Question bank
Cisco Certified CyberOps Professional
40 Cisco Certified CyberOps Professional questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Programmability and Automation
4 questions in this domain
- Question 1Single Choice
Which type of algorithm should be used when the primary goal is to ensure data confidentiality?
- AEncryption, such as AESCorrect answer
- BHashing, such as SHA-256
- CMessage authentication, such as HMAC
- DChecksum, such as CRC32
Why this is the answer
Encryption is the reversible transformation that protects confidentiality. Hashing and checksums are used for integrity, while HMAC provides authentication and integrity.
- Question 2Multiple Select
Which two statements correctly differentiate hashing from encryption?
- AEncryption is reversible when the appropriate key is available.Correct answer
- BHashing creates a fixed-size digest used primarily to verify integrity.Correct answer
- CHashing is a reversible process if the hash value is known.
- DEncryption is normally a one-way operation that cannot reveal the original data.
Why this is the answer
Encryption is reversible if you have the correct key, while hashing is one-way and produces a fixed-size digest for integrity verification. Reversing a hash or treating encryption as one-way are common misconceptions.
- Question 3Interactive
Review the code snippet. Which cryptographic operation does the code perform?
- AHashingCorrect answer
- BSymmetric encryption
- CAsymmetric encryption
- DDigital signature
Why this is the answer
The code calls hashlib.sha256(...).hexdigest(), producing a digest. No key is used and no decryption exists, so the operation is hashing, not encryption, signing, or key exchange.
- Question 4Single Choice
In a public key infrastructure, which action is performed using the CA's private key?
- ATo sign digital certificatesCorrect answer
- BTo verify a user's public key signature
- CTo encrypt all traffic between clients and servers
- DTo hash certificate revocation lists
Why this is the answer
In PKI, the CA uses its private key to sign certificates. Verification is performed with the CA's public key, not the private key.
Security Architecture
8 questions in this domain
- Question 5Single Choice
What type of cryptographic operation is used to keep data confidential so that unauthorized parties cannot read it?
- AEncryptionCorrect answer
- BHashing
- CDigital signing
- DMessage authentication
Why this is the answer
Encryption transforms plaintext into ciphertext to provide confidentiality. Hashing, signing, and MACs are used for integrity, authenticity, or non-repudiation, not secrecy.
- Question 6Multiple Select
Which statements correctly describe cryptographic hash functions? Select all that apply.
- AHash functions are one-way and produce a fixed-size output.Correct answer
- BA small change in input produces a completely different hash value.Correct answer
- CHash functions are reversible with the correct decryption key.
- DHash functions encrypt data to hide it from unauthorized readers.
Why this is the answer
Cryptographic hashes are deterministic one-way functions; they provide integrity and an avalanche effect, not confidentiality. Hashing is not encryption and cannot be reversed with a key.
- Question 7Interactive
Look at the command in the code block. What security purpose does this command primarily perform?
- AGenerate an integrity digestCorrect answer
- BEncrypt the text for confidentiality
- CDigitally sign with a private key
- DEstablish a VPN session
Why this is the answer
The command calculates a hash digest of the input. Hashing verifies integrity by detecting changes, but it does not encrypt, sign, or establish sessions.
- Question 8Single Choice
Why is it incorrect to assume longer keys always provide stronger security for all algorithms?
- AKey sizes are comparable only when algorithms have similar security models; different algorithms may require different key sizes.Correct answer
- BLonger keys are always weaker because they reduce algorithm strength.
- CAll algorithms require the same key length for equivalent security.
- DKey length has no effect on algorithm strength.
Why this is the answer
AES and RSA use different mathematical structures, so bit lengths are not directly interchangeable. A longer key does not automatically make any algorithm stronger or more appropriate.
- Question 9Multiple Select
Which statements are true about Perfect Forward Secrecy? Select all that apply.
- APFS uses ephemeral session keys so past sessions are not exposed if the long-term key is compromised.Correct answer
- BPFS makes it possible to recover old session keys by decrypting traffic with the server's static private key.
- CPFS requires a key exchange algorithm such as DHE or ECDHE.Correct answer
- DPFS is only used for hashing passwords.
Why this is the answer
PFS relies on ephemeral Diffie-Hellman key exchange. Compromising a long-term private key does not reveal prior session keys because those keys are not derived from static key material alone.
