Cisco CCNA 200-201 CCNACBR Practice Exam

• A. Role-based access control Correct answer
• B. Discretionary access control
• C. Mandatory access control Correct answer
• D. Owner-granted access control

Options A and C are correct because both role-based access control and mandatory access control assign access through a centrally administered scheme, rather than letting individual resource owners decide, which is what makes them nondiscretionary. Discretionary access control and owner-granted access control are, by definition, the opposite: they rely on the resource owner's own choice about who gets access.

• A. Availability, because authorized staff can no longer access the records when they are needed for patient care Correct answer
• B. Confidentiality, because attackers gained unauthorized read access to the patient records before encrypting them
• C. Integrity, because the encryption process silently altered the underlying content of every stored record
• D. Non-repudiation, because the attackers can later deny having encrypted the hospital's records

Option A is correct because ransomware encrypting patient records prevents authorized clinical staff from accessing the data they need for care, which is precisely what the availability principle covers. Option B is wrong because encryption alone does not prove the attacker read the confidential contents, and option C is wrong because encryption for ransom is not the same as silently corrupting record integrity. Option D is wrong because non-repudiation concerns proving who performed an action, not denial of access.

• A. Network-based protection, because it inspects traffic at chokepoints rather than on individual hosts
• B. Agent-based protection, because it runs local software on the endpoint that reports telemetry to management Correct answer
• C. Cloud access security broker, because it enforces policy on traffic between users and cloud services
• D. Agentless protection, because it queries each endpoint remotely without installing any local software

Option B is correct because agent-based protection installs a lightweight software component directly on each endpoint to continuously monitor local activity and send telemetry back to a central console. Option A is wrong because network-based protection inspects traffic at chokepoints rather than on the hosts themselves, and option D describes the opposite of agent-based by definition. Option C is wrong because a CASB governs cloud service access, not local endpoint monitoring.

• A. Sliding window anomaly detection, because it compares current activity against a continuously updated recent baseline Correct answer
• B. Threat modeling, because it systematically enumerates potential attack paths against an asset before an incident occurs
• C. Run book automation, because it executes a predefined sequence of response steps once a triggering rule fires
• D. Threat hunting, because it involves proactively searching for indicators of compromise using an analyst-driven hypothesis

Option A is correct because comparing current activity against a continuously updated recent baseline, rather than a single fixed historical snapshot, is the defining trait of sliding window anomaly detection. Option B is wrong because threat modeling is a proactive planning exercise done before an incident, not a detection comparison technique. Options C and D are wrong because run book automation executes predefined response steps and threat hunting is analyst-driven hypothesis testing, neither of which describes a moving-average comparison.

• A. SYN flood Correct answer
• B. Smurf attack (ICMP amplification) Correct answer
• C. Cross-site scripting
• D. SQL injection

Options A and B are correct because both a SYN flood and a Smurf attack exploit protocol-level behavior (the TCP handshake and ICMP broadcast replies) to exhaust resources or flood a target, making them protocol-based denial of service techniques. Cross-site scripting and SQL injection are web application attacks aimed at code execution or data manipulation, not protocol-level denial of service.

• A. A reduction in the trust boundary
• B. A specific software vulnerability Correct answer
• C. An expansion of the attack surface
• D. A newly opened network port

Option B is correct because a named CVE against a specific outdated library is, by definition, a discrete flaw that can be exploited - a vulnerability. It is not itself the attack surface (the sum of all entry points), a trust boundary reduction, or a newly opened port; those describe exposure or configuration changes rather than a specific documented weakness.

• A. The exploited vulnerability list
• B. The residual risk register
• C. The attack surface Correct answer
• D. The patched configuration baseline

Option C is correct because the attack surface is exactly the total sum of every point where an attacker could attempt entry or data extraction. It is not a list of already-exploited vulnerabilities, a risk register entry, or a patched baseline - those describe remediation status or specific weaknesses rather than the aggregate exposure the term captures.

• A. Next-gen firewall application signatures
• B. Email content filtering logs
• C. NetFlow flow records Correct answer
• D. Full packet capture with payload storage

Option C is correct because NetFlow records capture who talked to whom (source/destination IP, ports, timing) without needing payload content, which is exactly what's needed to identify the internal host that contacted the external IP. Full packet capture would also work but stores far more than needed, and application signatures or email filtering logs don't address general host-to-host communication tracking.

• A. Host-based intrusion detection Correct answer
• B. Host-based firewall Correct answer
• C. Traditional stateful network firewall
• D. Web content filtering proxy

Options A and B are correct because host-based intrusion detection and host-based firewalls both run as agents on the endpoint itself, monitoring or controlling activity local to that specific host. A traditional stateful network firewall and a web content filtering proxy both operate at the network level, inspecting traffic between hosts rather than monitoring an individual endpoint's internal activity.

• A. It scans files and running processes against known malware signatures before allowing execution.
• B. It analyzes system call sequences and file integrity changes to detect malicious behavior on the host.
• C. It permits or blocks network connections to and from the host based on rules such as port, protocol, and address. Correct answer
• D. It restricts which applications are permitted to run based on a defined allow list of executables.

Option C is correct because a host-based firewall's core job is permitting or blocking network connections to and from the endpoint based on rules like port, protocol, and address. A HIDS instead watches system calls and file integrity for signs of compromise, so options A, B, and D describe antivirus, HIDS, and allow-listing behaviors rather than a firewall.

