[2023] Valid 200-201 test answers & Cisco 200-201 exam pdf
Verified 200-201 dumps Q&As - Pass Guarantee or Full Refund
NEW QUESTION # 41
Which HTTP header field is used in forensics to identify the type of browser used?
- A. accept-language
- B. host
- C. user-agent
- D. referrer
Answer: C
Explanation:
Section: Network Intrusion Analysis
Explanation/Reference:
NEW QUESTION # 42
An analyst is exploring the functionality of different operating systems.
What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?
- A. deploys Windows Operating Systems in an automated fashion
- B. has a Common Information Model, which describes installed hardware and software
- C. queries Linux devices that have Microsoft Services for Linux installed
- D. is an efficient tool for working with Active Directory
Answer: B
NEW QUESTION # 43
How does statistical detection differ from rule-based detection?
- A. Statistical detection involves the evaluation of events, and rule-based detection requires an evaluated set of events to function.
- B. Rule-based detection involves the evaluation of events, and statistical detection requires an evaluated set of events to function Rule-based detection defines
- C. Statistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules
- D. legitimate data over a period of time, and statistical detection works on a predefined set of rules
Answer: C
NEW QUESTION # 44
A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engineer needs to analyze the network and identify ways to improve traffic movement to minimize delays. Which information must the engineer obtain for this analysis?
- A. total throughput on the interface of the router and NetFlow records
- B. output of routing protocol authentication failures and ports used
- C. running processes on the applications and their total network usage
- D. deep packet captures of each application flow and duration
Answer: C
NEW QUESTION # 45
An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day, an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?
- A. Recovery
- B. Eradication
- C. Analysis
- D. Detection
Answer: D
NEW QUESTION # 46
What does cyber attribution identity in an investigation?
- A. threat actors of an attack
- B. cause of an attack
- C. vulnerabilities exploited
- D. exploit of an attack
Answer: A
NEW QUESTION # 47
Refer to the exhibit.
Which event is occurring?
- A. A binary on VM cuckoo1 is being submitted for evaluation
- B. A URL is being evaluated to see if it has a malicious binary
- C. A binary named "submit" is running on VM cuckoo1.
- D. A binary is being submitted to run on VM cuckoo1
Answer: A
NEW QUESTION # 48
Refer to the exhibit.
In which Linux log file is this output found?
- A. var/log/var.log
- B. /var/log/authorization.log
- C. /var/log/dmesg
- D. /var/log/auth.log
Answer: D
NEW QUESTION # 49
Which security model assumes an attacker within and outside of the network and enforces strict verification before connecting to any system or resource within the organization?
- A. Biba
- B. Zero Trust
- C. Take-Grant
- D. Object-capability
Answer: B
Explanation:
Explanation
Zero Trust security is an IT security model that requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are sitting within or outside of the network perimeter.
NEW QUESTION # 50
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?
- A. transport layer security encryption
- B. ROT13 encryption
- C. SHA-256 hashing
- D. Base64 encoding
Answer: A
Explanation:
Explanation
ROT13 is considered weak encryption and is not used with TLS (HTTPS:443). Source:
https://en.wikipedia.org/wiki/ROT13
NEW QUESTION # 51
Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)
- A. UDP port to which the traffic is destined
- B. TCP port from which the traffic was sourced
- C. destination IP address of the packet
- D. UDP port from which the traffic is sourced
- E. source IP address of the packet
Answer: C,E
Explanation:
Section: Network Intrusion Analysis
NEW QUESTION # 52
Which utility blocks a host portscan?
- A. HIDS
- B. antimalware
- C. sandboxing
- D. host-based firewall
Answer: D
NEW QUESTION # 53
Which technology prevents end-device to end-device IP traceability?
- A. encryption
- B. load balancing
- C. tunneling
- D. NAT/PAT
Answer: D
NEW QUESTION # 54
Refer to the exhibit.
Which packet contains a file that is extractable within Wireshark?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
NEW QUESTION # 55
What does cyber attribution identify in an investigation?
- A. threat actors of an attack
- B. cause of an attack
- C. vulnerabilities exploited
- D. exploit of an attack
Answer: A
NEW QUESTION # 56
Which metric is used to capture the level of access needed to launch a successful attack?
- A. attack vector
- B. attack complexity
- C. user interaction
- D. privileges required
Answer: A
Explanation:
Explanation
Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter7: Introduction to Security Operations Management.
NEW QUESTION # 57
How is NetFlow different than traffic mirroring?
- A. NetFlow generates more data than traffic mirroring
- B. Traffic mirroring costs less to operate than NetFlow
- C. NetFlow collects metadata and traffic mirroring clones data
- D. Traffic mirroring impacts switch performance and NetFlow does not
Answer: C
NEW QUESTION # 58
Which HTTP header field is used in forensics to identify the type of browser used?
- A. accept-language
- B. host
- C. user-agent
- D. referrer
Answer: C
NEW QUESTION # 59
What does cyber attribution identity in an investigation?
- A. threat actors of an attack
- B. cause of an attack
- C. vulnerabilities exploited
- D. exploit of an attack
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 60
An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications. Which technology should be used to accomplish the task?
- A. static IP addresses
- B. cipher suite
- C. digital certificates
- D. signatures
Answer: B
NEW QUESTION # 61
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
Answer:
Explanation:
Explanation
Delivery: This step involves transmitting the weapon to the target.
Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities.
Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.
NEW QUESTION # 62
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?
- A. transport layer security encryption
- B. ROT13 encryption
- C. SHA-256 hashing
- D. Base64 encoding
Answer: A
NEW QUESTION # 63
Which type of data consists of connection level, application-specific records generated from network traffic?
- A. statistical data
- B. transaction data
- C. location data
- D. alert data
Answer: B
NEW QUESTION # 64
Which step in the incident response process researches an attacking host through logs in a SIEM?
- A. preparation
- B. detection and analysis
- C. containment
- D. eradication
Answer: B
Explanation:
Explanation
Preparation --> Detection and Analysis --> Containment, Erradicaion and Recovery --> Post-Incident Activity Detection and Analysis --> Profile networks and systems, Understand normal behaviors, Create a log retention policy, Perform event correlation. Maintain and use a knowledge base of information.Use Internet search engines for research. Run packet sniffers to collect additional data. Filter the data. Seek assistance from others.
Keep all host clocks synchronized. Know the different types of attacks and attack vectors. Develop processes and procedures to recognize the signs of an incident. Understand the sources of precursors and indicators.
Create appropriate incident documentation capabilities and processes. Create processes to effectively prioritize security incidents. Create processes to effectively communicate incident information (internal and external communications).
Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide
NEW QUESTION # 65
Drag and drop the uses on the left onto the type of security system on the right.
Answer:
Explanation:
NEW QUESTION # 66
......
Preparing for the Cisco 200-201 certification exam involves studying and practicing the concepts covered in the exam. Cisco offers a range of resources to help individuals prepare for the exam, including study guides, online courses, and practice exams. With the right preparation, individuals can feel confident in their ability to pass the Cisco 200-201 certification exam and kickstart their career in cybersecurity.
200-201 Exam Questions – Valid 200-201 Dumps Pdf: https://actualtests.troytecdumps.com/200-201-troytec-exam-dumps.html