Cisco Certified Network Associate (CCNA) Cybersecurity Operations — Practice Set 1

Question 1

An attacker sends a large volume of TCP SYN packets to a web server with spoofed source IP addresses, consuming all available half-open connection slots and preventing legitimate clients from connecting. Which attack does this describe?

Accepted Answer

A TCP SYN flood exploits the three-way handshake: the attacker sends SYN packets with spoofed source IPs, the server responds with SYN-ACK and allocates a half-open connection entry, but the ACK never arrives. This exhausts the server's connection table (backlog queue), preventing legitimate TCP connections. ARP spoofing poisons ARP caches to redirect traffic. DNS amplification uses DNS to flood a victim with traffic. SQL injection targets database query logic.

Question 2

A SOC analyst is reviewing RADIUS and TACACS+ authentication logs. Which statement correctly differentiates these two AAA protocols?

Accepted Answer

RADIUS uses UDP (ports 1812/1813) and encrypts only the password field in the Access-Request packet, leaving other attributes in plaintext. TACACS+ uses TCP (port 49) and encrypts the entire packet body, providing stronger confidentiality for AAA communications. TACACS+ separates authentication, authorisation, and accounting into distinct functions, whereas RADIUS combines authentication and authorisation. Both protocols can be used for wired and wireless environments.

Question 3

A security engineer explains that NAT/PAT complicates network security monitoring. Which monitoring challenge does NAT/PAT introduce?

Accepted Answer

Network Address Translation (NAT) and Port Address Translation (PAT) replace internal private IP addresses with a shared public IP address. When a SOC analyst sees an external connection from a public IP, they cannot identify which internal host initiated it without consulting NAT translation logs (or a network monitoring solution that correlates flows with NAT entries). NAT does not encrypt traffic, does not prevent stateful firewalls, and PAT changes source ports — not in a way that specifically breaks IPS signatures.

Question 4

A SOC analyst is comparing Windows and Linux security access models. In Windows, file permissions are governed by Discretionary Access Control (DAC). Which statement correctly describes DAC?

Accepted Answer

Discretionary Access Control (DAC) gives the resource owner the discretion to grant or deny access to other subjects. In Windows NTFS, the file or folder owner sets the ACL (Access Control List). Mandatory Access Control (MAC) uses system-enforced security labels that owners cannot override — this is used in SELinux and high-security environments. Role-Based Access Control (RBAC) assigns permissions based on organisational roles. A central policy engine describes MAC or RBAC, not DAC.

Question 5

A PKI administrator explains that a certificate has been revoked before its expiry date. An analyst asks how a client can check in real time whether a certificate is currently revoked without downloading the full Certificate Revocation List (CRL). Which protocol provides this capability?

Accepted Answer

OCSP (Online Certificate Status Protocol, RFC 6960) allows a client to query a CA's OCSP responder with a specific certificate's serial number and receive a real-time 'good', 'revoked', or 'unknown' response, without downloading the entire CRL. LDAP is a directory access protocol. SNMP is a network management protocol. RADIUS is an authentication protocol.

Question 6

A SOC analyst configures the SIEM to ingest logs from multiple sources. Which log source provides authentication event data from network devices such as Cisco routers and switches?

Accepted Answer

Cisco IOS routers and switches send syslog messages to a syslog server, including authentication events, configuration changes, and interface state changes. NetFlow provides IP traffic flow statistics (source/destination IPs, ports, byte counts) but not authentication events. HTTP access logs record web server requests. Windows Security Event logs record Windows-specific authentication events (Event IDs 4624, 4625, etc.).

Question 7

A SOC analyst wants to use a regular expression to search SIEM logs for all lines containing an IPv4 address in the format 192.168.x.x where x is any number from 0 to 255. Which regex pattern correctly matches this?

Accepted Answer

In regex, a dot (.) is a metacharacter matching any character; to match a literal dot it must be escaped as \. The pattern \d+ matches one or more digits (0–9), which covers any octet value. So 192\.168\.\d+\.\d+ correctly matches addresses like 192.168.1.1 through 192.168.255.255. Option B uses unescaped dots and * without quantifier context. Option C uses hyphens, not dots, and [0-9] matches only a single digit. Option D matches only the literal string '192.168.[255].[255]'.

Question 8

While analysing a packet capture in Wireshark, a SOC analyst notices that a host is sending DNS queries for random-looking subdomains of a single parent domain every 60 seconds (e.g., a1b2c3.evil.com, d4e5f6.evil.com). The responses contain TXT records with long encoded strings. Which attack technique does this MOST likely represent?

Accepted Answer

DNS tunnelling encodes data (commands, exfiltrated data) within DNS query and response records (commonly TXT, CNAME, or A records). The attacker registers a domain and controls the authoritative DNS server; the malware on the victim encodes data as subdomain labels in queries. The randomised subdomain names, regular beacon interval, and TXT records with encoded payloads are hallmark indicators of DNS tunnelling for C2 or data exfiltration. ARP poisoning operates at Layer 2. A DNS zone transfer uses AXFR and appears as one large transfer. BGP hijacking affects routing tables.

