No matching guide sections
Change the search or section filter.
Study Guide preview
Unlock Pro for every Cisco CyberOps Associate flashcard-note lesson.
Preview the beginning of Section 1. Pro includes the complete Study Guide by section, plus Course Notes, guided course access, and Pro downloads.
Unlock with Pro
Opens the Cisco CyberOps Associate Practice Test purchase options.
Section 1
Apply the CIA triad to security events
Preview
Preview: 1. Security Concepts (20%)
Preview includes- 3 of 3 lesson topics
- 1 overview segment
- 3 core concepts
- 2 exam tips
Lesson Topics
- Confidentiality, Integrity, and Availability
- Mapping Incidents to CIA Impact
- Control Tradeoffs
Overview
The CIA triad is the baseline model for describing what a security event threatens: unauthorized disclosure, unauthorized change, or loss of dependable access.
Core Concepts
- Confidentiality is loss of authorized secrecy: data is viewed or disclosed by an unauthorized party.
- Integrity is loss of trust in correctness or authenticity: data, configurations, or transactions are changed without authorization.
- Availability is loss or degradation of timely, reliable access to systems or data.
Exam Tips
- Translate the symptom into the security property before choosing a control.
- Do not assume malware always maps to availability; use the observed effect.
Section 1 continues in Pro.Unlock Pro to read the full Apply the CIA triad to security events lesson plus every remaining Cisco CyberOps Associate Study Guide section.
Unlock with Pro
Section 2
Compare network, endpoint, and application security deployments
Pro
Compare network, endpoint, and application security deployments unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 3
Compare agent-based and agentless protection
Pro
Compare agent-based and agentless protection unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 4
Differentiate SIEM, SOAR, log management, and runbook automation
Pro
Differentiate SIEM, SOAR, log management, and runbook automation unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 5
Secure container, virtual, and cloud environments
Pro
Secure container, virtual, and cloud environments unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 6
Differentiate threat intelligence, threat hunting, malware analysis, and reverse engineering
Pro
Differentiate threat intelligence, threat hunting, malware analysis, and reverse engineering unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 7
Explain threat actors, threat modeling, and DevSecOps
Pro
Explain threat actors, threat modeling, and DevSecOps unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 8
Distinguish risk, threat, vulnerability, and exploit
Pro
Distinguish risk, threat, vulnerability, and exploit unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 9
Apply defense in depth
Pro
Apply defense in depth unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 10
Compare discretionary, mandatory, and nondiscretionary access control
Pro
Compare discretionary, mandatory, and nondiscretionary access control unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 11
Compare AAA, rule-based, time-based, role-based, and attribute-based access
Pro
Compare AAA, rule-based, time-based, role-based, and attribute-based access unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 12
Interpret Cisco-listed CVSS metrics correctly
Pro
Interpret Cisco-listed CVSS metrics correctly unlocks with Pro.Unlock Pro to read the full 7 topics flashcard-note study guide for this section.
Unlock with Pro
Section 13
Identify visibility gaps and data-loss indicators from traffic profiles
Pro
Identify visibility gaps and data-loss indicators from traffic profiles unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 14
Use the 5-tuple and compare rule-based with behavioral detection
Pro
Use the 5-tuple and compare rule-based with behavioral detection unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 15
Compare attack surface and vulnerability
Pro
Compare attack surface and vulnerability unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 16
Use tcpdump and full packet capture for packet-level evidence
Pro
Use tcpdump and full packet capture for packet-level evidence unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 17
Interpret NetFlow, session, and transaction data
Pro
Interpret NetFlow, session, and transaction data unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 18
Compare next-generation and traditional stateful firewalls
Pro
Compare next-generation and traditional stateful firewalls unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 19
Use web and email content filtering telemetry
Pro
Use web and email content filtering telemetry unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 20
Explain how ACLs and NAT/PAT change security visibility
Pro
Explain how ACLs and NAT/PAT change security visibility unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 21
Recognize visibility effects of tunneling, TOR, encryption, proxies, and encapsulation
Pro
Recognize visibility effects of tunneling, TOR, encryption, proxies, and encapsulation unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 22
Account for P2P and load balancing in monitoring
Pro
Account for P2P and load balancing in monitoring unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 23
Choose the right security-monitoring data type
Pro
Choose the right security-monitoring data type unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 24
Recognize protocol, DoS, DDoS, and on-path attacks
Pro
Recognize protocol, DoS, DDoS, and on-path attacks unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 25
Recognize SQL injection, command injection, and XSS
Pro
Recognize SQL injection, command injection, and XSS unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 26
Recognize manual and generative-AI social engineering
Pro
Recognize manual and generative-AI social engineering unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 27
Recognize endpoint attacks: buffer overflow, C2, malware, and ransomware
Pro
Recognize endpoint attacks: buffer overflow, C2, malware, and ransomware unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 28
Detect evasion and obfuscation techniques
Pro
Detect evasion and obfuscation techniques unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 29
Explain PKI, symmetric encryption, and asymmetric encryption
Pro
Explain PKI, symmetric encryption, and asymmetric encryption unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 30
Interpret X.509 certificate fields in context
Pro
Interpret X.509 certificate fields in context unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 31
Interpret cipher suites, key exchange, protocol versions, and PKCS
Pro
