Free study guide

Cisco CCNA 200-201 CBROPS Study Guide

Cisco Certified Network Associate Cybersecurity 200-201

The Cisco 200-201 exam (Understanding Cisco Cybersecurity Operations Fundamentals) tests the skills of an associate-level security operations analyst. It covers security concepts, security monitoring, host-based analysis, network intrusion analysis, and security policies and procedures.

  • Exam code 200-201
  • Associate level
  • 5 exam domains

This guide is free, with no sign-up. It explains every Cisco CCNA 200-201 CBROPS exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 5chapters
  • 35topics
  • 14diagrams and exhibits
  • 2 h 42 minfast track
Start with Security Concepts
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Security Concepts8 topics · 35 min fast trackCIA triad, deployments, terms, risk, access control, CVSS, visibility and detection methods.
  1. 1The CIA Triad and Defense in Depth4 min
  2. 2Comparing Security Deployments5 min
  3. 3Core Security Terms5 min
  4. 4Risk, Threat, Vulnerability and Exploit4 min
  5. 5Access Control Models and AAA4 min
  6. 6CVSS Metrics and Scoring4 min
  7. 7Data Visibility Challenges and Data Loss4 min
  8. 8The Five Tuple and Detection Methods5 min
Read the chapter overview →
2Security Monitoring8 topics · 36 min fast trackData sources, visibility, monitoring data types, common attacks, evasion and certificates.
  1. 1Attack Surface and Monitoring Data Sources5 min
  2. 2How Network Technologies Affect Visibility5 min
  3. 3Types of Security Monitoring Data4 min
  4. 4Network Attacks: Protocol, DoS, DDoS and MITM5 min
  5. 5Web Application Attacks4 min
  6. 6Social Engineering Attacks4 min
  7. 7Endpoint Attacks, Evasion and Obfuscation4 min
  8. 8Certificates, PKI and TLS Components5 min
Read the chapter overview →
3Host-Based Analysis5 topics · 22 min fast trackEndpoint technologies, operating system components, evidence, logs and malware reports.
  1. 1Endpoint Security Technologies4 min
  2. 2Operating System Components: Windows and Linux4 min
  3. 3Attribution and Types of Evidence5 min
  4. 4Interpreting Host, SIEM and Command Line Logs5 min
  5. 5Reading Malware Analysis Reports4 min
Read the chapter overview →
4Network Intrusion Analysis7 topics · 34 min fast trackEvent sources, inspection, Wireshark, protocol headers, alert artifacts and regex.
  1. 1Event Sources and Alert Outcomes5 min
  2. 2Inspection Methods and Traffic Capture5 min
  3. 3Wireshark and PCAP Analysis5 min
  4. 4Protocol Headers: Ethernet, IP, TCP, UDP and ICMP5 min
  5. 5Protocol Fields: DNS, Mail, HTTP and ARP5 min
  6. 6Artifact Elements in an Alert5 min
  7. 7Basic Regular Expressions4 min
Read the chapter overview →
5Security Policies and Procedures7 topics · 35 min fast trackManagement, NIST response, forensics, profiling, data and attack models.
  1. 1Asset, Configuration, Mobile, Patch and Vulnerability Management5 min
  2. 2NIST SP 800-61 Incident Response5 min
  3. 3Incident Response Stakeholders and SOC Metrics5 min
  4. 4NIST SP 800-86 Digital Forensics5 min
  5. 5Network and Server Profiling5 min
  6. 6Protected Data in a Network5 min
  7. 7Cyber Kill Chain and Diamond Model5 min
Read the chapter overview →

Ready for more practice?

The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.