Cisco 200-201 - Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

In a Security Operations Center (SOC) environment, a vulnerability management metric is a quantifiable measure used to assess the effectiveness of the vulnerability management program. A full assets scan is a metric that can be used to determine the coverage and frequency of vulnerability scans across all assets. This helps in identifying unscanned assets and ensuring that all parts of the network are regularly checked for vulnerabilities1.

References :=

SOC Metrics: Security Metrics & KPIs for Measuring SOC Success

Vulnerability Management Metrics: 5 Metrics to Start Measuring in Your Vulnerability Management Program

Top 10 Vulnerability Management Metrics & KPIs To Measure Success

 Agent-based protection is a type of endpoint security that uses software agents installed on the devices to monitor and protect them. Agent-based protection can collect and detect all traffic locally, which means it can operate without relying on a network connection or a centralized server. Agent-based protection can also provide more granular and comprehensive visibility and control over the devices. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1.0/CSCU-LP-CBROPS-V1-028093.html (Module 2: Security Concepts, Lesson 2.3: Endpoint Security)

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network flow. It provides valuable data about the network sessions occurring within the network, such as source and destination IP addresses, port numbers, and protocols used. This session data is useful for understanding traffic patterns, volume, and usage.

Cisco’s training and certification materials on NetFlow would discuss how it is used to obtain session data for network analysis.

The exhibit shows a network diagram with a switch, a router, and two hosts. The switch has a MAC address table that maps the MAC addresses of the connected devices to the corresponding ports. A MAC flooding attack is a type of attack that aims to overload the switch’s MAC address table by sending a large number of frames with spoofed source MAC addresses. This causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, effectively turning it into a hub. This allows the attacker tosniff the traffic between the hosts and the router, or launch other attacks such as ARP spoofing or man-in-the-middle

The purpose of command and control (C&C) for network-aware malware is to allow an attacker to remotely control compromised systems. This includes sending commands to the malware, receiving data from the infected host, and updating the malware to evade detection or enhance its capabilities.

The CBROPS course materials cover the topic of network-aware malware and the role of command and control servers in managing such malware

 A web proxy is the technology used to block a user’s HTTP connection to a malicious site according to configured policy. It acts as an intermediary between users and the internet, enforcing security policies and preventing access to harmful sites by inspecting and managing web traffic.

The file in question, which contains logs of unsuccessful login attempts from an unknown IP address, is considered indirect evidence. It suggests that there may have been an attempt to gain unauthorized access, but it does not directly prove who was responsible for the attempts. Indirect evidence can be used to support other evidence that may lead to a direct identification of the threat actor. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) and other Cisco cybersecurity resources provide information on how to analyze and categorize different types of evidence in the context of security incidents.

The packet capture exhibit shows that the source IP address is 192.168.122.100 and it is sending a packet from source port 50272 to destination port 80 of destination IP address 81.179.179.69 using TCP protocol. The TCP protocol is indicated by the Protocol field which has the value 6. The source and destination ports are indicated by the SrcPort and DstPort fields respectively. The source and destination IP addresses are indicated by the SrcAddr and DstAddr fields respectively. References := Cisco Cybersecurity Operations Fundamentals - Module 3: Network Data and Event Analysis