Steps Necessary To Pass The 200-201 Exam from Training Expert PassTorrent
Valid Way To Pass CyberOps Associate's 200-201 Exam
NEW QUESTION 85
What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?
- A. Tapping interrogation replicates signals to a separate port for analyzing traffic
- B. Inline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies
- C. Tapping interrogations detect and block malicious traffic
- D. Inline interrogation detects malicious traffic but does not block the traffic
Answer: A
NEW QUESTION 86
Refer to the exhibit.
What is the potential threat identified in this Stealthwatch dashboard?
- A. Host 152.46.6.91 is being identified as a watchlist country for data transfer.
- B. Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.
- C. Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.
- D. Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.
Answer: D
NEW QUESTION 87
One of the objectives of information security is to protect the CIA of information and systems.
What does CIA mean in this context?
- A. confidentiality, integrity, and availability
- B. confidentiality, integrity, and authorization
- C. confidentiality, identity, and availability
- D. confidentiality, identity, and authorization
Answer: A
NEW QUESTION 88
Which process is used when IPS events are removed to improve data integrity?
- A. data signature
- B. data protection
- C. data normalization
- D. data availability
Answer: C
Explanation:
Section: Security Concepts
NEW QUESTION 89
Refer to the exhibit.
What is the potential threat identified in this Stealthwatch dashboard?
- A. A policy violation is active for host 10.10.101.24.
- B. A policy violation is active for host 10.201.3.149.
- C. There are three active data exfiltration alerts.
- D. A host on the network is sending a DDoS attack to another inside host.
Answer: C
Explanation:
Explanation
"EX" = exfiltration
And there are three.
Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration
https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/management_console/smc_users_guide/SW_6 page 177.
NEW QUESTION 90
A developer is working on a project using a Linux tool that enables writing processes to obtain these required results:
* If the process is unsuccessful, a negative value is returned.
* If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process.
Which component results from this operation?
- A. parent directory name of a file pathname
- B. macros for managing CPU sets
- C. new process created by parent process
- D. process spawn scheduled
Answer: C
NEW QUESTION 91
An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.
What is the initial event called in the NIST SP800-61?
- A. trigger
- B. online assault
- C. precursor
- D. instigator
Answer: C
Explanation:
Explanation
A precursor is a sign that a cyber-attack is about to occur on a system or network. An indicator is the actual alerts that are generated as an attack is happening. Therefore, as a security professional, it's important to know where you can find both precursor and indicator sources of information.
The following are common sources of precursor and indicator information:
* Security Information and Event Management (SIEM)
* Anti-virus and anti-spam software
* File integrity checking applications/software
* Logs from various sources (operating systems, devices, and applications)
* People who report a security incident
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
NEW QUESTION 92
An analyst is investigating an incident in a SOC environment.
Which method is used to identify a session from a group of logs?
- A. 5-tuple
- B. IP identifier
- C. timestamps
- D. sequence numbers
Answer: A
Explanation:
Section: Security Concepts
NEW QUESTION 93
What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?
- A. DAC is the strictest of all levels of control and MAC is object-based access
- B. DAC is controlled by the operating system and MAC is controlled by an administrator
- C. MAC is controlled by the discretion of the owner and DAC is controlled by an administrator
- D. MAC is the strictest of all levels of control and DAC is object-based access
Answer: D
NEW QUESTION 94
What is the difference between a threat and an exploit?
- A. A threat is a potential attack on an asset and an exploit takes advantage of the vulnerability of the asset
- B. An exploit is an attack path, and a threat represents a potential vulnerability
- C. A threat is a result of utilizing flow in a system, and an exploit is a result of gaining control over the system.
- D. An exploit is an attack vector, and a threat is a potential path the attack must go through.
Answer: A
NEW QUESTION 95
A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?
- A. file type
- B. file hash value
- C. file name
- D. file size
Answer: B
NEW QUESTION 96
Refer to the exhibit.
An analyst received this alert from the Cisco ASA device, and numerous activity logs were produced. How should this type of evidence be categorized?
