Cisco 200-201 Premium Exam Engine pdf – Download Free Updated 260 Questions [Q35-Q56]

Rate this post

Cisco 200-201 Premium Exam Engine pdf – Download Free Updated 260 Questions

Verified 200-201 Bundle Real Exam Dumps PDF

Cisco 200-201 certification exam is an essential credential for cybersecurity professionals who want to validate their skills and knowledge in cybersecurity operations. By passing 200-201 exam, candidates can demonstrate their proficiency in implementing effective security measures, identifying and responding to security threats, and ensuring compliance with regulatory requirements. Understanding Cisco Cybersecurity Operations Fundamentals certification can open up new career opportunities and help professionals advance their careers in the field of cybersecurity.

Q35. What is a sandbox interprocess communication service?

A collection of rules within the sandbox that prevent the communication between sandboxes.

A collection of network services that are activated on an interface, allowing for inter-port communication.

A collection of interfaces that allow for coordination of activities among processes.

A collection of host services that allow for communication between sandboxes.

Q36. Which attack method intercepts traffic on a switched network?

denial of service

ARP cache poisoning

DHCP snooping

command and control

Section: Security Concepts

Q37. Refer to the exhibit.

What does the message indicate?

an access attempt was made from the Mosaic web browser

a successful access attempt was made to retrieve the password file

a successful access attempt was made to retrieve the root of the website

a denied access attempt was made to retrieve the password file

Q38. An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

true negative

false negative

false positive

true positive

Explanation
A false negative occurs when the security system (usually a WAF) fails to identify a threat. It produces a
“negative” outcome (meaning that no threat has been observed), even though a threat exists.

Q39. An organization’s security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning How should the analyst collect the traffic to isolate the suspicious host?

by most active source IP

by most used ports

based on the protocols used

based on the most used applications

Q40. A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions.
Which identifier tracks an active program?

application identification number

active process identification number

runtime identification number

process identification number

Section: Host-Based Analysis

Q41. Refer to the exhibit.

Which component is identifiable in this exhibit?

Trusted Root Certificate store on the local machine

Windows PowerShell verb

Windows Registry hive

local service in the Windows Services Manager

Explanation
https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-hives
https://ldapwiki.com/wiki/HKEY_LOCAL_MACHINE#:~:text=HKEY_LOCAL_MACHINE%20Windows%20

Q42. Drag and drop the security concept on the left onto the example of that concept on the right.

Q43. Which step in the incident response process researches an attacking host through logs in a SIEM?

detection and analysis

preparation

eradication

containment

Explanation
Preparation –> Detection and Analysis –> Containment, Erradicaion and Recovery –> Post-Incident Activity Detection and Analysis –> Profile networks and systems, Understand normal behaviors, Create a log retention policy, Perform event correlation. Maintain and use a knowledge base of information.Use Internet search engines for research. Run packet sniffers to collect additional data. Filter the data. Seek assistance from others.
Keep all host clocks synchronized. Know the different types of attacks and attack vectors. Develop processes and procedures to recognize the signs of an incident. Understand the sources of precursors and indicators.
Create appropriate incident documentation capabilities and processes. Create processes to effectively prioritize security incidents. Create processes to effectively communicate incident information (internal and external communications).
Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

Q44.

Refer to the exhibit. What should be interpreted from this packet capture?

IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 80 of IP address
192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6.

IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 50272 of IP address
192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6.

IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 80 of IP address
192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6.

IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 50272 of IP address
192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6.

Section: Security Monitoring

Q45. Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are three active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

Explanation
“EX” = exfiltration
And there are three.
Also the “suspect long flow” and “suspect data heading” suggest, for example, DNS exfiltration
https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/management_console/smc_users_guide/SW_6 page 177.

Q46. What makes HTTPS traffic difficult to monitor?

SSL interception

packet header size

signature detection time

encryption

Q47. Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

integrity

confidentiality

availability

scope

Q48. Refer to the exhibit.

What is depicted in the exhibit?

Windows Event logs

Apache logs

IIS logs

UNIX-based syslog

Q49. Refer to the exhibit.

What is occurring in this network?

ARP cache poisoning

DNS cache poisoning

MAC address table overflow

MAC flooding attack

Q50. An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network.
What is the impact of this traffic?

ransomware communicating after infection

users downloading copyrighted content

data exfiltration

user circumvention of the firewall

Q51. A security engineer deploys an enterprise-wide host/endpoint technology for all of the company’s corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.
Which technology should be used to accomplish this task?

application whitelisting/blacklisting

network NGFW

host-based IDS

antivirus/antispyware software

Section: Network Intrusion Analysis

Q52. What ate two categories of DDoS attacks? (Choose two.)

split brain

scanning

phishing

reflected

direct

Q53. What does cyber attribution identity in an investigation?

cause of an attack

exploit of an attack

vulnerabilities exploited

threat actors of an attack

Section: Host-Based Analysis

Q54. Which type of access control depends on the job function of the user?

discretionary access control

nondiscretionary access control

role-based access control

rule-based access control

Q55. When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

fragmentation

pivoting

encryption

stenography

Section: Security Concepts

Q56. Which attack method intercepts traffic on a switched network?

denial of service

ARP cache poisoning

DHCP snooping

command and control

An ARP-based MITM attack is achieved when an attacker poisons the ARP cache of two devices with the MAC address of the attacker’s network interface card (NIC). Once the ARP caches have been successfully poisoned, each victim device sends all its packets to the attacker when communicating to the other device and puts the attacker in the middle of the communications path between the two victim devices. It allows an attacker to easily monitor all communication between victim devices. The intent is to intercept and view the information being passed between the two victim devices and potentially introduce sessions and traffic between the two victim devices

Loading …

Cisco CyberOps Job Roles

We don’t miss a case of massive security breaches every year, which only goes to show why cybersecurity specialists are in high demand these days. In essence, cybersecurity is a sophisticated niche, with many organizations now willing to work with a team of security specialists as part of Security Operations Centers (SOC), which brings us to the question, which roles can you qualify for after passing 200-201 test? Well, with security still a vital component of many networking roles, it’s easy to see a lot of overlapping roles between these two paths. The four most popular roles that you can qualify for after completing this training include the following: