Dumps of 200-201 Cover all the requirements of the Real Exam
Correct Practice Tests of 200-201 Dumps with Practice Exam
Cisco 200-201 exam consists of 120 multiple-choice questions that candidates have to complete within 120 minutes. 200-201 exam is available in English and Japanese languages and can be taken at any Pearson VUE testing center worldwide. Candidates who pass the exam will receive the Cisco Certified CyberOps Associate certification, which is a globally recognized certification in the field of cybersecurity.
Cisco 200-201 exam is part of the Cisco Certified CyberOps Associate certification program. This program is designed to provide candidates with the skills and knowledge needed to become effective cybersecurity analysts. The program covers a wide range of topics, including threat analysis, network security, incident response, and ethical hacking. By passing the Cisco 200-201 exam, candidates demonstrate that they have a strong foundation in these areas.
NEW QUESTION # 251
An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?
- A. The computer has a HIPS installed on it.
- B. The computer has a HIDS installed on it.
- C. The computer has a NIPS installed on it.
- D. The computer has a NIDS installed on it.
Answer: B
Explanation:
The discrepancy described suggests that the system had a Host Intrusion Detection System (HIDS) installed. HIDS are designed to monitor and analyze the internals of a computing system for signs of intrusion and policy violations. While they can detect unauthorized activities, they do not take direct action to stop an attack; this is typically the role of an intrusion prevention system. Therefore, the alert was generated, but no mitigation action was taken because the HIDS does not have the capability to intervene.
References := The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course material covers the functions and limitations of various security systems, including HIDS, and their role within a Security Operations Center (SOC)1.
NEW QUESTION # 252
Which step in the incident response process researches an attacking host through logs in a SIEM?
- A. detection and analysis
- B. preparation
- C. containment
- D. eradication
Answer: A
Explanation:
In the incident response process, detection and analysis involve researching an attacking host through logs in a Security Information and Event Management (SIEM) system. This step helps in identifying, validating, and managing potential security incidents. Reference:= Cisco CyberOps Associate - Module 3: Security Monitoring
NEW QUESTION # 253
Which piece of information is part of the chain of custody during investigation?
- A. Company that was collecting evidence
- B. List of vulnerable assets
- C. Method of evidence collection
- D. List of critical assets
Answer: C
NEW QUESTION # 254
The SOC team has confirmed a potential indicator of compromise on an endpoint. The team has narrowed the executable file's type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling this event?
- A. Collect public information on the malware behavior.
- B. Isolate the infected endpoint from the network.
- C. Perform forensics analysis on the infected endpoint.
- D. Prioritize incident handling based on the impact.
Answer: A
Explanation:
According to the NIST Computer Security Incident Handling Guide, the next step in handling an event after confirming a potential indicator of compromise on an endpoint is to collect public information on the malware behavior. This step involves searching for information from various sources, such as antivirus vendors, security blogs, threat intelligence feeds, and online forums, to learn more about the characteristics, capabilities, and impact of the malware. This information can help the SOC team to identify the type, severity, and scope of the incident, as well as to determine the appropriate response actions and mitigation strategies. Isolating the infected endpoint, performing forensics analysis, and prioritizing incident handling are subsequent steps that follow after collecting public information on the malware behavior. References:
* Computer Security Incident Handling Guide
* SP 800-61 Rev. 2, Computer Security Incident Handling Guide
NEW QUESTION # 255
Drag and drop the access control models from the left onto the correct descriptions on the right.
Answer:
Explanation:
NEW QUESTION # 256
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?
- A. ROT13 encryption
- B. TLS encryption
- C. Base64 encoding
- D. SHA-256 hashing
Answer: B
Explanation:
ROT13 is considered weak encryption and is not used with TLS (HTTPS:443).
Source:https://en.wikipedia.org/wiki/ROT13
NEW QUESTION # 257
Which event is a vishing attack?
- A. setting up a rogue access point near a public hotspot
- B. using a vulnerability scanner on a corporate network
- C. obtaining disposed documents from an organization
- D. impersonating a tech support agent during a phone call
Answer: D
Explanation:
Vishing is an attack where fraudsters impersonate legitimate entities via phone calls to deceive individuals into providing sensitive information or performing actions that compromise security. Reference:= Cisco Cybersecurity Source Documents
NEW QUESTION # 258
A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?
