?

Most professionals take 10–12 weeks of preparation, depending on experience and study hours.

9. What jobs can I get after earning the Cisco CyberOps 350-201 certification?

You can work as a Security Analyst, SOC Engineer, Cybersecurity Consultant, or Incident Response Specialist.

10. How much salary can I earn with a Cisco CyberOps 350-201 certification?

Professionals typically earn between $95,000–$140,000 annually, depending on skills and experience.