Interpret cipher suites, key exchange, protocol versions, and PKCS unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 32
Compare HIDS, antimalware, host firewalls, and predictive AI
Pro
Compare HIDS, antimalware, host firewalls, and predictive AI unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 33
Identify Windows operating-system artifacts
Pro
Identify Windows operating-system artifacts unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 34
Identify Linux operating-system artifacts
Pro
Identify Linux operating-system artifacts unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 35
Use attribution concepts: assets, threat actors, IOCs, and IOAs
Pro
Use attribution concepts: assets, threat actors, IOCs, and IOAs unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 36
Preserve chain of custody during host investigations
Pro
Preserve chain of custody during host investigations unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 37
Differentiate best, corroborative, and indirect evidence
Pro
Differentiate best, corroborative, and indirect evidence unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 38
Interpret Windows host logs to identify an event
Pro
Interpret Windows host logs to identify an event unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 39
Interpret Linux, application, and command-line logs
Pro
Interpret Linux, application, and command-line logs unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 40
Interpret SIEM and SOAR records during host analysis
Pro
Interpret SIEM and SOAR records during host analysis unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 41
Correlate process, file, and registry artifacts
Pro
Correlate process, file, and registry artifacts unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 42
Interpret malware sandbox and detonation reports
Pro
Interpret malware sandbox and detonation reports unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 43
Use hashes and URLs as investigation indicators
Pro
Use hashes and URLs as investigation indicators unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 44
Correlate systems, events, and networking indicators
Pro
Correlate systems, events, and networking indicators unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 45
Perform host triage using process lineage and persistence context
Pro
Perform host triage using process lineage and persistence context unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 46
Map events to IDS/IPS, firewall, proxy, antivirus, and NetFlow sources
Pro
Map events to IDS/IPS, firewall, proxy, antivirus, and NetFlow sources unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 47
Classify true/false positives and negatives and benign events
Pro
Classify true/false positives and negatives and benign events unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 48
Compare deep packet inspection, packet filtering, and stateful inspection
Pro
Compare deep packet inspection, packet filtering, and stateful inspection unlocks with Pro.Unlock Pro to read the full 3 topics flashcard-note study guide for this section.
Unlock with Pro
Section 49
Compare inline inspection with TAP/SPAN monitoring
Pro
Compare inline inspection with TAP/SPAN monitoring unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 50
Compare packet-monitoring data with NetFlow
Pro
Compare packet-monitoring data with NetFlow unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 51
Extract and validate files from TCP streams in Wireshark
Pro
Extract and validate files from TCP streams in Wireshark unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 52
Identify source, destination, ports, protocol, and payload in a PCAP
Pro
Identify source, destination, ports, protocol, and payload in a PCAP unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 53
Interpret Ethernet and ARP fields during intrusion analysis
Pro
Interpret Ethernet and ARP fields during intrusion analysis unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 54
Interpret IPv4 and IPv6 headers for intrusion analysis
Pro
Interpret IPv4 and IPv6 headers for intrusion analysis unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 55
Interpret TCP, UDP, and ICMP headers
Pro
Interpret TCP, UDP, and ICMP headers unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 56
Interpret DNS traffic and artifacts
Pro
Interpret DNS traffic and artifacts unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 57
Interpret SMTP, POP3, and IMAP traffic
Pro
Interpret SMTP, POP3, and IMAP traffic unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 58
Interpret HTTP, HTTPS, and HTTP/2 traffic
Pro
Interpret HTTP, HTTPS, and HTTP/2 traffic unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 59
Correlate common alert artifacts and basic regular expressions
Pro
Correlate common alert artifacts and basic regular expressions unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 60
Apply asset, configuration, and mobile-device management concepts
Pro
Apply asset, configuration, and mobile-device management concepts unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 61
Coordinate patch and vulnerability management
Pro
Coordinate patch and vulnerability management unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 62
Describe the elements of an incident response plan
Pro
Describe the elements of an incident response plan unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 63
Apply the incident handling lifecycle to an event
Pro
Apply the incident handling lifecycle to an event unlocks with Pro.Unlock Pro to read the full 6 topics flashcard-note study guide for this section.
Unlock with Pro
Section 64
Preserve evidence using NIST forensic concepts
Pro
Preserve evidence using NIST forensic concepts unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 65
Build and interpret a network profile
Pro
Build and interpret a network profile unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 66
Build and interpret a server profile
Pro
Build and interpret a server profile unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 67
Identify protected data: PII, PSI, PHI, and intellectual property
Pro
Identify protected data: PII, PSI, PHI, and intellectual property unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro
Section 68
Classify incidents with Kill Chain and Diamond Model concepts
Pro
Classify incidents with Kill Chain and Diamond Model concepts unlocks with Pro.Unlock Pro to read the full 4 topics flashcard-note study guide for this section.
Unlock with Pro
Section 69
Use SOC metrics for scope and response analysis
Pro
Use SOC metrics for scope and response analysis unlocks with Pro.Unlock Pro to read the full 5 topics flashcard-note study guide for this section.
Unlock with Pro