Cisco CyberOps Associate Exam 2026 – 190 Practice Questions with
Answers & Detailed Rationales, Security Monitoring, Threat
Analysis, Security Operations, Incident Response, Network Intrusion
Detection & Log Analysis
Section 1: Security Concepts (Questions 1–38)
Question 1
Which component of the CIA triad is primarily concerned with ensuring that data has not
been altered by unauthorized parties?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Correct Answer: B
Explanation: Integrity ensures data remains accurate and unmodified during storage or
transit, detecting unauthorized alterations through hashing and digital signatures.
Question 2
A security analyst receives an alert indicating that a user's account was accessed from two
geographically impossible locations within a 10-minute window. Which security principle is
most directly compromised?
A. Availability
B. Integrity
C. Confidentiality
,D. Redundancy
Correct Answer: C
Explanation: Unauthorized account access breaches confidentiality, as the attacker gains
access to information not intended for them.
Question 3
Which access control model allows the data owner to determine who may access specific
resources?
A. Mandatory Access Control (MAC)
B. Role-Based Access Control (RBAC)
C. Discretionary Access Control (DAC)
D. Rule-Based Access Control
Correct Answer: C
Explanation: DAC grants resource owners discretion to assign access permissions, making it
the most flexible but least centrally controlled model.
Question 4
A hospital requires that only doctors and nurses can access patient records, while
administrative staff are denied access regardless of individual permission grants. Which
access control model is implemented?
A. Discretionary Access Control
B. Role-Based Access Control
C. Mandatory Access Control
,D. Rule-Based Access Control
Correct Answer: B
Explanation: RBAC assigns permissions based on organizational roles, ensuring access rights
follow job functions rather than individual discretion.
Question 5
What does the Common Vulnerability Scoring System (CVSS) attack vector metric describe?
A. The difficulty of exploiting the vulnerability
B. The context by which the vulnerability can be exploited
C. The number of privileges required
D. The scope of impact on other components
Correct Answer: B
Explanation: The attack vector metric describes how the vulnerability is exploited—network,
adjacent, local, or physical—defining the attack's context.
Question 6
A vulnerability requires the attacker to have local access to the system and no user
interaction. Which CVSS metric describes the requirement for user participation?
A. Attack Complexity
B. Privileges Required
C. User Interaction
D. Scope
, Correct Answer: C
Explanation: User Interaction measures whether a human user must participate for
exploitation to succeed, with values of None or Required.
Question 7
In a defense-in-depth strategy, which layer is designed to detect and block malicious traffic
before it reaches internal hosts?
A. Application layer security
B. Network perimeter security
C. Endpoint detection and response
D. Data encryption
Correct Answer: B
Explanation: Network perimeter security controls (firewalls, IPS) form the boundary defense,
filtering traffic before it enters the internal network.
Question 8
What is the primary purpose of the principle of least privilege?
A. Ensuring all users have equal access rights
B. Limiting user access to only what is necessary for their role
C. Encrypting all user communications
D. Requiring multi-factor authentication for all users
Correct Answer: B
Answers & Detailed Rationales, Security Monitoring, Threat
Analysis, Security Operations, Incident Response, Network Intrusion
Detection & Log Analysis
Section 1: Security Concepts (Questions 1–38)
Question 1
Which component of the CIA triad is primarily concerned with ensuring that data has not
been altered by unauthorized parties?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Correct Answer: B
Explanation: Integrity ensures data remains accurate and unmodified during storage or
transit, detecting unauthorized alterations through hashing and digital signatures.
Question 2
A security analyst receives an alert indicating that a user's account was accessed from two
geographically impossible locations within a 10-minute window. Which security principle is
most directly compromised?
A. Availability
B. Integrity
C. Confidentiality
,D. Redundancy
Correct Answer: C
Explanation: Unauthorized account access breaches confidentiality, as the attacker gains
access to information not intended for them.
Question 3
Which access control model allows the data owner to determine who may access specific
resources?
A. Mandatory Access Control (MAC)
B. Role-Based Access Control (RBAC)
C. Discretionary Access Control (DAC)
D. Rule-Based Access Control
Correct Answer: C
Explanation: DAC grants resource owners discretion to assign access permissions, making it
the most flexible but least centrally controlled model.
Question 4
A hospital requires that only doctors and nurses can access patient records, while
administrative staff are denied access regardless of individual permission grants. Which
access control model is implemented?
A. Discretionary Access Control
B. Role-Based Access Control
C. Mandatory Access Control
,D. Rule-Based Access Control
Correct Answer: B
Explanation: RBAC assigns permissions based on organizational roles, ensuring access rights
follow job functions rather than individual discretion.
Question 5
What does the Common Vulnerability Scoring System (CVSS) attack vector metric describe?
A. The difficulty of exploiting the vulnerability
B. The context by which the vulnerability can be exploited
C. The number of privileges required
D. The scope of impact on other components
Correct Answer: B
Explanation: The attack vector metric describes how the vulnerability is exploited—network,
adjacent, local, or physical—defining the attack's context.
Question 6
A vulnerability requires the attacker to have local access to the system and no user
interaction. Which CVSS metric describes the requirement for user participation?
A. Attack Complexity
B. Privileges Required
C. User Interaction
D. Scope
, Correct Answer: C
Explanation: User Interaction measures whether a human user must participate for
exploitation to succeed, with values of None or Required.
Question 7
In a defense-in-depth strategy, which layer is designed to detect and block malicious traffic
before it reaches internal hosts?
A. Application layer security
B. Network perimeter security
C. Endpoint detection and response
D. Data encryption
Correct Answer: B
Explanation: Network perimeter security controls (firewalls, IPS) form the boundary defense,
filtering traffic before it enters the internal network.
Question 8
What is the primary purpose of the principle of least privilege?
A. Ensuring all users have equal access rights
B. Limiting user access to only what is necessary for their role
C. Encrypting all user communications
D. Requiring multi-factor authentication for all users
Correct Answer: B
