Download 200-201 CBROPS Dumps To Get Cisco Certified CyberOps Associate Certification

test2022-07-16T03:01:21+00:00

Looking for free 200-201 CBROPS Dumps? Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CBROPS) exam is a 120-minute assessment that is associated with the Cisco Certified CyberOps Associate certification. If you want complete and accurate 200-201 CBROPS Dumps, please choose FreeTestShare as your study guide! FreeTestShare 200-201 CBROPS Dumps cover real exam questions and answersto help you prepare for the 200-201 exam well. With real 200-201 CBROPS Dumps, you can learn about the exam topics and pattern fast to better adapt to the exam environment. We guarantees you 100% pass the Cisco 200-201 CBROPS exam on the first try!

Try these 200-201 practice exam questions for free.

Page 1 of 7

1. Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

resource exhaustion

tunneling

traffic fragmentation

timing attack

2. Refer to the exhibit.

Which type of attack is being executed?

SQL injection

cross-site scripting

cross-site request forgery

command injection

3. Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are two active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

4. What is an example of social engineering attacks?

receiving an unexpected email from an unknown person with an attachment from someone in the same company

receiving an email from human resources requesting a visit to their secure website to update contact information

sending a verbal request to an administrator who knows how to change an account password

receiving an invitation to the department’s weekly WebEx meeting

5. Which type of evidence supports a theory or an assumption that results from initial evidence?

probabilistic

indirect

best

corroborative

6. Refer to the exhibit.

What is occurring within the exhibit?

regular GET requests

XML External Entities attack

insecure deserialization

cross-site scripting attack

7. What is a difference between inline traffic interrogation and traffic mirroring?

Inline inspection acts on the original traffic data flow

Traffic mirroring passes live traffic to a tool for blocking

Traffic mirroring inspects live traffic for analysis and mitigation

Inline traffic copies packets for analysis and security

8. How is attacking a vulnerability categorized?

action on objectives

delivery

exploitation

installation

9. Refer to the exhibit.

This request was sent to a web application server driven by a database .

Which type of web server attack is represented?

parameter manipulation

heap memory corruption

command injection

blind SQL injection

10. Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

detection and analysis

post-incident activity

vulnerability management

risk assessment

vulnerability scoring

Page 2 of 7

11. What describes the defense-m-depth principle?

defining precise guidelines for new workstation installations

categorizing critical assets within the organization

isolating guest Wi-Fi from the focal network

implementing alerts for unexpected asset malfunctions

12. Refer to the exhibit.

An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email .

What is the state of this file?

The file has an embedded executable and was matched by PEiD threat signatures for further analysis.

The file has an embedded non-Windows executable but no suspicious features are identified.

The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.

13. Which two components reduce the attack surface on an endpoint? (Choose two.)

secure boot

load balancing

increased audit log levels

restricting USB ports

full packet captures at the endpoint

14. What is a difference between data obtained from Tap and SPAN ports?

Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.

SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times.

SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility.

Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination

15. DRAG DROP

Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

16. Which metric is used to capture the level of access needed to launch a successful attack?

privileges required

user interaction

attack complexity

attack vector

17. What is the function of a command and control server?

It enumerates open ports on a network device

It drops secondary payload into malware

It is used to regain control of the network after a compromise

It sends instruction to a compromised system

18. A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format .

Which type of evidence is this file?

CD data copy prepared in Windows

CD data copy prepared in Mac-based system

CD data copy prepared in Linux system

CD data copy prepared in Android-based system

19. What is a difference between tampered and untampered disk images?

Tampered images have the same stored and computed hash.

Tampered images are used as evidence.

Untampered images are used for forensic investigations.

Untampered images are deliberately altered to preserve as evidence

20. What is the impact of false positive alerts on business compared to true positive?

True positives affect security as no alarm is raised when an attack has taken place, while false positives are alerts raised appropriately to detect and further mitigate them.

True-positive alerts are blocked by mistake as potential attacks, while False-positives are actual attacks Identified as harmless.

False-positive alerts are detected by confusion as potential attacks, while true positives are attack attempts identified appropriately.

False positives alerts are manually ignored signatures to avoid warnings that are already acknowledged, while true positives are warnings that are not yet acknowledged.

Page 3 of 7

21. An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap .

Which command will accomplish this goal?

nmap --top-ports 192.168.1.0/24

nmap CsP 192.168.1.0/24

nmap -sL 192.168.1.0/24

nmap -sV 192.168.1.0/24

22. What are the two characteristics of the full packet captures? (Choose two.)

Identifying network loops and collision domains.

Troubleshooting the cause of security and performance issues.

Reassembling fragmented traffic from raw data.

Detecting common hardware faults and identify faulty assets.

Providing a historical record of a network transaction.

23. What is vulnerability management?

A security practice focused on clarifying and narrowing intrusion points.

A security practice of performing actions rather than acknowledging the threats.

A process to identify and remediate existing weaknesses.

A process to recover from service interruptions and restore business-critical applications

24. An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack .

What is the reason for this discrepancy?

The computer has a HIPS installed on it.

The computer has a NIPS installed on it.

The computer has a HIDS installed on it.

The computer has a NIDS installed on it.

25. Refer to the exhibit.

Which technology generates this log?

NetFlow

IDS

web proxy

firewall

26. An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.

Which kind of evidence is this IP address?

best evidence

corroborative evidence

indirect evidence

forensic evidence

27. An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.

What is the initial event called in the NIST SP800-61?

online assault

precursor

trigger

instigator

28. Refer to the exhibit.

In which Linux log file is this output found?

