[Aug-2022] 200-201 Exam Dumps, 200-201 Practice Test Questions [Q23-Q47]

ExamBoosts August 4, 2022 200-201 > Cisco 0

Rate this post

[Aug-2022] 200-201 Exam Dumps, 200-201 Practice Test Questions

Attested 200-201 Dumps PDF Resource [2022]

Certification Details: Cisco Certified CyberOps Associate

The recently updated Cisco Certified CyberOps Associate curriculum verifies the everyday knowledge and technical skills that you need to identify and mitigate security threats as part of a Security Operations Center (SOC). In addition, it opens your path to a career in cybersecurity. Cisco doesn’t list any mandatory prerequisites for attaining the CyberOps Associate designation but it’s always advisable to master the exam objectives before focusing on the certification path.

Prerequisites

There are no requirements that you should meet before going for the Cisco 200-201 test. However, the potential candidates are required to possess an understanding of the topics before taking this path. Thus, they will be able to deal with the questions and earn a high score.

NEW QUESTION 23
A developer is working on a project using a Linux tool that enables writing processes to obtain these required results:
* If the process is unsuccessful, a negative value is returned.
* If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process.
Which component results from this operation?

parent directory name of a file pathname

process spawn scheduled

macros for managing CPU sets

new process created by parent process

Explanation
There are two tasks with specially distinguished process IDs: swapper or sched has process ID 0 and is responsible for paging, and is actually part of the kernel rather than a normal user-mode process. Process ID 1 is usually the init process primarily responsible for starting and shutting down the system. Originally, process ID 1 was not specifically reserved for init by any technical measures: it simply had this ID as a natural consequence of being the first process invoked by the kernel. More recent Unix systems typically have additional kernel components visible as ‘processes’, in which case PID 1 is actively reserved for the init process to maintain consistency with older systems

NEW QUESTION 24
Refer to the exhibit. What does this output indicate?

HTTPS ports are open on the server.

SMB ports are closed on the server.

FTP ports are open on the server.

Email ports are closed on the server.

NEW QUESTION 25
Refer to the exhibit.

Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.

NEW QUESTION 26
An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

nmap –top-ports 192.168.1.0/24

nmap -sP 192.168.1.0/24

nmap -sL 192.168.1.0/24

nmap -sV 192.168.1.0/24

NEW QUESTION 27
A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders After further investigation, the analyst learns that customers claim that they cannot access company servers According to NIST SP800-61, in which phase of the incident response process is the analyst?

post-incident activity

detection and analysis

preparation

containment, eradication, and recovery

NEW QUESTION 28
Refer to the exhibit.

What is occurring in this network?

ARP cache poisoning

DNS cache poisoning

MAC address table overflow

MAC flooding attack

NEW QUESTION 29
What is the function of a command and control server?

It enumerates open ports on a network device

It drops secondary payload into malware

It is used to regain control of the network after a compromise

It sends instruction to a compromised system

NEW QUESTION 30
Refer to the exhibit.

Which type of log is displayed?

IDS

proxy

NetFlow

sys

NEW QUESTION 31
An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?

Run “ps -d” to decrease the priority state of high load processes to avoid resource exhaustion.

Run “ps -u” to find out who executed additional processes that caused a high load on a server.

Run “ps -ef” to understand which processes are taking a high amount of resources.

Run “ps -m” to capture the existing state of daemons and map required processes to find the gap.

NEW QUESTION 32
An engineer must compare NIST vs ISO frameworks The engineer deeded to compare as readable documentation and also to watch a comparison video review. Using Windows 10 OS. the engineer started a browser and searched for a NIST document and then opened a new tab in the same browser and searched for an ISO document for comparison The engineer tried to watch the video, but there ‘was an audio problem with OS so the engineer had to troubleshoot it At first the engineer started CMD and looked fee a driver path then locked for a corresponding registry in the registry editor The engineer enabled “Audiosrv” in task manager and put it on auto start and the problem was solved Which two components of the OS did the engineer touch? (Choose two)

permissions

PowerShell logs

service

MBR

process and thread

NEW QUESTION 33
What should an engineer use to aid the trusted exchange of public keys between user tom0411976943 and dan1968754032?

central key management server

web of trust

trusted certificate authorities

registration authority data

NEW QUESTION 34
An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.
Which testing method did the intruder use?

social engineering

eavesdropping

piggybacking

tailgating

Section: Security Monitoring

NEW QUESTION 35
A company encountered a breach on its web servers using IIS 7 5 Dunng the investigation, an engineer discovered that an attacker read and altered the data on a secure communication using TLS 1 2 and intercepted sensitive information by downgrading a connection to export-grade cryptography. The engineer must mitigate similar incidents in the future and ensure that clients and servers always negotiate with the most secure protocol versions and cryptographic parameters. Which action does the engineer recommend?

Upgrade to TLS v1 3.

Install the latest IIS version.

Downgrade to TLS 1.1.

Deploy an intrusion detection system

NEW QUESTION 36
Refer to the exhibit.

What is occurring in this network?

ARP cache poisoning

DNS cache poisoning

MAC address table overflow

MAC flooding attack

NEW QUESTION 37
Which category relates to improper use or disclosure of PII data?

legal

compliance

regulated

contractual

NEW QUESTION 38
Which event is user interaction?

gaining root access

executing remote code

reading and writing file permission

opening a malicious file

NEW QUESTION 39

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are two active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

Section: Host-Based Analysis

NEW QUESTION 40
Refer to the exhibit.

Which component is identifiable in this exhibit?

Trusted Root Certificate store on the local machine

Windows PowerShell verb

Windows Registry hive

local service in the Windows Services Manager

NEW QUESTION 41
Refer to the exhibit.

Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.

NEW QUESTION 42
Which security principle is violated by running all processes as root or administrator?

principle of least privilege

role-based access control

separation of duties

trusted computing base

Section: Security Concepts

NEW QUESTION 43
Which information must an organization use to understand the threats currently targeting the organization?

threat intelligence

risk scores

vendor suggestions

vulnerability exposure

NEW QUESTION 44
During which phase of the forensic process are tools and techniques used to extract information from the collected data?

investigation

examination

reporting

collection

NEW QUESTION 45
Refer to the exhibit.

Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.

NEW QUESTION 46
What is the difference between a threat and a risk?

Threat represents a potential danger that could take advantage of a weakness in a system

Risk represents the known and identified loss or danger in the system

Risk represents the nonintentional interaction with uncertainty in the system

Threat represents a state of being exposed to an attack or a compromise, either physically or logically.

A threat is any potential danger to an asset. If a vulnerability exists but has not yet been exploited-or, more importantly, it is not yet publicly known-the threat is latent and not yet realized.

NEW QUESTION 47

Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?