Question bank
Cisco Certified Cybersecurity Associate (CyberOps)
40 Cisco Certified Cybersecurity Associate (CyberOps) questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Access and Identity Management
6 questions in this domain
- Question 1Single Choice
A user checks a file hash and verifies that the file has not been changed. Which security goal is being validated?
- AAvailability
- BConfidentiality
- CIntegrityCorrect answer
- DNon-repudiation
Why this is the answer
A hash or digest match confirms that data has not been altered, which is integrity. Non-repudiation concerns proof of an action rather than data accuracy.
- Question 2Multiple Select
Which two statements about Cisco AAA are correct?
- AAAA can use local user accounts instead of a central server.Correct answer
- BLocal AAA authentication requires RADIUS.
- CCisco devices can authenticate users by using the device's local database.Correct answer
- DAn external AAA server is mandatory for every AAA implementation.
Why this is the answer
Cisco AAA can be implemented locally without a RADIUS server. Local authentication uses accounts stored on the device.
- Question 3Interactive
The exhibit shows an uptime metric and a response-time metric. Which classification is correct?
- AMetric A measures availability; Metric B measures performance.Correct answer
- BMetric A measures performance; Metric B measures availability.
- CBoth metrics measure confidentiality.
- DBoth metrics measure non-repudiation.
Why this is the answer
Availability relates to uptime and access, while performance relates to speed and response time. Neither metric measures confidentiality or non-repudiation.
- Question 4Single Choice
Which subjects must be included when an access plan implements least privilege?
- AHuman users only
- BHuman users, processes, and servicesCorrect answer
- COnly server administrator accounts
- DOnly third-party applications
Why this is the answer
Least privilege applies to human users and also to processes and services. People are not the only subjects that need limited rights.
- Question 5Multiple Select
Which two statements reflect the continuous nature of risk assessment?
- APerform a baseline risk assessment one time and never update it.
- BUpdate the risk assessment after significant system changes.Correct answer
- CConduct risk assessment repeatedly as part of normal operations.Correct answer
- DOnly conduct risk assessment during annual compliance audits.
Why this is the answer
Risk assessment is not a one-time project. It must be repeated after system changes and as new threats and risks appear.
- Question 6Interactive
The exhibit lists NIST incident response phases in order. What is the correct way to apply them?
- AThey must be followed only once in the displayed order.
- BThe process is iterative, and teams may return to an earlier phase.Correct answer
- CThe process always begins with post-incident activity.
- DThe order forbids repeating any phase.
Why this is the answer
NIST phases are presented sequentially for clarity, but actual incident response is iterative. Analysts may return to earlier phases as new information emerges.
Cryptography and PKI
4 questions in this domain
- Question 7Single Choice
A security analyst checks that a downloaded file matches the vendor's published hash. Which cryptographic property is being verified?
- AIntegrityCorrect answer
- BConfidentiality
- CAvailability
- DNon-repudiation
Why this is the answer
Matching a file against its original hash detects unauthorized changes, so the verified property is integrity. Confidentiality, availability, and non-repudiation address different concerns.
- Question 8Multiple Select
Which two security properties are commonly confused because both can use hashing and digital signatures in a PKI?
- AIntegrityCorrect answer
- BNon-repudiationCorrect answer
- CConfidentiality
- DAvailability
Why this is the answer
Integrity confirms data was not modified, while non-repudiation provides proof of the action or origin. They can both be involved when hashing and digital signatures are used.
- Question 9Interactive
A technician runs the command shown in the code block and later compares its output with an original digest. Which security property is being verified?
- AData integrityCorrect answer
- BNon-repudiation
- CConfidentiality
- DAvailability
Why this is the answer
A hash digest is a fingerprint of the data. If the content changes, the digest changes, so comparing digests detects modifications and supports integrity.
- Question 10Single Choice
A sales manager sends a proposal but later claims he never signed it. Which security property prevents this denial?
- ANon-repudiationCorrect answer
- BData integrity
- CConfidentiality
- DAvailability
Why this is the answer
Non-repudiation provides undeniable evidence that a specific person performed an action. A valid digital signature prevents a signer from later denying the signature.
