CyberOps Associate (200-201). Set it up and run it.

1. A SIEM alert shows one user account authenticating successfully from an office in Denver and, eleven minutes later, from an address geolocated to Bucharest. Both sessions used the correct password and a valid push approval. Which control would have stopped the second sign-in without requiring an analyst to be watching?

• A. A password policy that raises the minimum length to sixteen characters
• B. A conditional access policy that evaluates location and velocity at sign-in
• C. A longer log retention period on the SIEM
• D. Account lockout after five failed authentication attempts

Correct answer: B. Both sign-ins were technically valid, so nothing that judges credentials would have objected. Conditional access evaluates the context of the request — where it came from, how far it is from the last one, whether the device is known — and can block or step up the second attempt at the moment it happens, with no analyst in the loop.

Why the others are wrong.
A. The attacker already had the password. Making it longer changes how it is obtained next time, not whether this sign-in succeeds.
C. Retention decides how far back you can look after the fact. It is an investigation control, and the question asks what would have stopped the sign-in.
D. Lockout responds to failures. Both of these attempts succeeded, so the counter never moved.

2. A field engineer’s laptop is stolen from a car. The drive holds exported customer records. Which control determines whether that theft is a reportable data breach or an equipment loss?

• A. TLS 1.3 on every connection the laptop makes
• B. Full-disk encryption with the key sealed to the device’s TPM
• C. A SHA-256 hash of each exported file, stored centrally
• D. Tokenization of the customer table in the production database

Correct answer: B. The data is at rest on a drive somebody else is now holding. Full-disk encryption with the key sealed to the TPM means the drive cannot be read in another machine, which is what turns a breach into a hardware loss under most reporting regimes.

Why the others are wrong.
A. TLS protects data in transit. Nothing about this laptop is in transit; it is sitting in somebody’s boot.
C. A hash proves a file was not altered. It says nothing about whether anybody can read it, and the thief has the file either way.
D. Tokenizing the production database protects the database. The records were exported, and the export is what was stolen.

3. A user reports that their browser opens on an unfamiliar search page, ads appear on sites that do not normally carry them, and a toolbar they did not install is present. The behavior started after they installed a free PDF converter. Nothing else on the host is affected. Which best describes what is running?

• A. A rootkit
• B. A logic bomb
• C. A potentially unwanted program bundled with the installer
• D. A remote access trojan

Correct answer: C. Everything described is visible, browser-scoped and arrived with software the user chose to install. That is the signature of a bundled unwanted program: monetization by hijacking search and injecting ads, not stealth and not remote control.

Why the others are wrong.
A. A rootkit’s whole purpose is to not be noticed. A toolbar the user can see is the opposite of the behavior.
B. A logic bomb waits for a condition and then fires once. This is running continuously and started at install time.
D. A RAT gives an operator control of the host. Nothing here suggests anybody is driving the machine.

4. A contract with a hosting provider needs to state how quickly a failed service must be back in operation, in terms the provider can be held to. Which term belongs in that clause?

• A. Mean time between failures
• B. Recovery point objective
• C. Recovery time objective
• D. Maximum tolerable downtime

Correct answer: C. The recovery time objective is the agreed length of time between an outage starting and service being restored. It is the figure a provider commits to in a service level agreement, and the one a customer measures them against.

Why the others are wrong.
A. Mean time between failures describes how often something breaks, not how fast it comes back.
B. The recovery point objective is about data: how much of it you can afford to lose. It sets backup frequency, not restoration speed.
D. Maximum tolerable downtime is the business’s own ceiling, worked out internally. The RTO is set below it and is what gets written into the contract.

5. A nightly reporting script authenticates to a cloud API with a static key that was created three years ago and has never been changed. The key is stored in a file on the server. Which change most reduces the risk?

• A. Enroll the service account in multi-factor authentication
• B. Move to a workload identity that issues short-lived credentials at run time
• C. Rename the key file and remove its extension
• D. Increase the length of the key

Correct answer: B. The problem is a credential that is long-lived, copied onto disk and usable by anybody who reads it. A workload identity removes the stored secret entirely: the platform issues a credential to the running job that expires in minutes, so a copied file is worth nothing an hour later.

Why the others are wrong.
A. There is nobody at a keyboard to approve a prompt. Multi-factor authentication is designed around an interactive sign-in, which this is not.
C. The file is still readable to anything that can list the directory. Hiding a secret by renaming it is obscurity, not a control.
D. The key is not being brute-forced — it is being read off disk. Length does not change that.

6. A manufacturing line runs controllers whose vendor stopped issuing patches four years ago. They cannot be replaced this year, and a known remote vulnerability affects them. Which response is the appropriate compensating control?

• A. Accept the risk and record it in the register, with no further action
• B. Place the controllers on an isolated segment reachable only through an allowlisted firewall path, and monitor that path
• C. Move the controllers to the guest wireless network so they are away from corporate systems
• D. Install a general-purpose antivirus agent on each controller

Correct answer: B. When the vulnerable thing cannot be fixed, you reduce what can reach it. Segmentation with an explicit allowlist shrinks the attack surface to the few flows the line actually needs, and monitoring that path means an attempt against it is visible.

Why the others are wrong.
A. Acceptance is a legitimate decision, but it is not a control, and the question asks what to put in place while the controllers remain.
C. Guest wireless is a different network, not an isolated one — it usually has unrestricted internet access, which makes the exposure worse.
D. These controllers generally cannot run an endpoint agent, and if one were installed it would not remediate an unpatchable flaw in the firmware.