/var/log/authorization.log

/var/log/dmesg

var/log/var.log

/var/log/auth.log

29. During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

examination

investigation

collection

reporting

30. Which two elements are assets in the role of attribution in an investigation? (Choose two.)

context

session

laptop

firewall logs

threat actor

Page 4 of 7

31. A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.

Which technology should be used to accomplish this task?

application whitelisting/blacklisting

network NGFW

host-based IDS

antivirus/antispyware software

32. DRAG DROP

Drag and drop the access control models from the left onto the correct descriptions on the right.

33. An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network .

What is the impact of this traffic?

ransomware communicating after infection

users downloading copyrighted content

data exfiltration

user circumvention of the firewall

34. What describes the impact of false-positive alerts compared to false-negative alerts?

A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised

A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring

A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.

A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.

35. Refer to the exhibit.

Which stakeholders must be involved when a company workstation is compromised?

Employee 1 Employee 2, Employee 3, Employee 4, Employee 5, Employee 7

Employee 1, Employee 2, Employee 4, Employee 5

Employee 4, Employee 6, Employee 7

Employee 2, Employee 3, Employee 4, Employee 5

36. Which type of access control depends on the job function of the user?

discretionary access control

nondiscretionary access control

role-based access control

rule-based access control

37. A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders After further investigation, the analyst learns that customers claim that they cannot access company servers According to NIST SP800-61, in which phase of the incident response process is the analyst?

post-incident activity

detection and analysis

preparation

containment, eradication, and recovery

38. What is personally identifiable information that must be safeguarded from unauthorized access?

date of birth

driver's license number

gender

zip code

39. A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engineer needs to analyze the network and identify ways to improve traffic movement to minimize delays .

Which information must the engineer obtain for this analysis?

total throughput on the interface of the router and NetFlow records

output of routing protocol authentication failures and ports used

running processes on the applications and their total network usage

deep packet captures of each application flow and duration

40. When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.

Which information is available on the server certificate?

server name, trusted subordinate CA, and private key

trusted subordinate CA, public key, and cipher suites

trusted CA name, cipher suites, and private key

server name, trusted CA, and public key

Page 5 of 7

41. A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

42. Refer to the exhibit.

Which two elements in the table are parts of the 5-tuple? (Choose two.)

First Packet

Initiator User

Ingress Security Zone

Source Port

Initiator IP

43. Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

decision making

rapid response

data mining

due diligence

44. Which step in the incident response process researches an attacking host through logs in a SIEM?

detection and analysis

preparation

eradication

containment

45. Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

integrity

confidentiality

availability

scope

46. How does statistical detection differ from rule-based detection?

Statistical detection involves the evaluation of events, and rule-based detection requires an evaluated set of events to function.

Statistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules

Rule-based detection involves the evaluation of events, and statistical detection requires an evaluated set of events to function Rule-based detection defines

legitimate data over a period of time, and statistical detection works on a predefined set of rules

47. How is NetFlow different from traffic mirroring?

NetFlow collects metadata and traffic mirroring clones data.

Traffic mirroring impacts switch performance and NetFlow does not.

Traffic mirroring costs less to operate than NetFlow.

NetFlow generates more data than traffic mirroring.

48. What is threat hunting?

Managing a vulnerability assessment report to mitigate potential threats.

Focusing on proactively detecting possible signs of intrusion and compromise.

Pursuing competitors and adversaries to infiltrate their system to acquire intelligence data.

Attempting to deliberately disrupt servers by altering their availability

49. A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.

Which type of evidence is this?

best evidence

prima facie evidence

indirect evidence

physical evidence

50. An automotive company provides new types of engines and special brakes for rally sports cars. The company has a database of inventions and patents for their engines and technical information Customers can access the database through the company's website after they register and identify themselves .

Which type of protected data is accessed by customers?

IP data

PII data

PSI data

PHI data

Page 6 of 7

51. Which type of data collection requires the largest amount of storage space?

alert data

transaction data

session data

full packet capture

52. What does cyber attribution identify in an investigation?

cause of an attack

exploit of an attack

vulnerabilities exploited

threat actors of an attack

53. Which event is user interaction?

gaining root access

executing remote code

reading and writing file permission

opening a malicious file

54. Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

availability

confidentiality

scope

integrity

55. A user received an email attachment named "Hr405-report2609-empl094.exe" but did not run it .

Which category of the cyber kill chain should be assigned to this type of event?

installation

reconnaissance

weaponization

delivery

56. Which process is used when IPS events are removed to improve data integrity?

data availability

data normalization

data signature

data protection

57. A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver .

Which event category is described?

reconnaissance

action on objectives

installation

exploitation

58. Refer to the exhibit.

What does the output indicate about the server with the IP address 172.18.104.139?

open ports of a web server

open port of an FTP server

open ports of an email server

running processes of the server

59. How does an attack surface differ from an attack vector?

An attack vector recognizes the potential outcomes of an attack, and the attack surface is choosing a method of an attack.

An attack surface identifies vulnerable parts for an attack, and an attack vector specifies which attacks are feasible to those parts.

An attack surface mitigates external vulnerabilities, and an attack vector identifies mitigation techniques and possible workarounds.

An attack vector matches components that can be exploited, and an attack surface classifies the potential path for exploitation

60. An organization's security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning.

How should the analyst collect the traffic to isolate the suspicious host?

by most active source IP

by most used ports

based on the protocols used

based on the most used applications

Page 7 of 7

61. What is a purpose of a vulnerability management framework?

identifies, removes, and mitigates system vulnerabilities

detects and removes vulnerabilities in source code

conducts vulnerability scans on the network

manages a list of reported vulnerabilities

62. Which type of data consists of connection level, application-specific records generated from network traffic?

transaction data

location data

statistical data

alert data