Network Security
10 questions in this domain
- Question 11Single Choice
In a cybersecurity context, what does the integrity property guarantee about stored or transmitted data?
- AData remains unchanged from its original authorized stateCorrect answer
- BA sender is unable to deny sending the data
- CData and services are available when needed
- DA user's identity is verified before access
Why this is the answer
Integrity ensures data is unchanged by unauthorized parties. Non-repudiation, availability, and authentication describe different security objectives.
- Question 12Multiple Select
A security analyst is explaining data protections. Which three statements correctly separate integrity from non-repudiation?
- AHashing can detect unauthorized changes to dataCorrect answer
- BDigital signatures are commonly used to support non-repudiationCorrect answer
- CA hash alone proves who originally created a message
- DNon-repudiation prevents a sender from denying an actionCorrect answer
Why this is the answer
Hashes detect modification, while non-repudiation binds an identity to an action. Digital signatures help prevent denial of origin or delivery.
- Question 13Interactive
Review the Cisco IOS configuration. Which statement best describes how AAA authentication is performed on this device?
- ALocal usernames defined on the deviceCorrect answer
- BAn external RADIUS authentication server
- CA Kerberos realm located in the cloud
- DNo authentication is configured on this device
Why this is the answer
The keyword local means authentication uses the username database stored on the device. An external RADIUS or TACACS+ server is not referenced.
- Question 14Single Choice
In the CIA triad, what does availability mean for authorized users of network resources?
- AResources are accessible and usable when authorized parties need themCorrect answer
- BResources respond at the fastest possible speed
- CResources do not change during transmission
- DResources are protected from unauthorized access
Why this is the answer
Availability focuses on uptime and accessibility for authorized users, not throughput or latency, which belong to performance.
- Question 15Multiple Select
A CyberOps analyst is reviewing current network health. Which two conditions are availability failures rather than performance issues?
- AA core switch has no power and users cannot reach applicationsCorrect answer
- BUsers receive HTTP 503 errors from a web server after a misconfigurationCorrect answer
- CThe web page loads slower after a marketing campaign begins
- DDatabase queries take twice as long during a large batch job
Why this is the answer
Power loss and HTTP 503 errors indicate that resources are not accessible. Slow page loads and slower database queries are performance degradation.
- Question 16Interactive
A risk register entry for a network vulnerability has been marked as Accepted. What is the correct interpretation of this status?
- AManagement has decided to tolerate the risk for nowCorrect answer
- BThe risk was never evaluated and can be ignored
- CThe risk was transferred to an external insurer
- DThe risk has been eliminated by security controls
Why this is the answer
Accepted means a deliberate management decision to retain residual risk. It is not ignoring, transferring, or eliminating the risk.
- Question 17Single Choice
According to the principle of least privilege, which subjects should be limited to the minimum access needed for their tasks?
- AUsers, processes, applications, and network devicesCorrect answer
- BOnly employees who operate network devices
- COnly external vendors and temporary contractors
- DOnly privileged domain administrators
Why this is the answer
Least privilege is not just for people; it extends to software processes, services, firewalls, and devices that need only required permissions.
- Question 18Multiple Select
A security architect applies least privilege to a multi-tenant application. Which two implementations are appropriate?
- AService accounts are granted rights for the specific tasks they performCorrect answer
- BNetwork ACLs deny traffic not explicitly required by an applicationCorrect answer
- CEvery employee has full administrative rights to avoid support requests
- DA vulnerability scanner runs as Domain Administrator to simplify credentials
Why this is the answer
Least privilege grants only necessary permissions. Default-deny ACLs and restricted service accounts limit the attack surface; blanket admin rights violate it.
- Question 19Interactive
Review the snippet from a Cisco router where two administrators have different privilege levels. Which principle does this configuration support?
- ALeast privilegeCorrect answer
- BNon-repudiation
- CRisk acceptance
- DUnrestricted access
Why this is the answer
Privilege levels restrict which IOS commands a user can enter. Level 5 is limited and level 15 is full, which is an application of least privilege.
- Question 20Single Choice
How should a CyberOps program treat risk assessment to stay current with evolving threats and changes in the network?