- A. file name
- B. file size
- C. file header type
- D. file hash value
Answer: D
NEW QUESTION # 259
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?
- A. ROT13 encryption
- B. TLS encryption
- C. Base64 encoding
- D. SHA-256 hashing
Answer: B
NEW QUESTION # 260
What is the relationship between a vulnerability and a threat?
- A. A threat exploits a vulnerability
- B. A threat is a calculation of the potential loss caused by a vulnerability
- C. A vulnerability exploits a threat
- D. A vulnerability is a calculation of the potential loss caused by a threat
Answer: A
Explanation:
A vulnerability refers to a weakness or flaw in a system that can be exploited by threats (such as hackers or malware) to gain unauthorized access, cause damage, etc. Threats exploit these vulnerabilities to impact the confidentiality, integrity, or availability of information and systems. References: Cisco Cybersecurity Associate
NEW QUESTION # 261
How does certificate authority impact a security system?
- A. It authenticates client identity when requesting SSL certificate
- B. It authenticates domain identity when requesting SSL certificate
- C. It validates domain identity of a SSL certificate
- D. It validates client identity when communicating with the server
Answer: C
Explanation:
A Certificate Authority (CA) is responsible for issuing digital certificates to validate the identity of the certificate holder and provide a means to establish secure communications over networks like the Internet. References := Cisco Cybersecurity Source Documents
NEW QUESTION # 262
What describes the impact of false-positive alerts compared to false-negative alerts?
- A. A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring
- B. A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.
- C. A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.
- D. A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised
Answer: B
Explanation:
False positives and false negatives are terms used to describe the accuracy of security alerts. A false positive occurs when a security system incorrectly identifies benign activity as malicious, leading to unnecessary investigation and potential disruption of legitimate activities. Conversely, a false negative happens when a security system fails to detect actual malicious activity, allowing the attackers to proceed undetected. The impact of false positives is generally wasted time and resources investigating non-issues, while the impact of false negatives can be much more severe, potentially leading to undetected breaches and significant damage.
References: The CBROPS curriculum covers the concepts of false positives and false negatives in the context of security monitoring and alerting systems
NEW QUESTION # 263
Which action matches the weaponization step of the Cyber Kill Chain model?
- A. Test and construct the appropriate malware to launch the attack
- B. Scan a host to find open ports and vulnerabilities
- C. Construct the appropriate malware and deliver it to the victim.
- D. Research data on a specific vulnerability
Answer: C
Explanation:
The weaponization step in the Cyber Kill Chain model involves creating or repurposing malware based on the information gathered during reconnaissance to exploit vulnerabilities in the target's system. This step culminates in the preparation of the malware to be delivered to the victim2.
Reference:
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)
Cyber Kill Chain
NEW QUESTION # 264
What is the difference between a threat and a risk?
- A. Risk represents the known and identified loss or danger in the system
- B. Risk represents the nonintentional interaction with uncertainty in the system
- C. Threat represents a state of being exposed to an attack or a compromise, either physically or logically.
- D. Threat represents a potential danger that could take advantage of a weakness in a system
Answer: D
Explanation:
A threat is any potential danger to an asset. If a vulnerability exists but has not yet been exploited-or, more importantly, it is not yet publicly known-the threat is latent and not yet realized.
NEW QUESTION # 265
While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible?
- A. encapsulation
- B. NAT
- C. tunneling
- D. TOR
Answer: B
Explanation:
Explanation
Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.
NEW QUESTION # 266
Which metric should be used when evaluating the effectiveness and scope of a Security Operations Center?
- A. The total incident escalations per week.
- B. The average time the SOC takes to detect and resolve the incident.
- C. The average time the SOC takes to register and assign the incident.
- D. The total incident escalations per month.
Answer: B
NEW QUESTION # 267
An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.
Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)
- A. domain names
- B. signatures
- C. host IP addresses
- D. dropped files
- E. file size
Answer: A,C
NEW QUESTION # 268
......
Sample Questions of 200-201 Dumps With 100% Exam Passing Guarantee: https://prepaway.testinsides.top/200-201-dumps-review.html