CCNA Cybersecurity (200-201). Set it up and run it.

1. Refer to the exhibit. A downloaded firmware image produces a SHA-256 hash that does not match the value published by the vendor. Which CIA property does this mismatch call into question?

• A. Availability of the download server
• B. Integrity of the firmware image
• C. Confidentiality of the firmware
• D. Non-repudiation of the vendor

Correct answer: B. Integrity assures data has not been altered from its known-good state. A hash that differs from the vendor's published value signals the file changed in transit or storage, so its integrity can no longer be trusted.

Why the others are wrong. Availability concerns whether the file could be reached, and it downloaded fine. Confidentiality concerns disclosure, not modification. Non-repudiation binds an action to an identity; a mismatched hash points to tampering with the content, not to a disputed vendor action.

2. Refer to the exhibit. A firewall deny log records repeated blocked connections from one internal host. Which two observations from this log warrant escalation? (Choose two.)

• A. The connections originate from a documentation IP range
• B. The firewall is correctly logging these blocked connection attempts exactly as its configured policy dictates
• C. The internal host repeatedly attempts outbound connections to port 4444, a common C2 port
• D. The source ports increment sequentially as expected for a client
• E. One host is persistently trying to reach multiple external hosts on unusual ports

Correct answer: C. Persistent outbound attempts to port 4444 and to multiple external hosts on non-standard ports suggest an internal host trying to establish command-and-control, so the destination port and the fan-out to several hosts are the escalation-worthy signals.

Why the others are wrong. That the source uses a documentation range is a lab-addressing artifact, not a threat indicator. The firewall correctly logging denies is normal operation, not itself suspicious. Ephemeral source ports incrementing is standard client behavior on every connection and reveals nothing about intent, so those three are benign compared with the C2-style destination and fan-out.

3. An attacker copies an unencrypted database backup containing customer records off a file server. Which element of the CIA triad has this action most directly violated?

• A. Confidentiality
• B. Availability
• C. Integrity
• D. Non-repudiation

Correct answer: A. Confidentiality protects information from unauthorized disclosure. Copying readable customer records to a location the attacker controls exposes data to someone with no authorization, which is exactly the disclosure confidentiality is meant to prevent.

Why the others are wrong. Availability concerns whether authorized users can reach data, and the backup remained reachable throughout. Integrity concerns unauthorized modification, but the records were read, not altered. Non-repudiation ensures an action cannot be denied later and is unrelated to simply reading a file.

4. A monitoring pipeline generates thousands of raw events per second, but only some are surfaced to analysts for action. What best distinguishes an alert from an ordinary event?

• A. A logged occurrence a device records as part of normal operation
• B. A confirmed breach that has already caused measurable data loss
• C. An occurrence flagged by a rule as meriting analyst review or triage
• D. A record kept only for compliance retention, never reviewed by analysts

Correct answer: C. An event is any recorded occurrence; an alert is the subset a detection rule or correlation elevated as potentially significant, so it is what an analyst triages rather than raw background noise.

Why the others are wrong. Recording an occurrence during normal operation describes a plain event, not an alert. An alert does not by itself prove a breach, since many are false positives needing validation. Retention length is a storage-policy attribute unrelated to whether something is an alert, and alerts are precisely what analysts review, not what they ignore.

5. Refer to the exhibit. A Sysmon process tree shows winword.exe spawning cmd.exe and PowerShell that then launches certutil. What does this chain most strongly indicate?

• A. A routine document print job initiated by the user
• B. Normal Office update checking for new templates
• C. A malicious macro launching a download-and-execute chain
• D. Windows Defender quarantining an infected attachment

Correct answer: C. Office applications like winword.exe should not spawn cmd.exe, PowerShell, or certutil; this parent-child chain is the classic signature of a weaponized macro downloading and executing a second-stage payload.

Why the others are wrong. A print job never creates a scripting-interpreter tree, so option one is wrong. Office update checks contact signed Microsoft services, not certutil fetching from an arbitrary host. Defender quarantine writes to its Operational log and terminates the process rather than allowing a live download chain to run.

6. A SOC analyst reviews traffic and finds a user authenticating over Telnet across the network. From a security perspective, why is this protocol a concern?

• A. It encrypts traffic using an outdated cipher suite
• B. It transmits credentials and session data in cleartext
• C. It requires a client certificate that periodically expires
• D. It compresses the payload and obscures the header fields

Correct answer: B. Telnet carries the login, commands, and all session data as unencrypted cleartext, so anyone capturing the traffic can read usernames, passwords, and everything typed during the session, which is why SSH replaced it.

Why the others are wrong. Telnet does not encrypt at all, so an outdated cipher suite does not apply to it. It uses no client certificates, so certificate expiry is irrelevant. It performs no meaningful compression and leaves headers and payload fully readable rather than obscured.

7. Ransomware on an endpoint encrypts local files and the user can no longer open documents needed for work. Which CIA property is most directly impacted?

• A. Confidentiality
• B. Non-repudiation
• C. Authentication
• D. Availability

Correct answer: D. Availability means authorized users can access information and systems when needed. Encrypting files so the legitimate owner cannot open them denies that timely access, which is the defining loss availability describes.

Why the others are wrong. Confidentiality would be affected if the attacker read or leaked the files, but encryption for extortion targets access, not disclosure. Non-repudiation and authentication concern proving identity and actions; neither describes files becoming unreadable to their rightful owner.

8. Refer to the exhibit. A proxy log shows one workstation contacting the same external host at near-constant intervals with tiny, uniform POST bodies. What does this pattern most likely indicate?

• A. A large file upload finishing
• B. Routine web browsing by the user
• C. Command-and-control beaconing
• D. A misconfigured NTP time sync

Correct answer: C. Fixed-interval callbacks with small, uniform POST payloads to one external host are the signature of C2 beaconing, the implant checking in for instructions, unlike human-driven traffic which is bursty and variable.

Why the others are wrong. A finishing upload would show large, decreasing transfer sizes, not tiny uniform ones repeated forever. Routine browsing produces varied destinations and irregular timing driven by user clicks. NTP synchronization uses UDP 123 to a time source, not HTTPS POSTs to a web host, so none match the metronomic small-POST pattern seen here.