Free 200-201 Sample Questions — Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) (200-201) is a associate-level Cisco certification exam. The blueprint splits the exam across 6 domains, starting with Security Concepts, Security Monitoring, Host-Based Analysis. On exam day you face around 100 questions in 120 minutes, in formats such as multiple choice, drag and drop. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The 200-201 is rated medium in difficulty, and most candidates prepare with at least 6 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 245+ question PDF.

  • 20 free questions
  • pass mark 825/1000
  • 120 min
  • $300 official fee
  • blueprint v1.0
  • Every free question shows the correct answer
  • Questions follow the official 6-domain blueprint
  • No account or email required
  • 245+ questions in the full PDF

Looking for more? Click here to get the full PDF with 245+ practice questions for $10 for offline study and deeper preparation.

Question 1

Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

  • A. Hypertext Transfer Protocol
  • B. SSL Certificate
  • C. Tunneling
  • D. VPN
Show Answer
Correct Answer:
B. SSL Certificate
Question 2

Which two protocols are used for DDoS amplification attacks? (Choose two.)

  • A. HTTP
  • B. DNS
  • C. TCP
  • D. ICMPv6
  • E. NTP
Show Answer
Correct Answer:
  • B. DNS
  • E. NTP
Question 3

Which HTTP header field is used in forensics to identify the type of browser used?

  • A. referrer
  • B. host
  • C. user-agent
  • D. accept-language
Show Answer
Correct Answer:
C. user-agent
Question 4

Which artifact is used to uniquely identify a detected file?

  • A. file timestamp
  • B. file extension
  • C. file size
  • D. file hash
Show Answer
Correct Answer:
D. file hash
Question 5

What is email greylisting by the mail transfer agent?

  • A. denying any email from a sender it does not recognize
  • B. returning emails that are potential phishing attempts
  • C. allowing emails from unknown senders temporarily
  • D. quarantining emails sent from outside of the organization
Show Answer
Correct Answer:
A. denying any email from a sender it does not recognize
Question 6

An engineer received a flood of phishing emails from HR with the source address HRjacobrn@company.com. What is the threat actor in this scenario?

  • A. sender
  • B. phishing email
  • C. receiver
  • D. HR
Show Answer
Correct Answer:
A. sender
Question 7

What is the difference between indicator of attack (IoA) and indicators of compromise (IoC)?

  • A. IoA refers to the individual responsible for the security breach, and IoC refers to the resulting loss
  • B. IoA is the evidence that a security breach has occurred, and IoC allows organizations to act before the vulnerability can be exploited
  • C. IoC refers to the individual responsible for the security breach, and IoA refers to the resulting loss
  • D. IoC is the evidence that a security breach has occurred, and IoA allows organizations to act before the vulnerability can be exploited
Show Answer
Correct Answer:
D. IoC is the evidence that a security breach has occurred, and IoA allows organizations to act before the vulnerability can be exploited
Question 8

One of the objectives of information security is to protect the CIA of information and systems. What does CIA mean in this context?

  • A. confidentiality, identity, and authorization
  • B. confidentiality, integrity, and authorization
  • C. confidentiality, identity, and availability
  • D. confidentiality, integrity, and availability
Show Answer
Correct Answer:
D. confidentiality, integrity, and availability
Question 9

What are indicators of attack?

  • A. large numbers of requests for the same file
  • B. multiple log ins from different regions
  • C. swells in database read volume
  • D. suspicious registry or system file changes
Show Answer
Correct Answer:
B. multiple log ins from different regions
Question 10

What is a comparison between rule-based and statistical detection?

  • A. Statistical is based on measured data while rule-based uses the evaluated probability approach
  • B. Statistical uses the probability approach while rule-based is based on measured data
  • C. Rule-based is based on assumptions and statistical uses data known beforehand
  • D. Rule-based uses data known beforehand and statistical is based on assumptions
Show Answer
Correct Answer:
D. Rule-based uses data known beforehand and statistical is based on assumptions
Question 11

What is obtained using NetFlow?

  • A. full packet capture
  • B. session data
  • C. application logs
  • D. network downtime report
Show Answer
Correct Answer:
B. session data
Question 12

Which technology should be used to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes?

  • A. AWS
  • B. IIS
  • C. Load balancer
  • D. Proxy server
Show Answer
Correct Answer:
C. Load balancer
Question 13

Which two elements are assets in the role of attribution in an investigation? (Choose two.)

  • A. context
  • B. session
  • C. laptop
  • D. firewall logs
  • E. threat actor
Show Answer
Correct Answer:
  • C. laptop
  • D. firewall logs
Question 14

Which security principle requires more than one person is required to perform a critical task?

  • A. least privilege
  • B. need to know
  • C. separation of duties
  • D. due diligence
Show Answer
Correct Answer:
C. separation of duties
Question 15

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

  • A. encapsulation
  • B. TOR
  • C. tunneling
  • D. NAT
Show Answer
Correct Answer:
D. NAT
Question 16

What is a sandbox interprocess communication service?

  • A. collection of rules within the sandbox that prevent the communication between sandboxes
  • B. collection of network services that are activated on an interface, allowing for inter-port communication
  • C. collection of interfaces that allow for coordination of activities among processes
  • D. collection of host services that allow for communication between sandboxes
Show Answer
Correct Answer:
C. collection of interfaces that allow for coordination of activities among processes
Question 17

Which attack method is being used when an attacker tries to compromise a network with an authentication system that uses only 4-digit numeric passwords and no username?

  • A. replay
  • B. SQL injection
  • C. dictionary
  • D. cross-site scripting
Show Answer
Correct Answer:
C. dictionary
Question 18

An engineer is working on the implementation of digital certificates for new critical web applications. One of the requirements is that the https connection must be validated and protected against malicious network impersonators. The server will be exposed externally from the DMZ network. Which certificate must be used?

  • A. X.509
  • B. private CA
  • C. SSLv3
  • D. TLS1.1
Show Answer
Correct Answer:
A. X.509
Question 19

The security team has detected an ongoing spam campaign targeting the organization. The team's approach is to push back the cyber kill chain and mitigate ongoing incidents. At which phase of the cyber kill chain should the security team mitigate this type of attack?

  • A. installation
  • B. reconnaissance
  • C. actions
  • D. delivery
Show Answer
Correct Answer:
D. delivery
Question 20

What matches the regular expression c(rgr)+e?

  • A. c(rgr)e
  • B. crgrrgre
  • C. crgr+e
  • D. ce
Show Answer
Correct Answer:
A. c(rgr)e

200-201 sample questions FAQ

Are these 200-201 sample questions from the real exam?

No. They are original practice questions written to match the format and topic mix of the Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) exam, which contains around 100 questions. Treat them as representative practice, not leaked exam content.

How many free 200-201 sample questions do I get?

This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 245+ questions.

Do the sample questions include the correct answers?

Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.

Is 20 sample questions enough to pass the 200-201?

Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 245+ question set under timed conditions before booking the exam.

Aced these? Get the Full Exam

Download the complete 200-201 study bundle with 245+ questions in a single printable PDF.