Cisco 200-201 Real Exam Questions and Answers FREE [Q43-Q63]

Cisco 200-201 Real Exam Questions and Answers FREE

Exam Dumps 200-201 Practice Free Latest Cisco Practice Tests

With the development of the IT field, the professionals desire to improve their expertise in various subject areas. Those individuals who want to evaluate their skills in cybersecurity can opt for the Cisco Certified CyberOps Associate certificate. Getting this certification inflames your career and proves that you know how to work with cybersecurity services. To obtain it, the applicants are obliged to pass the Cisco 200-201 exam that covers the basics of this field as well as the key methods and skills.

Skills That Candidates Need to Develop to Pass 200-201

When you start preparing for the Cisco 200-201 exam, you should start by downloading its blueprint. This document will give you direction over the topics tested and the skills that you need to gain. These are as follows:

• Map different events and compare their characteristics to perform a network intrusion analysis
• – when it comes to the peculiarities of this section, it will cover the concepts like host-based intrusion detection, block listing, and sandboxing involving Chrome, Java, and Adobe Reader. In addition, candidates will need to concentrate on how to differentiate between the components of the operating system, define attribution in an investigation, look into the details for tampered and untampered disk image, and deal with such malware analysis tools like URLs and hashes.
• – this domain will teach you how to define the CIA triad and compare various security deployments like endpoint, agent-based & agentless protection measures, log management, SIEM, and SOAR. In addition, you will get to know more about TI (threat intelligence), hunting, and malware analysis. Within this tested area, candidates as well will need to grasp such security concepts as risk, vulnerability, exploit, and threat. Finally, you will have to get the gist of access control models, data visibility, and 5-tuple approach.
• – this part will equip you with the relevant knowledge of how to provide network application control and compare items like false positive-false negative, true positive-true negative, and benign. Moreover, applicants will have to demonstrate a solid knowledge of traffic interrogation & monitoring, Wireshark, and PCAP files. A candidate will as well interpret the fields in protocols like IPv4, IPv6, TCP, ICMP, DNS if to name a few, and will explain general artifact components.
• Identify vulnerability areas and ensure the highest level of security monitoring

Security Monitoring

The questions from this part cover 25% of the entire content and are dedicated to validating the following expertise:

• Describing the influence of access control program, tunneling & encryption, encapsulation & load balancing, as well as NAT/PAT, P2P, and TOR on information visibility;
• Identifying the types of data presented by such technologies as NetFlow, TCP dump, next-gen and traditional stateful firewall, Web and Email content filtering, as well as app visibility & control;
• Describing the utilization of metadata, full packet capture, as well as session, transaction, statistical, and alert data in security control;
• Describing the influence of certificates on security.
• Describing the obfuscation & evasion techniques, including proxies, encryption, and tunneling;

NO.43 Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2?
(Choose two.)

 detection and analysis

 post-incident activity

 vulnerability management

 risk assessment

 vulnerability scoring

NO.44 Refer to the exhibit.

A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted What is occurring?

 indicators of denial-of-service attack due to the frequency of requests

 garbage flood attack attacker is sending garbage binary data to open ports

 indicators of data exfiltration HTTP requests must be plain text

 cache bypassing attack: attacker is sending requests for noncacheable content

NO.45 Drag and drop the security concept on the left onto the example of that concept on the right.

NO.46 What is an incident response plan?

 an organizational approach to events that could lead to asset loss or disruption of operations

 an organizational approach to security management to ensure a service lifecycle and continuous improvements

 an organizational approach to disaster recovery and timely restoration of operational services

 an organizational approach to system backup and data archiving aligned to regulations

NO.47 What is a difference between SIEM and SOAR?

 SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

 SlEM’s primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

 SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

 SOAR’s primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

NO.48 Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

 Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.

 Host 152.46.6.91 is being identified as a watchlist country for data transfer.

 Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.

 Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.

NO.49 What is the difference between discretionary access control (DAC) and role-based access control (RBAC)?

 DAC requires explicit authorization for a given user on a given object, and RBAC requires specific conditions.

 RBAC access is granted when a user meets specific conditions, and in DAC, permissions are applied on user and group levels.

 RBAC is an extended version of DAC where you can add an extra level of authorization based on time.

