Cisco Understanding Cisco Cybersecurity Operations Fundamentals - 200-201 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

Refer to the exhibit. What must be interpreted from this packet capture?

A. IP address 192.168.88.12 is communicating with 192.168 88.149 with a source port 49098 to destination port 80 using TCP protocol. B. IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol. C. IP address 192.168.88,12 is communicating with 192.168.88.149 with a source port 74 to destination port 49098 using TCP protocol D. IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.

Discussion 0

Correct Answer: A Vote an answer

Question 2

A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format.
Which type of evidence is this file?

A. CD data copy prepared in Linux system B. CD data copy prepared in Android-based system C. CD data copy prepared in Windows D. CD data copy prepared in Mac-based system

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

An analyst see that this security alert "Default-Botnet-Communication-Detection-By-Endpoint" has been raised from the IPS. The analyst checks and finds that an endpoint communicates to the C&C.
How must an impact from this event be categorized?

A. false negative B. false positive C. true positive D. true negative

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 4

What is a difference between antivirus and antimalware security systems?

A. Antivirus deals with well-known threats, such as Trojans and viruses, and antimalware typically focuses on newer threats, such as polymorphic malware and malware delivered by zero-day exploits. B. Antimalware protects users from lingering, predictable yet dangerous malware, and antivirus protects users from the latest, currently in the wild exploits. C. Antimalware offers the minimum layer of protection against classic viruses like keyloggers, and antivirus utilizes heuristic-based detection to proactively find source codes that indicate a threat. D. Antivirus updates rules faster, hence having the best protection against new malware, and antimalware is best for trojans and crypto-malware types of threats.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 5

What is the difference between deep packet inspection and stateful inspection?

A. Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7 B. Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4 C. Deep packet inspection is more secure than stateful inspection on Layer 4 D. Stateful inspection is more secure than deep packet inspection on Layer 7

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

An engineer received a ticket to investigate a potentially malicious file detected by a malware scanner that was trying to execute multiple commands. During the initial review, the engineer discovered that the file was created two days prior. Further analyses show that the file was downloaded from a known malicious domain after a successful phishing attempt on an asset owner. At which phase of the Cyber Kill Chain was this attack mitigated?

A. reconnaissance B. delivery C. exploitation D. installation

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 7

What describes the usage of a rootkit in endpoint-based attacks?

A. remote code execution that causes a denial-of-service on the system B. set of tools used by an attacker to maintain control of a compromised system while avoiding detection C. set of vulnerabilities used by an attacker to disable root access on the system D. exploit that can be used to perform remote code execution

Discussion 0

Correct Answer: B Vote an answer

Question 8

A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?

A. file size B. file name C. file type D. file hash value

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 9

What is a difference between inline traffic interrogation and traffic mirroring?

A. Traffic mirroring passes live traffic to a tool for blocking B. Inline inspection acts on the original traffic data flow C. Inline traffic copies packets for analysis and security D. Traffic mirroring inspects live traffic for analysis and mitigation

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 10

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible?

A. NAT B. TOR C. tunneling D. encapsulation

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 11

While analyzing the process of a recent breach case, a forensic investigator determined that an external USB drive was connected to the laptop of the HR manager and personal data of employees was exfiltrated to an external source. Video surveillance showed a stranger giving this USB drive to an HR manager during a job interview. How must this type of evidence be categorized?

A. corroborative evidence B. direct evidence C. indirect evidence D. best evidence

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).