200-201 CBROPS practice examsUpdate in progress
Cisco Certified CyberOps Associate
The analyst credential for a security operations centre: the kill chain, diamond model and technique catalogue as ways of reasoning about an intrusion, the monitoring data types and why session data earns its cost, detection quality with false negatives as the dangerous class, and network artefacts when payloads are encrypted; then host telemetry where parent process and command line carry the meaning, order of volatility and evidence handling, the response lifecycle and triage, and playbooks and reports that separate observation from inference.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Security Concepts | 20% |
| Security Monitoring | 25% |
| Host-Based Analysis | 20% |
| Network Intrusion Analysis | 20% |
| Security Policies and Procedures | 15% |
Two sample questions
1. What does the kill chain describe?
- Stages of an attack — correct
- A firewall rule
- A log format
- A subnet by default
Why: The kill chain describes attack stages.
2. What does a parent process reveal?
- The payload
- What launched a process — correct
- The subnet as configured
- The alert in this setup
Why: The parent shows what launched a process.
The real 200-201 CBROPS exam
| Length | 120 minutes |
|---|---|
| Questions | 95 to 105 |
| Pass mark | Scaled score; Cisco does not publish the percentage |
| Price | Purchased per attempt through Pearson VUE |
| Recommended before you sit it | None enforced. Networking fundamentals are assumed. |
| Valid for | 3 years |
Exam facts as published by Cisco; always check the vendor’s page before you book.
Study 200-201 CBROPS with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.