• A. HKEY_USERS, which stores the default profile template applied to new user accounts on the host.
• B. HKEY_LOCAL_MACHINE, which stores hardware and software configuration shared by all users on the host.
• C. HKEY_CLASSES_ROOT, which stores file association and COM object registration data for the system.
• D. HKEY_CURRENT_USER, which stores settings for the user account currently signed in to the session. Correct answer

Option D is correct because HKEY_CURRENT_USER holds the profile settings, including desktop and mapped drives, for whichever user is currently signed in. HKEY_USERS stores all loaded profiles rather than just the active one, HKEY_LOCAL_MACHINE holds machine-wide settings shared by every user, and HKEY_CLASSES_ROOT is about file associations, not per-user preferences.

• A. Using observed threat actor tactics to prioritize which assets need closer monitoring going forward. Correct answer
• B. Publishing the suspected threat actor's identity externally before the investigation is complete.
• C. Replacing chain-of-custody documentation with the attribution summary once a suspect is named.
• D. Deleting the asset inventory records once attribution to a threat actor has been established.

Option A is correct because attribution data is meant to inform defensive priorities, such as focusing monitoring on assets the actor is known to target. Publishing a suspect's identity before an investigation concludes, discarding chain-of-custody records, or deleting asset inventories all undermine the investigation rather than support it.

• A. IDS/IPS Correct answer
• B. Firewall Correct answer
• C. A printer's toner level sensor
• D. A conference room booking system

Options A and B are correct because IDS/IPS and firewalls are both network security technologies designed to generate events when they observe suspicious or policy-violating traffic, making them genuine source technologies for intrusion analysis. A printer's toner sensor and a conference room booking system are unrelated business systems that have no role in detecting or logging network security events.

• A. NetFlow record, because it records five-tuple session metadata without payload content
• B. Proxy log, because it records URL category and user-agent for web sessions Correct answer
• C. IDS alert, because it records signature ID and rule name for matched traffic patterns
• D. Antivirus log, because it records file hash matches for known malware signatures

Option B is correct because a proxy log records the specific details of a web session such as the destination URL's category and the client's user-agent string, which are proxy-specific artifacts. NetFlow only records five-tuple session metadata without such application detail, an IDS alert would instead show a matched signature/rule name, and antivirus logs center on file hash matches rather than web browsing details.

• A. Firewall, because the rule number and permit or deny action are firewall policy artifacts Correct answer
• B. Proxy, because the rule number identifies a URL category filtering policy applied to the session
• C. NetFlow, because the rule number identifies the exporter interface that captured the flow
• D. Antivirus, because the rule number identifies a signature database entry for a scanned file

Option A is correct because a permit/deny action paired with a matched rule number is the signature of firewall policy logging. A proxy log would show URL category or user actions rather than firewall rule numbers, NetFlow records flow metadata without policy match information, and antivirus logs track file scanning results, not connection permit/deny decisions.

• A. False negative, because the attack succeeded without triggering any alert at all
• B. True positive, because the alert correctly identified an attack that actually occurred Correct answer
• C. Benign trigger, because the traffic matched a signature but caused no impact
• D. False positive, because the alert fired on traffic that turned out to be harmless

Option B is correct because a true positive is exactly this: an alert that correctly fires on traffic that really is malicious, here confirmed by the verified successful attack. A false negative would mean no alert fired at all, a benign trigger implies no real attack occurred, and a false positive describes an alert on harmless traffic, neither of which matches a confirmed successful attack with a matching alert.

• A. Following an appropriate order of volatility when collecting evidence Correct answer
• B. Prioritizing speed of restoration over evidence preservation in every case
• C. Discarding evidence once an initial theory is formed
• D. Preserving data integrity throughout collection and analysis Correct answer

Options A and D are correct because NIST SP 800-86 emphasizes collecting evidence in the proper order of volatility, most fleeting data first, and preserving its integrity unaltered throughout collection and analysis. Prioritizing restoration speed over preservation and discarding evidence once a theory forms both directly contradict the standard's emphasis on careful, unbiased evidence handling.

• A. Patch management - maintains update history for each device
• B. Asset management - maintains inventory records for each device Correct answer
• C. Configuration management - maintains baseline settings for each device
• D. Vulnerability management - maintains scan results for each device

Option B is correct because asset management is the process responsible for maintaining an authoritative inventory of every device the organization owns, including details like purchase date and assigned owner. Configuration management tracks approved baseline settings rather than ownership records, patch management tracks update history, and vulnerability management tracks scan findings - none of those maintain the inventory itself.

• A. The patch was formally requested by a business unit ahead of the next maintenance window
• B. The patch had already completed successful functional testing in the staging environment
• C. The patch remediates a high-CVSS vulnerability under active exploitation in the wild Correct answer
• D. The patch was bundled into the vendor's routine monthly cumulative update release

Option C is correct because an actively exploited high-CVSS vulnerability creates immediate real-world risk, which is exactly what justifies bypassing the normal maintenance window for emergency deployment. Being bundled into a routine cumulative update, completing staging tests, or being requested by a business unit are all normal-priority factors that don't by themselves demand emergency action.

• A. specifies escalation timelines for each severity level, while the plan specifies evidence handling steps for each timeline
• B. lists the technical tools each responder must use, while the plan lists the communication channels for each stakeholder
• C. is formally reviewed and re-approved annually by senior management, while the plan is reviewed only after a major incident occurs
• D. defines management's authority and priorities for the program, while the plan lays out the roadmap for implementing it Correct answer

Option D is correct because the incident response policy sets management's authority and priorities for the program, while the incident response plan lays out the roadmap for actually implementing that program. The other options describe details that belong to lower-level documents like procedures or playbooks, not the policy-versus-plan distinction NIST SP 800-61 draws.