Cisco CyberOps Study Guide — 200-201 CBROPS (Cybersecurity Operations Fundamentals)

Preparing for the Cisco 200-201 CBROPS exam? This is the complete study guide — six chapters covering all five official Cisco domains, written in plain language for working engineers and aspiring SOC analysts.

The real exam: 200-201, Understanding Cisco Cybersecurity Operations Fundamentals, version 1.2 — 120 minutes, graded pass/fail, delivered through Pearson VUE. It is the single exam for Cisco's associate-level cybersecurity operations certification (Cisco renamed it from CyberOps Associate to Cybersecurity Associate in January 2025; the exam code and content are unchanged). No prerequisite certification is required. The certificate is valid for 3 years.

What's inside:

- Chapter 1 — Security Concepts (20%): the CIA triad, security deployments (SIEM vs SOAR vs log management), the nine core terms, the risk/threat/vulnerability/exploit chain, defense in depth, access control models (DAC, MAC, RBAC, ABAC), CVSS, the 5-tuple

- Chapter 2 — Security Monitoring I: attack surface vs vulnerability, the data each technology provides (packet capture, NetFlow, NGFW, web/email filtering), the eight mechanisms that take visibility away, and the six data types ranked by fidelity and retention

- Chapter 3 — Security Monitoring II: network, web, social engineering (including generative-AI lures and voice cloning) and endpoint attacks, evasion techniques, and certificates/PKI — cipher suites, X.509, key exchange

- Chapter 4 — Host-Based Analysis (20%): HIDS, antimalware and host firewalls, Windows and Linux artefacts, persistence, attribution (IOC vs IOA), evidence classes, log interpretation, sandbox reports

- Chapter 5 — Network Intrusion Analysis (20%): event sources, the five detection verdicts (true/false positive/negative, benign), DPI vs stateful vs packet filtering, inline vs taps, PCAP and Wireshark work, protocol headers, regular expressions

- Chapter 6 — Security Policies and Procedures (15%): the five management disciplines, NIST SP 800-61 incident handling, SP 800-86 evidence rules, network and server profiling, protected data (PII, PHI, PSI, IP), the Cyber Kill Chain and Diamond Model, SOC metrics

Two honest notes. Cisco does not publish this exam's question count or passing score — be wary of any product that quotes either as fact. And because Security Monitoring is the largest domain (25%), this guide gives it two full chapters.

Files included (1): cyberops-study-guide.pdf — the complete 6-chapter guide (200 pages)

Want practice questions too? The Deluxe tier adds the full 500-question practice bank and the cheat sheets, plus license-key access to the online practice hub.

Independent study material. Not affiliated with or endorsed by Cisco.