PDF (New 2024) Actual Cisco 200-201 Exam Questions [Q51-Q65]

ExamBoosts November 5, 2024 200-201 > Cisco 0

Rate this post

PDF (New 2024) Actual Cisco 200-201 Exam Questions

Dumps Moneyack Guarantee – 200-201 Dumps UpTo 90% Off

NO.51 Refer to the exhibit.

Which technology generates this log?

NetFlow

IDS

web proxy

firewall

The log in the exhibit is generated by a firewall. It shows a deny action taken on TCP traffic, specifying the source and destination addresses and ports, which is characteristic of firewall logs. Firewalls are designed to control incoming and outgoing network traffic based on predetermined security rules, and this log entry reflects the enforcement of such a rule.
References :=
* Cisco’s official documentation on firewall technologies and their log formats.

NO.52 A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

file header type

file size

file name

file hash value

NO.53 Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

known-plaintext

replay

dictionary

man-in-the-middle

A man-in-the-middle attack occurs when a third party intercepts and potentially alters the communication between two parties (in this case, two IP phones) without them knowing. This type of attack can lead to eavesdropping, where the attacker can gain unauthorized access to sensitive data being communicated between the two parties. References := Cisco Cybersecurity Operations Fundamentals – Module 5: Endpoint Threat Analysis and Computer Forensics

NO.54 Which type of evidence supports a theory or an assumption that results from initial evidence?

probabilistic

indirect

best

corroborative

Section: Security Policies and Procedures

NO.55 Refer to the exhibit.
An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server Which display filters should the analyst use to filter the FTP traffic?

dstport == FTP

tcp.port==21

tcpport = FTP

dstport = 21

The correct display filter for analyzing FTP traffic in a PCAP file is “tcp.port==21”. This filter will show all TCP packets where the port number is 21, which is the standard port for FTP control messages.

NO.56 Refer to the exhibit.

An engineer received an event log file to review. Which technology generated the log?

NetFlow

proxy

firewall

IDS/IPS

The exhibit shows an event log file with fields like date time action protocol src-ip dst-ip src-port dst-port etc., which are typical in Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS). These systems monitor network traffic for suspicious activity or violations of policies and produce reports as seen in the exhibit. References: Cisco Certified CyberOps Associate Overview

NO.57 What is a difference between SOAR and SIEM?

SOAR platforms are used for threat and vulnerability management, but SIEM applications are not

SIEM applications are used for threat and vulnerability management, but SOAR platforms are not

SOAR receives information from a single platform and delivers it to a SIEM

SIEM receives information from a single platform and delivers it to a SOAR

Section: Security Concepts
Explanation

NO.58 While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible?

encapsulation

TOR

tunneling

NAT

NO.59 How is NetFlow different from traffic mirroring?

NetFlow collects metadata and traffic mirroring clones data.

Traffic mirroring impacts switch performance and NetFlow does not.

Traffic mirroring costs less to operate than NetFlow.

NetFlow generates more data than traffic mirroring.

NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network traffic. It collects metadata of the IP traffic flowing across networking devices like routers and switches. On the other hand, Traffic mirroring involves capturing all the data packets that flow through a particular point in the network to analyze or inspect them later. Reference:= Cisco Cybersecurity Operations Fundamentals

NO.60 What causes events on a Windows system to show Event Code 4625 in the log messages?

The system detected an XSS attack

Someone is trying a brute force attack on the network

Another device is gaining root access to the system

A privileged user successfully logged into the system

NO.61 What is the difference between the rule-based detection when compared to behavioral detection?

Rule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature.

Rule-Based systems have established patterns that do not change with new data, while behavioral changes.

Behavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags potentially abnormal patterns using signatures.

Behavioral systems find sequences that match a particular attack signature, while Rule-Based identifies potential attacks.

Rule-based detection involves identifying malicious activities based on predefined rules or patterns of known attacks; it does not adapt or change with new data. In contrast, behavioral detection adapts over time by learning from new data; it identifies malicious activities based on deviations from established norms or behaviors. References: Cisco Certified CyberOps Associate Overview, Section 1.0: Security Concepts, Subsection 1.1: Compare and contrast the characteristics of data obtained from taps, NetFlow, and packet capture)

NO.62 When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.
Which information is available on the server certificate?

server name, trusted CA, and public key

trusted CA name, cipher suites, and private key

trusted subordinate CA, public key, and cipher suites

server name, trusted subordinate CA, and private key

When communicating via TLS, part of the handshake process involves presenting a certificate containing the server name, the name of the trusted CA that issued the certificate, and the public key of the server. The client can verify the validity of the certificate and use the public key to encrypt the data sent to the server. Reference:= Cisco Cybersecurity Source Documents

NO.63 What matches the regular expression c(rgr)+e?

crgrrgre

np+e

c(rgr)e

The regular expression c(rgr)+e matches strings where “rgr” occurs one or more times between “c” and “e”.
The string “crgrrgre” fits this pattern as it has the sequence “rgr” repeated twice between “c” and “e”. The plus sign (+) in the regular expression indicates that the preceding element must appear one or more times for a match to occur

NO.64 Which evasion technique is a function of ransomware?

extended sleep calls

encryption

resource exhaustion

encoding

Encryption is an evasion technique that is a function of ransomware, which is a type of malware that encrypts the victim’s files or system and demands a ransom for the decryption key. Encryption is used by ransomware to prevent the victim from accessing their data and to avoid detection by antivirus or other security tools. Encryption can also be used by other types of malware to hide their communication, configuration, or payload from analysis. Reference:
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 3: Network Intrusion Analysis, Lesson 3.4: Malware Cisco Certified CyberOps Associate Overview, Exam Topics, 3.4 Compare and contrast types of malware

NO.65 A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.
Which type of evidence is this?

best evidence

prima facie evidence

indirect evidence

physical evidence

Section: Host-Based Analysis

Loading …