 DAC administrators pass privileges to users and groups, and in RBAC, permissions are applied to specific groups

NO.50 A security engineer deploys an enterprise-wide host/endpoint technology for all of the company’s corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.
Which technology should be used to accomplish this task?

 application whitelisting/blacklisting

 network NGFW

 host-based IDS

 antivirus/antispyware software

Section: Network Intrusion Analysis

NO.51 Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

 decision making

 rapid response

 data mining

 due diligence

NO.52 An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.
Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)

 signatures

 host IP addresses

 file size

 dropped files

 domain names

NO.53 Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

 UDP port to which the traffic is destined

 TCP port from which the traffic was sourced

 source IP address of the packet

 destination IP address of the packet

 UDP port from which the traffic is sourced

Section: Network Intrusion Analysis

NO.54 Which two elements are used for profiling a network? (Choose two.)

 session duration

 total throughput

 running processes

 listening ports

 OS fingerprint

Explanation
A network profile should include some important elements, such as the following:
Total throughput – the amount of data passing from a given source to a given destination in a given period of time Session duration – the time between the establishment of a data flow and its termination Ports used – a list of TCP or UDP processes that are available to accept data Critical asset address space – the IP addresses or the logical location of essential systems or data Profiling data are data that system has gathered, these data helps for incident response and to detect incident Network profiling = throughput, sessions duration, port used, Critical Asset Address Space Host profiling = Listening ports, logged in accounts, running processes, running tasks,applications

NO.55 Refer to the exhibit.

Which technology generates this log?

 NetFlow

 IDS

 web proxy

 firewall

NO.56 DRAG DROP
Drag and drop the security concept on the left onto the example of that concept on the right.
Select and Place:

NO.57 An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?

 The threat actor used a dictionary-based password attack to obtain credentials.

 The threat actor gained access to the system by known credentials.

 The threat actor used the teardrop technique to confuse and crash login services.

 The threat actor used an unknown vulnerability of the operating system that went undetected.

NO.58 What is personally identifiable information that must be safeguarded from unauthorized access?

 date of birth

 driver’s license number

 gender

 zip code

Explanation
According to the Executive Office of the President, Office of Management and Budget (OMB), and the U.S.
Department of Commerce, Office of the Chief Information Officer, PII refers to “information which can be used to distinguish or trace an individual’s identity.” The following are a few examples:
– An individual’s name
– Social security number
– Biological or personal characteristics, such as an image of distinguishing features, fingerprints, Xrays, voice signature, retina scan, and the geometry of the face
– Date and place of birth
– Mother’s maiden name
– Credit card numbers
– Bank account numbers
– Driver license number
– Address information, such as email addresses or street addresses, and telephone numbers for businesses or personal use
– Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide Omar Santos

NO.59 Refer to the exhibit.

Which application protocol is in this PCAP file?

 SSH

 TCP

 TLS

 HTTP

NO.60 Which security principle requires more than one person is required to perform a critical task?

 least privilege

 need to know

 separation of duties

 due diligence

Section: Security Concepts

NO.61 What is a difference between signature-based and behavior-based detection?

 Signature-based identifies behaviors that may be linked to attacks, while behavior-based has a predefined set of rules to match before an alert.

 Behavior-based identifies behaviors that may be linked to attacks, while signature-based has a predefined set of rules to match before an alert.

 Behavior-based uses a known vulnerability database, while signature-based intelligently summarizes existing data.

 Signature-based uses a known vulnerability database, while behavior-based intelligently summarizes existing data.

Explanation
Instead of searching for patterns linked to specific types of attacks, behavior-based IDS solutions monitor behaviors that may be linked to attacks, increasing the likelihood of identifying and mitigating a malicious action before the network is compromised.
https://accedian.com/blog/what-is-the-difference-between-signature-based-and-behavior-based-ids/

NO.62 When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

 fragmentation

 pivoting

 encryption

 stenography

Section: Security Concepts

NO.63 Which regular expression matches “color” and “colour”?

 colo?ur

 col[08]+our

 colou?r

 col[09]+our

 Loading …

Verified 200-201 Exam Dumps Q&As – Provide 200-201 with Correct Answers: https://www.examboosts.com/Cisco/200-201-practice-exam-dumps.html

         

Related Links: myportal.utt.edu.tt www.stes.tyc.edu.tw www.stes.tyc.edu.tw www.stes.tyc.edu.tw www.stes.tyc.edu.tw www.stes.tyc.edu.tw