- Question 10Interactive
The code block defines an IPsec transform set. What behavior is expected from the mode shown in the block?
- AOnly the payload of the original IP packet is protected.Correct answer
- BThe entire original IP packet is protected within a new IP header.
- CIPsec is disabled for packet headers.
- DIt encrypts only the IP header and leaves the payload clear.
Why this is the answer
In IPsec transport mode, only the IP payload is protected and the original header is preserved. Tunnel mode encapsulates and protects the entire original packet.
- Question 11Single Choice
In a public key infrastructure, what key does a certificate authority use to sign a certificate?
- ACA private keyCorrect answer
- BCA public key
- CSubscriber private key
- DPre-shared key
Why this is the answer
The CA signs certificates using its own private key. Relying parties verify the signature using the CA's public key.
- Question 12Multiple Select
Which statements accurately describe compliance versus security? Select all that apply.
- AA company that passes a compliance audit has eliminated all security risk.
- BCompliance frameworks represent a minimum baseline and do not guarantee full security.Correct answer
- CIt is possible for an organization to be compliant and still have serious attack paths.Correct answer
- DMeeting a compliance requirement automatically covers every risk in every environment.
Why this is the answer
Compliance demonstrates alignment with specific requirements, not total protection. Organizations must assess threats, implement internal controls, and sometimes exceed baseline minimums.
Security Concepts
4 questions in this domain
- Question 13Single Choice
Which of the following algorithms provides data confidentiality?
- AEncryptionCorrect answer
- BHashing
- CHMAC
- DDigital signature
Why this is the answer
Encryption is a reversible process that uses a key to protect data confidentiality. Hashing, HMACs, and digital signatures provide integrity and authenticity, not confidentiality.
- Question 14Multiple Select
Which two statements correctly distinguish hashing from encryption? Select all that apply.
- AHashing is a one-way function commonly used to verify integrity.Correct answer
- BEncryption is reversible if the recipient has the appropriate key.Correct answer
- CHashing ensures that the original data can be recovered using a private key.
- DEncryption always produces a fixed-length output regardless of input size.
Why this is the answer
Hashing is a one-way technique used for integrity, while encryption is reversible with the correct key. Hashing is not designed to recover the original input, and encryption does not produce a fixed-length output.
- Question 15Interactive
Using the command shown in the code block, which key does the CA use to sign the server certificate?
- AThe CA's private keyCorrect answer
- BThe CA's public key
- CThe server's private key
- DThe server's public key in the CSR
Why this is the answer
A certificate authority signs certificates using its own private key. The ca.key file referenced in the command is the CA private key, while ca.crt is the CA certificate containing the public portion.
- Question 16Single Choice
A VPN is configured with one static RSA key for every session. What risk does this create with regard to Perfect Forward Secrecy?
- ANo ephemeral per-session keys are used, so compromise of the long-term key exposes past traffic.Correct answer
- BThe RSA key is not strong enough to support modern VPN encryption.
- CStatic RSA keys cannot be used with IPsec, so the VPN will not encrypt traffic.
- DPerfect Forward Secrecy is only possible with pre-shared keys.
Why this is the answer
Perfect Forward Secrecy requires separate ephemeral keys for each session. When a single static key is reused, an attacker who later compromises that key can reconstruct past session keys and decrypt previously captured traffic.
Security Engineering
12 questions in this domain
- Question 17Single Choice
Which cryptographic process protects data confidentiality by turning readable input into ciphertext?
- AEncryptionCorrect answer
- BHashing
- CBase64 encoding
- DDigital signature
Why this is the answer
Encryption preserves confidentiality. Hashing provides integrity but is not reversible and does not protect confidentiality.
- Question 18Multiple Select
Which statements about hashing are correct? Select all that apply.
- AHash output can be reversed with a key
- BIt produces a fixed-size outputCorrect answer
- CA small input change changes the hashCorrect answer
- DHashing is a type of encryption
Why this is the answer
Hash functions are one-way and fixed-size. They act like fingerprints for integrity, not like encryption.
- Question 19Interactive
Examine the code block. Which property of the displayed command makes it useful for integrity verification?
