200-201

200-201 CBROPS Exam Details

Domain Weight Breakdown

Certification Path & Exam Strategy

The 200-201 CBROPS is the single exam required for the Cisco Certified CyberOps Associate certification. It validates a candidate's ability to work as a junior-level cybersecurity analyst within a Security Operations Center (SOC). The certification covers security event monitoring, alert triage, incident response procedures, and the analysis of host-based and network-based intrusions.

After earning CyberOps Associate, candidates can pursue the CyberOps Professional certification (300-215 CBRFIR + 300-220 CBRTHD). There is no prerequisite for this exam, but Cisco recommends familiarity with networking fundamentals (CCNA-level knowledge), basic Linux/Windows administration, and an understanding of TCP/IP protocols.

Tip: Focus heavily on Security Monitoring (25%) and understand how to read packet captures, syslog output, and SIEM alerts. Be comfortable with the TCP/IP model, common ports, and the difference between various attack types.

CIA Triad

SOC Roles & Responsibilities

Threat Actors

Security Frameworks & Standards

Cryptography Fundamentals

PKI (Public Key Infrastructure)

• Certificate Authority (CA): Issues and signs digital certificates. Root CA is the trust anchor; subordinate/intermediate CAs sign end-entity certificates.
• Digital Certificate (X.509): Contains subject name, public key, issuer (CA), validity period, serial number, and CA signature. Used in TLS/SSL to verify server identity.
• Certificate Revocation: CRL (Certificate Revocation List) is a periodic list of revoked certs. OCSP (Online Certificate Status Protocol) provides real-time status checks.
• TLS Handshake: Client Hello → Server Hello + Certificate → Key Exchange (asymmetric) → Session Keys (symmetric) → Encrypted Communication.

Tip: Know the difference between symmetric (fast, shared key) and asymmetric (slow, key pair) encryption. TLS uses asymmetric for key exchange, then switches to symmetric for the session.

Common Attack Types

TCP/IP Model vs OSI Model

Common Protocols & Ports

Tip: Memorize all ports above. The exam frequently tests your ability to identify protocols by port numbers, especially in packet captures and log analysis questions.

TCP Three-Way Handshake & Flags

TCP Flags: SYN (synchronize), ACK (acknowledge), FIN (finish/close), RST (reset/abort), PSH (push data immediately), URG (urgent pointer). SYN Flood Attack: Attacker sends many SYN packets without completing the handshake, exhausting server connection table resources.

Syslog Severity Levels

Mnemonic: "Every Awesome Cisco Engineer Will Need Ice-cream Daily". Syslog format: <priority>timestamp hostname: %facility-severity-mnemonic: message. Priority = (facility × 8) + severity.

SNMP (Simple Network Management Protocol)

Components: Manager (NMS) polls agents. Agents reside on managed devices. MIB (Management Information Base) defines the data structure. GET retrieves data, SET modifies config, TRAP sends unsolicited alerts (UDP 162).

SIEM & Log Analysis

SIEM (Security Information and Event Management): Aggregates logs from multiple sources (firewalls, IDS/IPS, servers, endpoints), normalizes data, correlates events, generates alerts, and provides dashboards for SOC analysts. Examples: Splunk, Cisco SecureX, IBM QRadar, Elastic SIEM, LogRhythm.

Packet Analysis & Wireshark

Wireshark is the primary tool for deep packet inspection. SOC analysts use it to analyze captured PCAP files, identify anomalous traffic patterns, extract artifacts, and validate SIEM alerts.

Tip: Wireshark display filters use a dot notation (e.g., tcp.port) while capture filters use BPF syntax (e.g., port 80). Know the difference for the exam.

NetFlow / IPFIX

NetFlow: Cisco protocol that collects IP traffic statistics as flows. A flow is defined by 5-tuple: source IP, destination IP, source port, destination port, protocol. Does not capture full packet content (unlike PCAP) but provides metadata about traffic patterns, volumes, and conversations.

• Use cases: Bandwidth monitoring, anomaly detection, identifying top talkers, detecting data exfiltration, baseline traffic analysis
• IPFIX: IETF standard based on NetFlow v9, vendor-neutral alternative
• sFlow: Sampling-based alternative (samples 1 in N packets), lower overhead
• Key difference: NetFlow provides flow metadata (who talked to whom), PCAP provides full payload content. Use NetFlow for broad visibility, PCAP for deep investigation.

Regex for Log Parsing (Common Patterns)

Key metacharacters: . (any char), * (0+ repeats), + (1+ repeats), ? (0 or 1), \d (digit), \w (word char), ^ (start), $ (end), [ ] (character class), | (alternation).

IDS vs IPS

HIDS vs NIDS: Host-based IDS monitors a single host (file integrity, process activity, logs). Network-based IDS monitors network segments (packet inspection). Examples: Snort (NIDS/NIPS), Suricata (NIDS), OSSEC (HIDS), Cisco Secure IPS (NIPS).

Malware Types & Analysis

Analysis methods: Static analysis – examine without execution (strings, hashes, PE headers, disassembly). Dynamic analysis – run in sandbox and observe behavior (network calls, file changes, registry mods). Sandboxing tools: Cuckoo Sandbox, Cisco Threat Grid, Any.run, Joe Sandbox.

Indicators of Compromise (IoCs)

MITRE ATT&CK Framework

MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It provides a common language for describing attacks and helps defenders map detection coverage.

Tip: The exam expects you to map observed behavior to tactics and techniques. Understand the difference between a tactic (the goal) and a technique (how the goal is achieved).

Windows Forensic Artifacts

Linux Forensic Artifacts

Incident Response Process (NIST SP 800-61)

Tip: The exam loves asking about the correct order of IR phases and what happens in each. Remember: you must DETECT before you CONTAIN, and always do a LESSONS LEARNED session afterward.

Evidence Handling & Chain of Custody

• Order of Volatility: Collect most volatile evidence first: 1) CPU registers/cache, 2) RAM/memory, 3) Network state/connections, 4) Running processes, 5) Disk (file system), 6) Remote logs, 7) Physical media/backups
• Chain of Custody: Document who collected the evidence, when, how, where it was stored, and who had access. Any break in the chain can invalidate evidence in legal proceedings.
• Forensic Imaging: Create bit-for-bit copy (dd, FTK Imager). Always work on the copy, never the original. Verify with hash (MD5/SHA-256) to prove integrity.
• Write Blocker: Hardware or software device that prevents modification of the original evidence during acquisition.

Vulnerability Management Lifecycle

CVSS (Common Vulnerability Scoring System)

CVSS Metric Groups: Base (attack vector, complexity, privileges, user interaction, scope, CIA impact), Temporal (exploit maturity, remediation level, report confidence), Environmental (modified base + asset importance). CVE = unique vulnerability identifier (e.g., CVE-2021-44228). CWE = weakness category (e.g., CWE-79 XSS).

Access Control Models

Compliance & Regulatory Frameworks

Security Tools Comparison

Firewall Types Comparison

Encryption Protocol Comparisons

Alert Classification

Tip: False Negatives are the most dangerous because a real attack goes undetected. False Positives cause alert fatigue but are less harmful. Tuning rules aims to minimize both.

Network Defense in Depth

Cisco Security Product Portfolio

Key Acronyms Quick Reference