Updated Apr-2024 200-201 Free Exam Files Downloaded Instantly
Practice Exams and Training Solutions for Certifications
NEW QUESTION # 58
When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?
- A. encryption
- B. stenography
- C. fragmentation
- D. pivoting
Answer: B
Explanation:
Section: Security Concepts
NEW QUESTION # 59
A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?
- A. file size
- B. file type
- C. file name
- D. file hash value
Answer: D
NEW QUESTION # 60
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
Answer:
Explanation:
Explanation
Delivery: This step involves transmitting the weapon to the target.
Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities.
Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.
NEW QUESTION # 61
Refer to the exhibit.
What information is depicted?
- A. IPS event data
- B. NetFlow data
- C. network discovery event
- D. IIS data
Answer: B
NEW QUESTION # 62
How does agentless monitoring differ from agent-based monitoring?
- A. Agentless can access the data via API. while agent-base uses a less efficient method and accesses log data through WMI.
- B. Agent-based has a possibility to locally filter and transmit only valuable data, while agentless has much higher network utilization
- C. Agent-based monitoring has a lower initial cost for deployment, while agentless monitoring requires resource-intensive deployment.
- D. Agent-based monitoring is less intrusive in gathering log data, while agentless requires open ports to fetch the logs
Answer: D
NEW QUESTION # 63
Drag and drop the data source from the left onto the data type on the right.
Answer:
Explanation:
NEW QUESTION # 64
A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?
- A. victims of the attack
- B. companyassets that are threatened
- C. customer assets that are threatened
- D. perpetrators of the attack
Answer: D
NEW QUESTION # 65
What is personally identifiable information that must be safeguarded from unauthorized access?
- A. zip code
- B. driver's license number
- C. gender
- D. date of birth
Answer: B
Explanation:
Explanation
According to the Executive Office of the President, Office of Management and Budget (OMB), and the U.S.
Department of Commerce, Office of the Chief Information Officer, PII refers to "information which can be used to distinguish or trace an individual's identity." The following are a few examples:
- An individual's name
- Social security number
- Biological or personal characteristics, such as an image of distinguishing features, fingerprints, Xrays, voice signature, retina scan, and the geometry of the face
- Date and place of birth
- Mother's maiden name
- Credit card numbers
- Bank account numbers
- Driver license number
- Address information, such as email addresses or street addresses, and telephone numbers for businesses or personal use
- Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide Omar Santos
NEW QUESTION # 66
Refer to the exhibit.
Which type of log is displayed?
- A. sys
- B. IDS
- C. NetFlow
- D. proxy
Answer: B
Explanation:
You also see the 5-tuple in IPS events, NetFlow records, and other event data. In fact, on the exam you may need to differentiate between a firewall log versus a traditional IPS or IDS event. One of the things to remember is that traditional IDS and IPS use signatures, so an easy way to differentiate is by looking for a signature ID (SigID). If you see a signature ID, then most definitely the event is a traditional IPS or IDS event.
NEW QUESTION # 67
Refer to the exhibit.
What does the output indicate about the server with the IP address 172.18.104.139?
- A. running processes of the server
- B. open ports of a web server
- C. open port of an FTP server
- D. open ports of an email server
Answer: D
NEW QUESTION # 68
Drag and drop the access control models from the left onto the correct descriptions on the right.
Answer:
Explanation:
NEW QUESTION # 69
What is a sandbox interprocess communication service?
- A. A collection of interfaces that allow for coordination of activities among processes.
- B. A collection of network services that are activated on an interface, allowing for inter-port communication.
- C. A collection of rules within the sandbox that prevent the communication between sandboxes.
- D. A collection of host services that allow for communication between sandboxes.
Answer: A
Explanation:
Explanation
Inter-process communication (IPC) allows communication between different processes. A process is one or more threads running inside its own, isolated address space. https://docs.legato.io/16_10/basicIPC.html
NEW QUESTION # 70
Which two elements are used for profiling a network? (Choose two.)
- A. session duration
- B. total throughput
- C. OS fingerprint
- D. running processes
- E. listening ports
Answer: A,B
Explanation:
A network profile should include some important elements, such as the following:
Total throughput - the amount of data passing from a given source to a given destination in a given period of time Session duration - the time between the establishment of a data flow and its termination Ports used - a list of TCP or UDP processes that are available to accept data Critical asset address space - the IP addresses or the logical location of essential systems or data Profiling data are data that system has gathered, these data helps for incident response and to detect incident Network profiling = throughput, sessions duration, port used, Critical Asset Address Space Host profiling = Listening ports, logged in accounts, running processes, running tasks,applications
NEW QUESTION # 71
Refer to the exhibit.
Which type of log is displayed?
- A. sys
- B. IDS
- C. NetFlow
- D. proxy
Answer: C
NEW QUESTION # 72
What describes the impact of false-positive alerts compared to false-negative alerts?
- A. A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.
- B. A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised
- C. A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring
- D. A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.
Answer: D
NEW QUESTION # 73
Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?
- A. dictionary
- B. man-in-the-middle
- C. replay
- D. known-plaintext
Answer: B
NEW QUESTION # 74
......
Certification Path
If you want to upgrade your CyberOps skills from associate to a professional level, you can continue your education by pursuing the Cisco Certified CyberOps Professional certificate, which will bring even more perks to your career.
Q&As with Explanations Verified & Correct Answers: https://www.trainingquiz.com/200-201-practice-quiz.html
Dumps Free Test Engine Player Verified Answers: https://drive.google.com/open?id=1-5A7W0m1A6Fgye7mZDqlcpLlXCP7FWzE