- A. corroborative
- B. best
- C. indirect
- D. circumstantial
Answer: A
Explanation:
Explanation
Indirect=circumstantail so there is no posibility to match A or B (only one answer is needed in this question).
For suer it's not a BEST evidence - this FW data inform only of DROPPED traffic. If smth happend inside network, presented evidence could be used to support other evidences or make our narreation stronger but alone it's mean nothing.
NEW QUESTION 97
Refer to the exhibit.
What is depicted in the exhibit?
- A. IIS logs
- B. Windows Event logs
- C. Apache logs
- D. UNIX-based syslog
Answer: D
NEW QUESTION 98
A company encountered a breach on its web servers using IIS 7 5 Dunng the investigation, an engineer discovered that an attacker read and altered the data on a secure communication using TLS 1 2 and intercepted sensitive information by downgrading a connection to export-grade cryptography. The engineer must mitigate similar incidents in the future and ensure that clients and servers always negotiate with the most secure protocol versions and cryptographic parameters. Which action does the engineer recommend?
- A. Install the latest IIS version.
- B. Downgrade to TLS 1.1.
- C. Upgrade to TLS v1 3.
- D. Deploy an intrusion detection system
Answer: A
NEW QUESTION 99
Refer to the exhibit.
Which application protocol is in this PCAP file?
- A. TLS
- B. SSH
- C. TCP
- D. HTTP
Answer: A
NEW QUESTION 100
Drag and drop the security concept on the left onto the example of that concept on the right.
Answer:
Explanation:
NEW QUESTION 101
A user received a targeted spear-phishing email and identified it as suspicious before opening the content. To which category of the Cyber Kill Chain model does to this type of event belong?
- A. weaponization
- B. exploitation
- C. delivery
- D. reconnaissance
Answer: C
NEW QUESTION 102 
Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?
- A. Host 152.46.6.91 is being identified as a watchlist country for data transfer.
- B. Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.
- C. Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.
- D. Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.
Answer: D
Explanation:
Section: Host-Based Analysis
NEW QUESTION 103
Which metric is used to capture the level of access needed to launch a successful attack?
- A. user interaction
- B. privileges required
- C. attack vector
- D. attack complexity
Answer: C
Explanation:
Explanation
Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter7: Introduction to Security Operations Management.
NEW QUESTION 104
What is the difference between deep packet inspection and stateful inspection?
- A. Stateful inspection is more secure due to its complex signatures, and deep packet inspection requires less human intervention.
- B. Deep packet inspection is more secure due to its complex signatures, and stateful inspection requires less human intervention.
- C. Deep packet inspection gives insights up to Layer 7, and stateful inspection gives insights only up to Layer 4.
- D. Stateful inspection verifies data at the transport layer and deep packet inspection verifies data at the application layer
Answer: B
NEW QUESTION 105
Refer to the exhibit.
Which type of log is displayed?
- A. sys
- B. NetFlow
- C. proxy
- D. IDS
Answer: A
NEW QUESTION 106
What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?
- A. SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.
- B. APS interrogation is more complex because traffic mirroring applies additional tags to data and SPAN does not alter integrity and provides full duplex network.
- C. TAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools
- D. SPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.
Answer: B
NEW QUESTION 107
Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?
- A. syslog messages
- B. full packet capture
- C. NetFlow
- D. firewall event logs
Answer: C
Explanation:
Section: Security Monitoring
NEW QUESTION 108
......
200-201 Details
The test has a duration of 120 minutes during which the candidates will have to answer 95 to 105 questions. Applicants can enroll in their exams by using the Pearson VUE platform after having created an account there and selected the “proctored exam” section. Thereafter, you should search the code 200-201 and follow the instructions to fully register. The fee for this test is $300 and it's available in the English language only.
All 200-201 Dumps and Understanding Cisco Cybersecurity Operations Fundamentals Training Courses: https://freepdf.passtorrent.com/200-201-latest-torrent.html