Question 9

A SOC analyst reviews firewall logs and finds the following entry:

Feb 17 14:32:11 fw01 %ASA-4-106023: Deny tcp src outside:203.0.113.45/54321 dst inside:10.1.1.50/22 by access-group 'OUTSIDE_IN'

What does this log entry indicate?

Accepted Answer

The Cisco ASA syslog message %ASA-4-106023 indicates an explicit deny action from an access control list (ACL). The log shows: source is the 'outside' interface with IP 203.0.113.45 port 54321; destination is the 'inside' interface at 10.1.1.50 port 22. The traffic was denied by the 'OUTSIDE_IN' access group. Port 22 is SSH. The direction is external-to-internal (inbound). The word 'Deny' confirms the traffic was blocked, not allowed.

Question 10

A SOC analyst is tuning an IDS. The system generates an alert every time it sees an HTTP request containing the string '/etc/passwd'. Many legitimate internal security scanners also trigger this signature. What type of alert does this represent?

Accepted Answer

A false positive occurs when a security tool generates an alert for activity that is actually benign or authorised. The internal security scanners are legitimate tools, yet they trigger the IDS signature. This is a false positive. A true positive is a correct alert for a real attack. A false negative is a missed real attack (no alert generated). A true negative means no alert and no attack — the normal, desired state.

Question 11

A SOC analyst is reviewing NetFlow data exported from a core router. Which information is typically available in a NetFlow record?

Accepted Answer

NetFlow records contain metadata about IP traffic flows: source and destination IP addresses, source and destination ports, IP protocol (TCP/UDP/ICMP), interface index, byte count, packet count, and timestamps. NetFlow does not capture packet payloads (that requires full packet capture). It does not contain MAC addresses at the flow level or Windows Event IDs.

Question 12

A SOC analyst is investigating a potential brute-force login attack on a Windows server. Which Windows Security Event ID should the analyst filter for to find failed logon attempts?

Accepted Answer

Windows Security Event ID 4625 is generated for every failed logon attempt on a Windows system. Multiple 4625 events in rapid succession from the same source indicate a brute-force or password-spraying attack. Event ID 4624 records successful logons. Event ID 4688 records process creation events. Event ID 7045 records a new service being installed on the system.

Question 13

A SOC analyst investigating a compromised Linux server wants to identify which accounts have recently logged in successfully. Which log file should the analyst examine?

Accepted Answer

/var/log/auth.log (or /var/log/secure on RHEL-based distributions) records authentication events including successful and failed logins, sudo usage, and SSH sessions. /etc/passwd stores account information (username, UID, shell) but not login history. /etc/shadow stores hashed passwords. /var/log/dmesg records kernel ring buffer messages related to hardware and boot events.

Question 14

A SOC analyst reviewing Windows Event ID 4688 logs notices a process named 'svchost.exe' with a parent process of 'cmd.exe'. Why is this suspicious?

Accepted Answer

The legitimate Windows svchost.exe (Service Host) process is always a child of services.exe (the Service Control Manager). If Event ID 4688 shows svchost.exe being spawned by cmd.exe or any other unexpected parent, it strongly suggests that malware is using a process named 'svchost.exe' to blend in with legitimate system processes — a technique called process masquerading. Analysts use parent-child process relationship analysis to detect this type of anomaly.

Question 15

During incident response, a SOC analyst computes the SHA-256 hash of a suspicious executable found on a workstation and compares it against a threat intelligence feed. The hash matches a known malware family. What does this hash comparison confirm?

Accepted Answer

A cryptographic hash (SHA-256) is a fingerprint of a file's contents. If the computed hash matches a known malware hash in a threat intelligence database, it confirms with very high confidence that the file is identical to the known malicious sample. Hashing does not reveal who created the file, whether it is encrypted, or when it was downloaded.

Question 16

A SOC analyst reviews the following Snort rule:

alert tcp any any -> 192.168.1.0/24 80 (msg:"HTTP scan detected"; flags:S; threshold:type both, track by_src, count 20, seconds 10; sid:1001;)

What does this rule do?

Accepted Answer

The Snort rule has action 'alert', so it generates an alert (it does not drop traffic — 'drop' would be the action for inline IPS blocking). The 'flags:S' option matches TCP packets with only the SYN flag set. The threshold keyword with 'type both, track by_src, count 20, seconds 10' fires the alert when a single source IP sends 20 or more matching packets within any 10-second window. This is a classic SYN scan / port scan detection rule against web servers.

Question 17

A CVSS v3.1 base score for a vulnerability shows: Attack Vector (AV): Network, Attack Complexity (AC): Low, Privileges Required (PR): None, User Interaction (UI): None, Scope (S): Changed, Confidentiality (C): High. Which statement about this vulnerability is correct?

Accepted Answer

CVSS v3.1 base metrics: AV:Network means the vulnerability is exploitable remotely over a network. AC:Low means exploitation is straightforward with no special conditions. PR:None means no authentication is needed. UI:None means no victim interaction is required. S:Changed means a successful exploit can affect components beyond the vulnerable component's security scope. C:High means complete loss of confidentiality. This profile describes a critical, remotely exploitable, unauthenticated vulnerability.