- AIt is reversible
- BIt produces a one-way digestCorrect answer
- CIt uses symmetric encryption
- DIt outputs readable plaintext
Why this is the answer
The digest produced by the command is one-way; the original file cannot be recovered from it, which is ideal for integrity checking.
- Question 20Single Choice
When judging cryptographic strength, what must be considered in addition to key length?
- AThe algorithm typeCorrect answer
- BThe software logo
- CThe user's email address
- DThe cable color
Why this is the answer
Algorithm type and implementation matter. Long keys do not automatically make a weak or poorly implemented algorithm secure.
- Question 21Multiple Select
Which statements about cryptographic key length are accurate? Select all that apply.
- AA longer key always makes an algorithm secure
- BThe algorithm type affects how effective the key isCorrect answer
- CProper key management is also essentialCorrect answer
- DKey length has no effect on security at all
Why this is the answer
Security depends on algorithm type, key management, and key length. Longer keys do not automatically make weak algorithms secure.
- Question 22Interactive
Inspect the code block. What must be evaluated together with the key size to judge security?
- AAlgorithm typeCorrect answer
- BScreen resolution
- CRAM capacity
- DKeyboard layout
Why this is the answer
A 2048-bit key can still be secure only if the algorithm and its use are sound; algorithm type and key management must be checked.
- Question 23Single Choice
In a public key infrastructure (PKI), which key does a certificate authority use to sign certificates?
- AThe CA's private keyCorrect answer
- BThe CA's public key
- CThe certificate owner's password
- DThe certificate serial number
Why this is the answer
The CA signs with its private key. The CA's public key is used by relying parties to verify the signature.
- Question 24Multiple Select
Which statements about private keys in a PKI are true? Select all that apply.
- AA private key must remain secretCorrect answer
- BA CA uses its private key to sign certificatesCorrect answer
- CThe certificate contains the private key
- DThe private key is distributed to all users
Why this is the answer
Private keys are secret. The CA's private key signs certificates; public keys are shared inside certificates.
- Question 25Interactive
Review the command in the code block. Which file contains the secret key required for certificate signing?
- Aca.keyCorrect answer
- Bsigned.crt
- Crequest.csr
- Dpublic.pem
Why this is the answer
The code references the CA private key file, ca.key, which signs the certificate and must be protected.
- Question 26Single Choice
What is the main purpose of Perfect Forward Secrecy (PFS) in a VPN?
- AProtect old sessions if the long-term private key leaksCorrect answer
- BEncrypt only the new IP header
- CIncrease the packet delivery speed
- DRemove the need for user authentication
Why this is the answer
PFS uses ephemeral key exchange so past session keys cannot be recovered if a long-term private key is compromised.
- Question 27Multiple Select
Which statements about Perfect Forward Secrecy are correct? Select all that apply.
- AIt uses ephemeral key exchangeCorrect answer
- BIt protects past sessions after a long-term key leakCorrect answer
- CIt requires a static RSA key without exchange
- DIt disables encryption in the VPN tunnel
Why this is the answer
PFS relies on ephemeral keys. If the long-term key is compromised, past session keys remain protected.
- Question 28Interactive
Look at the VPN configuration in the code block. What security property is this setting intended to enable?
- APerfect Forward SecrecyCorrect answer
- BHashing-only integrity
- CPassword recovery
- DMAC address filtering
Why this is the answer
Configuring a Diffie-Hellman group for an IKEv2 proposal supports PFS by creating ephemeral session keys.
Security Operations
8 questions in this domain
- Question 29Single Choice
In a security operations environment, which type of algorithm should be used to provide data confidentiality?
- AHashing
- BEncryptionCorrect answer
- CDigital signature
- DMessage digest
Why this is the answer
Encryption provides confidentiality by making data unreadable without a key. Hashing protects integrity, not secrecy.
- Question 30Multiple Select
Which two statements correctly distinguish a hash function from an encryption algorithm?
- AA hash is a one-way operationCorrect answer
- BEncryption provides confidentialityCorrect answer
- CA hash can be decrypted with the right key
- DEncryption primarily ensures integrity
Why this is the answer
Hash functions are one-way and verify integrity. Encryption is reversible with a key and protects confidentiality.
- Question 31Interactive
Review the command output shown in the code block. Which security property is demonstrated by this operation?
