200-201 Exam Preparation Material with New 200-201 Dumps Questions
200-201 2025 Training With 379 QA's
NEW QUESTION # 157
Refer to the exhibit.
What is occurring in this network traffic?
- A. Flood of SYN packets coming from a single source IP to a single destination IP.
- B. Flood of ACK packets coming from a single source IP to multiple destination IPs.
- C. High rate of SYN packets being sent from a multiple source towards a single destination IP.
- D. High rate of ACK packets being sent from a single source IP towards multiple destination IPs.
Answer: C
Explanation:
The exhibit shows a high rate of SYN packets being sent from multiple sources towards a single destination IP. This is indicative of a SYN flood attack, where the attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. Reference:= Cisco Cybersecurity Operations Fundamentals - Module 4: Network Intrusion Analysis
NEW QUESTION # 158
An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.
Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)
- A. signatures
- B. dropped files
- C. file size
- D. host IP addresses
- E. domain names
Answer: D,E
Explanation:
To investigate the callouts made post infection, it's essential to know where the callouts were made to (domain names) and from which host IP addresses they originated. This information can help trace back the source and destination, aiding in understanding the nature of the callouts. References: https://www.cisco.com/c
/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60
/Working_with_Indicators_of_Compromise.html
NEW QUESTION # 159
Which regular expression is needed to capture the IP address 192.168.20.232?
- A. ^ (?:[0-9]f1,3}\.){1,4}
- B. ^ ([0-9]-{3})
- C. ^ (?:[0-9]{1,3}\.){3}[0-9]{1,3}
- D. ^ (?:[0-9]{1,3}\.)'
Answer: C
Explanation:
The regular expression ^ (?:[0-9]{1,3}.){3}[0-9]{1,3} is needed to capture the IP address 192.168.20.232. This regex matches any string that starts with three groups of one to three digits followed by a dot, and ends with one group of one to three digits. The IP address 192.168.20.232 matches this pattern exactly. The other options are either invalid or do not match the IP address format. Reference:= Cisco Cybersecurity Operations Fundamentals, Module 5: Security Policies and Procedures, Lesson 5.3: Data and Event Analysis, Topic 5.3.2: Regular Expressions
NEW QUESTION # 160
What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?
- A. integrity validation
- B. least privilege
- C. need to know
- D. due diligence
Answer: B
Explanation:
The principle of least privilege states that users and processes should be granted only the minimum permissions necessary to perform their specific role or function within an organization. This reduces the attack surface and limits the potential damage of a compromised account or process. References:
* Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 1: Security Concepts, Lesson 1.2: Security Principles
* Cisco Certified CyberOps Associate Overview, Exam Topics, 1.1 Explain the CIA triad
NEW QUESTION # 161 
Refer to the exhibit. A network engineer received a report that a host is communicating with unknown domains on the internet. The network engineer collected packet capture but could not determine the technique or the payload used. What technique is the attacker using?
- A. amplification
- B. session hijacking
- C. teardrop
- D. tunneling
Answer: D
NEW QUESTION # 162
Which security technology allows only a set of pre-approved applications to run on a system?
- A. application-level whitelisting
- B. application-level blacklisting
- C. host-based IPS
- D. antivirus
Answer: A
Explanation:
Application-level whitelisting is a security technology that allows only a set of pre-approved applications to run on a system, and blocks any other unauthorized or malicious programs. This can prevent malware, ransomware, zero-day exploits, and other threats from compromising the system. Application-level whitelisting is also known as application control or application allowlisting. Reference:= Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 3: Host-Based Analysis, Lesson 3.2: Endpoint Security Technologies, Topic 3.2.3: Application Whitelisting, page 3-20.
NEW QUESTION # 163
What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?
- A. SPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.
- B. SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.
- C. APS interrogation is more complex because traffic mirroring applies additional tags to data and SPAN does not alter integrity and provides full duplex network.
- D. TAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools
Answer: C
NEW QUESTION # 164
What is an incident response plan?
- A. an organizational approach to security management to ensure a service lifecycle and continuous improvements
- B. an organizational approach to disaster recovery and timely restoration ot operational services
- C. an organizational approach to events that could lead to asset loss or disruption of operations
- D. an organizational approach to system backup and data archiving aligned to regulations
Answer: B
NEW QUESTION # 165
Refer to the exhibit.
What is occurring within the exhibit?
- A. XML External Entities attack
- B. regular GET requests
- C. insecure deserialization
- D. cross-site scripting attack
Answer: B
Explanation:
Based on the image details, the exhibit shows a series of HTTP requests with the method GET, which are used to retrieve data from a web server. There is no evidence of any malicious payload or parameter in these requests, so they are likely regular GET requests. The other options are types of web application attacks that exploit different vulnerabilities, such as XML External Entities, insecure deserialization, and cross-site scripting. References := Cisco Cybersecurity
NEW QUESTION # 166
Which of these describes volatile evidence?