Question 18

The MITRE ATT&CK framework organises adversary behaviour into tactics and techniques. A SOC analyst identifies that an attacker used a scheduled task to execute a payload every time the system reboots. Under which ATT&CK tactic does this behaviour fall?

Accepted Answer

In the MITRE ATT&CK framework, 'Persistence' is the tactic covering techniques that allow adversaries to maintain their foothold across system restarts, credential changes, or other interruptions. Using a scheduled task (T1053.005 on Windows) to execute malware at startup is a persistence technique. 'Initial Access' covers gaining the initial foothold. 'Exfiltration' covers stealing data. 'Discovery' covers techniques for learning about the environment.

Question 19

A SOC analyst reviews a packet capture and observes a host performing a TCP connect scan. The source sends a SYN to a port; the target replies SYN-ACK; the source completes the handshake with ACK and then immediately sends RST. What does a SYN-ACK response from the target indicate about that port?

Accepted Answer

In a TCP port scan, a SYN-ACK response means the port is open and the service is listening — the target accepted the connection initiation. A closed port would reply with RST-ACK. A filtered port (firewall dropping packets) produces no response or an ICMP port-unreachable message, not SYN-ACK. The attacker then sends RST to cleanly tear down the connection without completing a full session (this is characteristic of a TCP connect scan).

Question 20

The Diamond Model of Intrusion Analysis has four core features. A SOC analyst is documenting an incident where an APT group used spear-phishing emails containing malicious PDF attachments to compromise users at a defence contractor. Which four Diamond Model features apply here?

Accepted Answer

The Diamond Model of Intrusion Analysis defines four core features: Adversary (the threat actor — the APT group), Capability (what the adversary used — the malicious PDF attachment), Infrastructure (the systems/channels used to deliver the capability — the spear-phishing email infrastructure), and Victim (the target — defence contractor employees). The other options describe the NIST CSF (B and C) and ATT&CK TTP terminology (D).

Question 21

An organisation uses the NIST Cybersecurity Framework (CSF). The team is implementing controls to limit the impact of a potential cybersecurity event, including access controls, network segmentation, and data encryption. Under which NIST CSF function do these activities fall?

Accepted Answer

The NIST CSF 'Protect' function encompasses the implementation of safeguards to ensure delivery of critical services, including access control, awareness training, data security (encryption), information protection processes, maintenance, and protective technologies. 'Identify' covers asset management and risk assessment. 'Detect' covers monitoring and anomaly detection. 'Respond' covers actions taken during a detected incident.

Question 22

A company classifies all data it handles. Customer names and contact details are classified as 'Confidential'. Publicly available marketing brochures are classified as 'Public'. Which data classification level would a company's unpublished quarterly earnings report MOST appropriately receive?

Accepted Answer

An unpublished quarterly earnings report contains highly sensitive financial information that, if disclosed prematurely, could violate securities regulations and cause severe business harm. This warrants the highest internal classification level — often called 'Restricted' or 'Highly Confidential' — which limits access to a small group and applies the strictest handling controls. 'Confidential' typically covers sensitive operational data accessible to employees with a need-to-know. 'Internal Use Only' covers general employee information. 'Public' is for information intended for external audiences.

Question 23

A tier 1 SOC analyst receives an alert for a host communicating with a known malicious IP address. After confirming the alert is a true positive, what should the tier 1 analyst do NEXT according to standard SOC procedures?

Accepted Answer

A tier 1 SOC analyst's primary responsibilities are alert triage, initial investigation, and escalation. After confirming a true positive, the analyst documents all findings in the incident ticket and escalates to tier 2 for deeper analysis, root cause determination, and containment decisions. Tier 1 does not independently make remediation decisions such as reimaging systems. External notification follows a defined incident response and communication plan, not ad hoc analyst action. Offensive hacking back is illegal without specific authorisation.

Question 24

An organisation must comply with GDPR. A customer requests that the company delete all personal data the company holds about them. Under GDPR, what right does this request invoke?

Accepted Answer

GDPR Article 17 establishes the 'right to erasure', commonly known as the 'right to be forgotten'. It allows individuals to request that an organisation delete their personal data under certain conditions (e.g., the data is no longer necessary for its original purpose). Article 15 covers the right to obtain a copy of one's data (right of access). Article 16 is the right to correct inaccurate data. Article 20 covers the right to receive one's data in a machine-readable format.

Question 25

A SOC has documented an incident response runbook for ransomware. After the malware is identified on a workstation, the runbook instructs the analyst to immediately isolate the workstation from the network. Which incident response phase and purpose does this action represent?

Accepted Answer

Isolating an infected workstation from the network is a containment action. Containment limits the spread of the incident and minimises further damage — in a ransomware scenario, network isolation prevents the malware from encrypting mapped network drives or laterally infecting other hosts. Eradication involves removing the malware and closing the vulnerability after containment. Recovery restores services. Lessons learned occurs after the incident is fully resolved.

200-201 CBROPS — Cisco Certified Network Associate (CCNA) Cybersecurity Operations