- AContinuous and repeated after major system changesCorrect answer
- BPerformed only once when the network is built
- CCompleted each time a new employee is hired
- DTriggered solely by customer complaints
Why this is the answer
Threats, vulnerabilities, and network architectures change over time. Risk assessment must be continuous and repeated after significant changes.
Security Concepts
8 questions in this domain
- Question 21Single Choice
According to the Cisco CyberOps security model, which objective makes certain that data is not altered or modified without authorization?
- AData confidentiality
- BSystem availability
- CData integrityCorrect answer
- DNon-repudiation assurance
Why this is the answer
Integrity protects the accuracy of data by preventing unauthorized changes. It is different from non-repudiation, which prevents someone denying their actions.
- Question 22Multiple Select
Which of the following statements correctly explain the relationship and difference between integrity and non-repudiation in cybersecurity?
- AIntegrity prevents unauthorized data modificationCorrect answer
- BNon-repudiation stops parties from denying actionCorrect answer
- CBoth use hashing and digital signaturesCorrect answer
- DNon-repudiation ensures encryption of data
Why this is the answer
Integrity addresses any unauthorized change to data. Non-repudiation addresses denial of an action. Hashing and digital signatures support both concepts.
- Question 23Interactive
Examine the Cisco device commands shown in the exhibit. How is authentication being implemented on this router?
- AAuthentication via RADIUS server
- BLocal AAA authenticationCorrect answer
- CAuthentication via TACACS+ server
- DUnauthenticated device access
Why this is the answer
The 'local' keyword tells the router to use its local username database rather than querying an external AAA server.
- Question 24Single Choice
In the Cisco CyberOps view of the CIA triad, what does availability mean for a service or resource?
- AUptime and user accessibilityCorrect answer
- BHigh performance and throughput
- CPrevention of unauthorized modification
- DGuaranteed confidentiality of data
Why this is the answer
Availability is concerned with uptime and authorized accessibility, not speed or throughput. Performance is not the same as availability in security.
- Question 25Multiple Select
According to Cisco Security guidance, which subjects should be subject to the principle of least privilege? Select all that apply.
- AUsers and their accountsCorrect answer
- BApplications and processesCorrect answer
- CNetwork devices and servicesCorrect answer
- DOnly human employees
Why this is the answer
Cisco stresses that least privilege is not limited to people; applications, processes, devices, and services should also receive only necessary access rights.
- Question 26Interactive
A cron job runs a security posture review every week as seen in the exhibit. Why is this regular schedule appropriate for risk management?
- ARisk assessment is a continuous processCorrect answer
- BRisk assessment is a one-time event
- CRisk assessment replaces security controls
- DRisk assessment is only needed after breaches
Why this is the answer
Performing repeated reviews supports a continuous risk management model instead of treating assessment as a single, finished activity.
- Question 27Single Choice
According to NIST guidance in the Cisco CyberOps course, which statement correctly describes the incident response process?
- AStrictly sequential, one phase at a time
- BIterative and sometimes overlappingCorrect answer
- COnly preparation and recovery are repeated
- DAlways linear from detection to recovery
Why this is the answer
NIST presents phases for clarity, but in practice incident response can be iterative, with steps repeating or overlapping as new information emerges.
- Question 28Multiple Select
Which of the following statements correctly describe risk acceptance in cybersecurity? Select all that apply.
- AIt is a deliberate management decisionCorrect answer
- BIt can be appropriate for low-impact risksCorrect answer
- CIt is not the same as ignoring the riskCorrect answer
- DIt means ignoring the risk entirely
Why this is the answer
Risk acceptance is deliberate, often for low-probability or low-impact situations. It is not ignoring a risk and should be formally decided by management.
Security Operations and Monitoring
12 questions in this domain
- Question 29Single Choice
Which security property is responsible for confirming that data has not been changed during storage or transmission?
- AConfidentiality
- BIntegrityCorrect answer
- CAvailability
- DNon-repudiation
Why this is the answer
Integrity is the assurance that data has not been altered. Non-repudiation relates to proving the origin of an action, not preventing data modification.
