Exam Topics

The Cisco 200-201 exam will validate your skills and knowledge of security monitoring, security concepts, security policies & procedures, host-based analysis, and network intrusion analysis. All in all, its content comes with 5 topics that are listed as follows:

Security Concepts

This domain makes up 20% of the exam content and measures the applicants’ abilities to perform the following tasks:

• Analyze security deployments – It includes the agent-based and agentless protections as well as network, endpoint, and application security systems. You should also know about log management, SOAR & SIEM, and Legacy antivirus & antimalware;
• Explain the policies of the defense-in-depth approach;
• Classify the difficulties of data visibility in detention;
• Differentiate access control models – In this subsection, you are required to learn about discretionary, nondiscretionary, and mandatory access control, as well as authentication, accounting, and authorization;
• Define security terms – The potential candidates have to know about hunting, actor & threat intelligence, and TI platform, malware analysis, run book cybernation, as well as sliding window exception detection;
• Compare rule-based detection vs. behavioral and statistical detection;
• Compare various security concepts – As for this one, it covers the details of risk scoring, assessment, and reduction as well as vulnerability, exploit, and threat;
• Determine the possible data loss from the available traffic profiles;
• Understand CVSS – You need to have knowledge of the attack vector, privileges required, scope, and user interaction;
• Describe the 5-tuple method to separate a compromised host in a grouped set of logs.
• Define the CIA triad;

Understanding functional and technical aspects of Cisco Cybersecurity Operations Fundamentals v1.0 (200-201 CBROPS) Host-Based Analysis

The following will be discussed in CISCO 200-201 exam dumps:

• Understanding Common TCP/IP Attacks
• Interpret operating system, application, or command line logs to identify an event
• Understanding Windows Operating System Basics
• Assets
• Chain of custody
• Exploring Data Type Categories
• Understanding Endpoint Security Technologies
• Understanding Event Correlation and Normalization
• Antimalware and antivirus
• Interpret the output report of a malware analysis tool (such as a detonation chamber or sandbox)
• Describe the functionality of these endpoint technologies in regard to security monitoring
• Using a Playbook Model to Organize Security Monitoring
• Compare tampered and untampered disk image
• Conducting Security Incident Investigations
• Identifying Patterns of Suspicious Behavior
• Corroborative evidence
• Describing Incident Response
• URLs
• Host-based intrusion detection
• Identifying Common Attack Vectors
• Best evidence
• Understanding SOC Metrics
• Identify type of evidence used based on provided logs
• Understanding Incident Analysis in a Threat-Centric SOC
• Understanding Network Infrastructure and Network Security Monitoring Tools
• Identifying Malicious Activity
• Systems, events, and networking
• Understanding Basic Cryptography Concepts
• Understanding the Use of VERIS
• Indirect evidence
• Indicators of compromise
• Defining the Security Operations Center
• Identifying Resources for Hunting Cyber Threats
• Application-level allow listing/block listing
• Threat actor
• Identify components of an operating system (such as Windows and Linux) in a given scenario
• Indicators of attack
• Describe the role of attribution in an investigation
• Systems-based sandboxing (such as Chrome, Java, Adobe Reader)
• Hashes
• Understanding SOC Workflow and Automation
• Understanding Linux Operating System Basics
• Host-based firewall

Reference: https://www.cisco.com/c/en/us/training-events/training-certifications/exams/current-list/200-201-cbrops.html