- A. logs
- B. registers and cache
- C. disk and removable drives
- D. usernames
Answer: B
NEW QUESTION # 167
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
Answer:
Explanation:
Explanation
Delivery: This step involves transmitting the weapon to the target.
Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities.
Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.
NEW QUESTION # 168
What makes HTTPS traffic difficult to monitor?
- A. signature detection time
- B. SSL interception
- C. encryption
- D. packet header size
Answer: C
Explanation:
HTTPS uses SSL/TLS encryption to secure data transmission over the internet. This encryption makes it difficult to monitor HTTPS traffic because the data packets are encrypted making them unreadable to anyone trying to intercept or monitor the data without proper decryption keys. References := Cisco CyberOps Associate
NEW QUESTION # 169
Which two elements are used for profiling a network? (Choose two.)
- A. session duration
- B. listening ports
- C. total throughput
- D. OS fingerprint
- E. running processes
Answer: B,D
Explanation:
Section: Security Policies and Procedures
Explanation
NEW QUESTION # 170
Refer to the exhibit.
What should be interpreted from this packet capture?
- A. 192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.
- B. 81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.
- C. 192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.
- D. 81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.
Answer: A
NEW QUESTION # 171
In a SOC environment, what is a vulnerability management metric?
- A. single factor authentication
- B. full assets scan
- C. code signing enforcement
- D. internet exposed devices
Answer: D
NEW QUESTION # 172
What is the difference between deep packet inspection and stateful inspection?
- A. Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4
- B. Stateful inspection is more secure than deep packet inspection on Layer 7
- C. Deep packet inspection is more secure than stateful inspection on Layer 4
- D. Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7
Answer: A
Explanation:
Section: Security Concepts
NEW QUESTION # 173 
Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?
- A. Host 152.46.6.91 is being identified as a watchlist country for data transfer.
- B. Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.
- C. Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.
- D. Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.
Answer: D
Explanation:
Section: Host-Based Analysis
NEW QUESTION # 174
Refer to the exhibit.
Which application protocol is in this PCAP file?
- A. HTTP
- B. TLS
- C. SSH
- D. TCP
Answer: A
Explanation:
The PCAP file in the exhibit shows a Transmission Control Protocol (TCP) communication between two IP addresses. In the data section of the packet capture, "pdy/3.1... http/1" is visible, indicating that HTTP (Hypertext Transfer Protocol) is being used as the application protocol for this communication.
NEW QUESTION # 175
Refer to the exhibit.
What is the potential threat identified in this Stealthwatch dashboard?
- A. Host 152.46.6.91 is being identified as a watchlist country for data transfer.
- B. Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.
- C. Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.
- D. Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.
Answer: D
NEW QUESTION # 176
Refer to the exhibit.
An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?
- A. The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.
- B. The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.
- C. The file has an embedded executable and was matched by PEiD threat signatures for further analysis.
- D. The file has an embedded non-Windows executable but no suspicious features are identified.
Answer: A
NEW QUESTION # 177
Which regular expression matches "color" and "colour"?
- A. col[09]+our
- B. colo?ur
- C. colou?r
- D. col[08]+our
Answer: B
Explanation:
The regular expression that matches both "color" and "colour" is colo?ur. In this expression, the ? denotes that the preceding character u is optional, meaning it may appear zero or one time. This allows the expression to match both the American spelling "color" and the British spelling "colour".
References := Understanding regular expressions is fundamental in various computing tasks, including cybersecurity operations. The Cisco Cybersecurity Operations Fundamentals (CBROPS) material covers the use of regular expressions for searching through logs and data, which is a critical skill for a cybersecurity analyst.
NEW QUESTION # 178
What are the two characteristics of the full packet captures? (Choose two.)
- A. Identifying network loops and collision domains.
- B. Providing a historical record of a network transaction.
- C. Detecting common hardware faults and identify faulty assets.
- D. Troubleshooting the cause of security and performance issues.
- E. Reassembling fragmented traffic from raw data.
Answer: D,E
Explanation:
Full packet captures are essential for troubleshooting security and performance issues as they provide detailed information on network traffic (option B). They also allow for reassembling fragmented traffic from raw data, enabling analysts to review complete transactions or sessions (option C). References := Cisco Cybersecurity Operations Fundamentals - Module 3: Network Data and Event Analysis
NEW QUESTION # 179
......
Quickly and Easily Pass Cisco Exam with 200-201 real Dumps: https://actualtests.troytecdumps.com/200-201-troytec-exam-dumps.html