- Question 30Multiple Select
Which two security goals can be supported by the combined use of hashing and digital signatures?
- AConfidentiality
- BAvailability
- CIntegrityCorrect answer
- DNon-repudiationCorrect answer
Why this is the answer
Hashing detects unauthorized changes, supporting integrity. Digital signatures prove origin and prevent repudiation; confidentiality and availability require separate controls.
- Question 31Interactive
Examine the simple scenario shown in the code block and then identify the security property that is directly demonstrated.
- AIntegrityCorrect answer
- BNon-repudiation
- CAvailability
- DConfidentiality
Why this is the answer
Matching hashes show that the file was not modified, which is integrity. The claim that the sender never sent the file cannot be countered without non-repudiation.
- Question 32Single Choice
When configuring AAA on a Cisco network device, which implementation option is considered valid?
- AExternal RADIUS server only
- BExternal TACACS+ server only
- CLocal database or external AAA serverCorrect answer
- DAAA is unsupported
Why this is the answer
AAA can be implemented on the device itself using local usernames or centrally through servers such as RADIUS and TACACS+. It does not always require a server.
- Question 33Multiple Select
Which two statements about AAA implementation in a Cisco environment are true?
- AUses local device accountsCorrect answer
- BExternal AAA server is always required
- CCentralized RADIUS or TACACS+ serversCorrect answer
- DOnly supports accounting
Why this is the answer
Cisco devices can authenticate users locally in addition to using centralized AAA servers. An external server is not mandatory, and AAA covers authentication, authorization, and accounting.
- Question 34Interactive
Analyze the Cisco device configuration shown in the code block and state what it reveals about authentication.
- AExternal RADIUS server authentication
- BLocal username database authenticationCorrect answer
- CGuest access without authentication
- DAccounting only
Why this is the answer
The keyword local instructs the device to use its local user database when users attempt login; no external AAA server is referenced.
- Question 35Single Choice
In information security, what should the objective of availability guarantee for authorized users and systems?
- AFast responses at all times
- BAccessible when needed by authorized usersCorrect answer
- CEncrypted in storage
- DProof of transaction origin
Why this is the answer
Availability is about uptime and accessibility for authorized users when required. It is not synonymous with speed or performance.
- Question 36Multiple Select
Which two conditions are examples of protecting or maintaining availability in a monitored IT environment?
- ASystem accessible during defined operating hoursCorrect answer
- BResponse time below 50 milliseconds
- CAuthorized users can restore access after an outageCorrect answer
- DData is encrypted before transmission
Why this is the answer
Availability includes defined uptime, accessibility, and recovery after disruptions. Low latency is a performance measure, and encryption serves confidentiality.
- Question 37Interactive
Read the monitoring report in the code block and explain why the conclusion about availability is inaccurate.
- AConfidentiality
- BIntegrity
- CPerformanceCorrect answer
- DNon-repudiation
Why this is the answer
Availability is measured through uptime and accessibility. Reduced response time indicates improved performance, but it does not by itself prove increased availability.
- Question 38Single Choice
In a defense-in-depth security model, to which kinds of subjects should least privilege be applied?
- AHuman users only
- BProcesses and human usersCorrect answer
- CNetwork hardware serial numbers
- DCloud regions
Why this is the answer
Least privilege applies to users, devices, processes, and services, not exclusively to human users. Restricting privileges on every component reduces risk.
- Question 39Multiple Select
Which two types of subjects should least privilege apply to in a typical IT environment?
- AHuman user accountsCorrect answer
- BAutomated servicesCorrect answer
- CData classification labels
- DNetwork topology maps
Why this is the answer
The principle covers people as well as technical processes. Automated services and user accounts should both receive minimum necessary permissions.
- Question 40Interactive
Review the configuration note in the code block and determine which security principle is being violated.
- AProcesses run with excessive privilegesCorrect answer
- BData is not encrypted
- CThe server is overloaded
- DNo backup plan exists
Why this is the answer
Background processes have more permission than required for their task. Running everything with root authority violates least privilege and increases damage potential.
Frequently asked questions
Everything about the Cisco Certified Cybersecurity Associate (CyberOps) question bank and how to use it.