- AConfidentiality
- BIntegrityCorrect answer
- CAvailability
- DAuthentication
Why this is the answer
The command calculates a file hash. Any change to the file changes the hash value, so integrity is verified.
- Question 32Single Choice
In a public key infrastructure, which key does the certificate authority use to sign certificates?
- ASubject's private key
- BSubject's public key
- CCA's public key
- DCA's private keyCorrect answer
Why this is the answer
The CA signs certificates with its own private key. Anyone can verify the signature using the CA's public key.
- Question 33Multiple Select
Which two statements about private keys in a PKI are true?
- AThe CA signs certificates with its private keyCorrect answer
- BA subject uses its private key for signing or decryptionCorrect answer
- CPrivate keys are included in public certificates
- DOnly the certificate authority needs a private key
Why this is the answer
Both the CA and certificate subjects have private keys. Private keys are never placed in public certificates.
- Question 34Interactive
Review the IPsec configuration in the block. Which traffic is protected when this mode is active?
- AThe entire original IP packetCorrect answer
- BOnly the original IP header
- CNo part of the packet
- DOnly the Ethernet frame
Why this is the answer
In tunnel mode, the whole original IP packet is protected and encapsulated with a new IP header.
- Question 35Single Choice
A security engineer sees RSA and ECC keys of different lengths. Which conclusion about key strength is accurate?
- ALonger keys always mean better security
- BKey length can be compared only within the same algorithmCorrect answer
- CAll algorithms have equal strength at the same length
- DAlgorithm type is irrelevant if the key is long
Why this is the answer
Longer keys are not automatically better when algorithm types differ. Key strength comparisons are valid within the same algorithm.
- Question 36Multiple Select
A design team is selecting cryptographic controls. Which two factors must they consider beyond raw key length?
- AThe algorithm's structure affects appropriate key sizeCorrect answer
- BRecommended key sizes differ for RSA, ECC, and AESCorrect answer
- COnly key length determines security strength
- DAll algorithms accept the same key sizes
Why this is the answer
RSA, ECC, and AES use different structures, so their secure key sizes are different. Key length alone is not enough.
Vulnerability Management
4 questions in this domain
- Question 37Single Choice
Which characteristic best distinguishes hashing from encryption?
- AHashing is reversible when the correct key is available.
- BHashing produces a fixed-size one-way digest of the input.Correct answer
- CEncryption produces a fixed-size one-way digest of the input.
- DEncryption does not use a key.
Why this is the answer
Hashing is a one-way function that creates a digest from which the input cannot be recovered. Encryption is reversible with the appropriate key, so the two must not be confused.
- Question 38Multiple Select
Why is assuming that longer keys always mean stronger security an important cryptographic trap?
- AKey length must be evaluated within the algorithm's security model, not by size alone.Correct answer
- BA very long key in a weak or improperly used algorithm still may provide poor security.Correct answer
- CA 4096-bit RSA key is always more secure than a 256-bit AES key in all contexts.
- DKey length is the only variable that determines a cipher's resistance to attack.
Why this is the answer
Security level is determined by both the algorithm and its key size. A large key in a weak or poorly used algorithm does not guarantee protection.
- Question 39Interactive
Review the code block. Which private key is used to sign an issued certificate in a public key infrastructure?
- AThe private key of the requesting subject signs the final certificate.
- BThe private key of the certificate authority signs the final certificate.Correct answer
- CThe public key of the certificate authority signs the final certificate.
- DA symmetric pre-shared key signs the final certificate.
Why this is the answer
In a PKI, the certification authority signs issued certificates using its own private key. The subject's private key is not used for that CA signature.
- Question 40Single Choice
Which security property does Perfect Forward Secrecy add to a VPN?
- AA later compromise of the server's long-term key does not reveal past session keys.Correct answer
- BEach session reuses a long-term static key until it expires.
- CIt encrypts only the payload, leaving the IP headers visible.
- DIt removes the need for ephemeral keys during session negotiation.
Why this is the answer
PFS prevents compromise of long-term keys from exposing previously negotiated session keys. Past VPN traffic remains protected even after a long-term key disclosure.
Frequently asked questions
Everything about the Cisco Certified CyberOps Professional question bank and how to use it.