Free Performing Cybersecurity Using Cisco Security Technologies Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Performing Cybersecurity Using Cisco Security Technologies practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A response playbook lists named staff, a designated incident manager, and surge support assignments. Which component do these entries primarily define?

   1. A. Incident evidence retention
   2. B. Response roles and responsibilities
   3. C. Technical indicators of compromise
   4. D. System recovery validation criteria

   Answer: B

   Explanation: CISA calls for plans with "assigned roles and responsibilities." Named staff and surge assignments establish who performs response duties, rather than the evidence, indicators, or recovery criteria.

   Reference: Cybersecurity Incident & Vulnerability Response Playbooks — Preparation Activities — Policies and Procedures, p. 7

2. 2A SOC needs to separate statistically unusual network requests from normal requests before classifying possible threats. Which technique in the documented Cisco Secure Network Analytics pipeline fits this first task?

   1. A. Relationship modeling
   2. B. Event classification
   3. C. Anomaly detection
   4. D. Entity modeling

   Answer: C

   Explanation: Cisco says "anomaly detection employs statistical machine learning methods" to separate normal from anomalous traffic. Classification assigns threat categories later; entity and relationship modeling aggregate contextual evidence.

   Reference: Cisco Security Analytics White Paper — Layer 1 — Anomaly detection

3. 3A threat model identifies an attacker changing transaction amounts while data travels between application components. Which STRIDE category describes this threat?

   1. A. Information disclosure
   2. B. Denial of service
   3. C. Tampering
   4. D. Repudiation

   Answer: C

   Explanation: Microsoft defines tampering as "malicious modification of data." The modeled transaction alteration is an integrity threat rather than unauthorized reading, service denial, or denial of having performed an action.

   Reference: Threat Modeling Tool Threats — Microsoft — STRIDE model — Tampering

4. 4Which capability distinguishes a SOAR platform's execution role from simply storing and searching security logs?

   1. A. Retaining original log files for later examination
   2. B. Executing playbooks that automate security operations tasks
   3. C. Indexing timestamps to make event records searchable
   4. D. Normalizing field names across different log sources

   Answer: B

   Explanation: Cisco describes SOAR as automating tasks by "deploying and executing playbooks". Log retention, indexing, and normalization support security data analysis, but playbook execution carries out the operational workflow.

   Reference: Designing Security Automation Playbooks — Sharing Lessons Learned with Practitioners — Introduction

5. 5An incident playbook includes a checklist with an action taken field and a completion date for each procedure. What is the primary purpose of this component?

   1. A. Assign a confidence score to each indicator
   2. B. Estimate the probability of each threat event
   3. C. Record response progress against required activities
   4. D. Define the financial impact of each affected asset

   Answer: C

   Explanation: The playbook states that Appendix B "provides a companion checklist to track activities to completion." Action and date entries track execution rather than indicator confidence, threat likelihood, or asset valuation.

   Reference: Cybersecurity Incident & Vulnerability Response Playbooks — Incident Response Process, p. 5

6. 6A SOC already has a statistically anomalous subset of traffic and needs to label events as categories such as command and control or unauthorized software updates. Which stage of the documented Cisco analytics pipeline should it use?

   1. A. Event classification
   2. B. Trust modeling
   3. C. Relationship modeling
   4. D. Anomaly detection

   Answer: A

   Explanation: Cisco states, "The statistically anomalous subset from the previous layer is classified into 100 or more categories using classifiers." Event classification supplies the requested labels; the other stages filter anomalies or model contextual relationships.

   Reference: Cisco Security Analytics White Paper — Layer 2 — Event classification

7. 7A threat model shows that users can perform sensitive actions and later deny performing them because no evidence can establish who acted. Which STRIDE threat is represented?

   1. A. Repudiation
   2. B. Tampering
   3. C. Spoofing
   4. D. Denial of service

   Answer: A

   Explanation: Microsoft associates repudiation with users who "deny performing an action". The missing attribution evidence enables that denial; the scenario does not require data alteration, another identity, or an outage.

   Reference: Threat Modeling Tool Threats — Microsoft — STRIDE model — Repudiation

8. 8Several SOAR workflows need the same reusable IP reputation lookup. Following Cisco's modular playbook guidance, how should that lookup be organized?

   1. A. Copy the full investigation workflow into every lookup step
   2. B. Combine lookup, containment, and reporting into each reusable lookup
   3. C. Create a reusable component centered on the lookup's single function
   4. D. Use a separate incompatible lookup implementation for every workflow

   Answer: C

   Explanation: Cisco says an atomic playbook should pivot on "one core function". A reusable lookup component follows that modular boundary; copying complete workflows or bundling unrelated functions makes reuse less focused.

   Reference: Designing Security Automation Playbooks — Sharing Lessons Learned with Practitioners — Modularity

9. 9A playbook requires preserving both the current memory contents and the persistent storage of a suspected compromised endpoint for forensic examination. Which capability should the responder select?

   1. A. Acquire a disk image and a live memory image
   2. B. Acquire a disk image and export filesystem metadata
   3. C. Acquire a live memory image and a process list
   4. D. Export installed software and operating system logs

   Answer: A

   Explanation: CISA specifies "disk and active memory imaging" for forensic evidence collection. A disk image preserves persistent storage and a live memory image preserves current memory. Disk metadata alone misses live memory, runtime lists miss stored contents, and software/log exports do not capture both.

   Reference: Cybersecurity Incident & Vulnerability Response Playbooks — Technical Infrastructure, p. 9

10. 10What distinguishes a CIS Hardened Image from a general-purpose virtual machine image?

    1. A. It contains the organization's current production data
    2. B. It includes a completed penetration test of deployed applications
    3. C. It provides automatic authorization for regulated workloads
    4. D. It includes a security configuration based on CIS Benchmarks

    Answer: D

    Explanation: CIS states, "Virtual machine (VM) images are pre-hardened to the CIS Benchmarks®". This supplies a secure configuration starting point rather than production data, application test results, or workload authorization.

    Reference: CIS Hardened Images — CIS Hardened Images — opening description