Cisco 200-201 Exam Dumps

Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Cisco 200-201 Sample Questions

Question # 1

An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task? 

A. Firepower  
B. Email Security Appliance  
C. Web Security Appliance  
D. Stealthwatch  

Show Answer

Question # 2

Which technology prevents end-device to end-device IP traceability? 

A. encryption  
B. load balancing  
C. NAT/PAT  
D. tunneling  

Show Answer

Question # 3

Which statement describes patch management? 

A. scanning servers and workstations for missing patches and vulnerabilities  
B. managing and keeping previous patches lists documented for audit purposes  
C. process of appropriate distribution of system or software updates  
D. workflow of distributing mitigations of newly found vulnerabilities  

Show Answer

Question # 4

Developers must implement tasks on remote Windows environments. They decided to usescripts for enterprise applications through PowerShell. Why does the functionality notwork?

A. WMI must be configured.  
B. Symlinks must be enabled.  
C. Ext4 must be implemented.  
D. MBR must be set up.  

Show Answer

Question # 5

Which management concept best describes developing, operating, maintaining, upgrading, and disposing of all resources?

A. configuration  
B. vulnerability  
C. asset  
D. patch  

Show Answer

Question # 6

What is a difference between rule-based and role-based access control mechanisms? 

A. Rule-based are simple and easy to execute, and role-based are well-defined.  
B. Role-based are an appropriate choice in geographically diverse workgroups, and rulebased are for simply structured workgroups.
C. Rule-based are less granular, and role-based have time constraints.  
D. Role-based are efficient in small workgroups, and rule-based are preferred in timedefined workgroups. 

Show Answer

Question # 7

What is the difference between deep packet inspection and stateful inspection? 

A. Stateful inspection verifies contents at Layer 4. and deep packet inspection verifies connection at Layer 7. 
B. Stateful inspection is more secure than deep packet inspection on Layer 7.  
C. Deep packet inspection is more secure than stateful inspection on Layer 4.  
D. Deep packet inspection allows visibility on Layer 7, and stateful inspection allows visibility on Layer 4. 

Show Answer

Question # 8

Which attack method is being used when an attacker tries to compromise a network with an authentication system that uses only 4-digit numeric passwords and no username?

A. SQL injection  
B. dictionary  
C. replay  
D. cross-site scripting  

Show Answer

Question # 9

What is a difference between tampered and untampered disk images? 

A. Tampered images have the same stored and computed hash.  
B. Untampered images are deliberately altered to preserve as evidence.  
C. Tampered images are used as evidence.  
D. Untampered images are used for forensic investigations.  

Show Answer

Question # 10

A network engineer discovers that a foreign government hacked one of the defensecontractors in their home country and stole intellectual property. What is the threat agent inthis situation?

A. the intellectual property that was stolen  
B. the defense contractor who stored the intellectual property  
C. the method used to conduct the attack  
D. the foreign government that conducted the attack  

Show Answer

Question # 11

A security engineer must protect the company from known issues that trigger adware.Recently new incident has been raised that could harm the system. Which securityconcepts are present in this scenario?

A. exploit and patching  
B. risk and evidence  
C. analysis and remediation  
D. vulnerability and threat  

Show Answer

Question # 12

Which two pieces of information are collected from the IPv4 protocol header? (Choosetwo.)

A. UDP port to which the traffic is destined  
B. TCP port from which the traffic was sourced  
C. source IP address of the packet  
D. destination IP address of the packet  
E. UDP port from which the traffic is sourced  

Show Answer

Question # 13

How does certificate authority impact a security system? 

A. It authenticates client identity when requesting SSL certificate  
B. It validates domain identity of a SSL certificate  
C. It authenticates domain identity when requesting SSL certificate  
D. It validates client identity when communicating with the server  

Show Answer

Question # 14

An organization that develops high-end technology is going through an internal audit Theorganization uses two databases The main database stores patent information and asecondary database stores employee names and contact information A compliance team isasked to analyze the infrastructure and identify protected data Which two types ofprotected data should be identified? (Choose two)

A. Personally Identifiable Information (Pll)  
B. Payment Card Industry (PCI)  
C. Protected Hearth Information (PHI)  
D. Intellectual Property (IP)  
E. Sarbanes-Oxley (SOX)  

Show Answer

Question # 15

What is a difference between an inline and a tap mode traffic monitoring? 

A. Inline monitors traffic without examining other devices, while a tap mode tags traffic andexamines the data from monitoring devices.
B. Tap mode monitors traffic direction, while inline mode keeps packet data as it passes through the monitoring devices. 
C. Tap mode monitors packets and their content with the highest speed, while the inlinemode draws a packet path for analysis
D. Inline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network. 

Show Answer

Question # 16

How is attacking a vulnerability categorized? 

A. action on objectives  
B. delivery  
C. exploitation  
D. installation  

Show Answer

Question # 17

An engineer receives a security alert that traffic with a known TOR exit node has occurredon the network. What is the impact of this traffic?

A. ransomware communicating after infection  
B. users downloading copyrighted content  
C. data exfiltration  
D. user circumvention of the firewall  

Show Answer

Question # 18

A security engineer deploys an enterprise-wide host/endpoint technology for all of thecompany's corporate PCs. Management requests the engineer to block a selected set ofapplications on all PCs.Which technology should be used to accomplish this task? 

A. application whitelisting/blacklisting  
B. network NGFW  
C. host-based IDS  
D. antivirus/antispyware software  

Show Answer

Question # 19

What is an advantage of symmetric over asymmetric encryption? 

A. A key is generated on demand according to data type.  
B. A one-time encryption key is generated for data transmission  
C. It is suited for transmitting large amounts of data.  
D. It is a faster encryption mechanism for sessions  

Show Answer

Question # 20

The security team has detected an ongoing spam campaign targeting the organization. Theteam's approach is to push back the cyber kill chain and mitigate ongoing incidents. Atwhich phase of the cyber kill chain should the security team mitigate this type of attack?

A. actions  
B. delivery  
C. reconnaissance  
D. installation  

Show Answer

Question # 21

A security engineer must investigate a recent breach within the organization. An engineer noticed that a breached workstation is trying to connect to the domain "Ranso4730-mware92-647". which is known as malicious. In which step of the Cyber Kill Chain is thisevent?

A. Vaporization  
B. Delivery  
C. reconnaissance  
D. Action on objectives  

Show Answer

Question # 22

What is the impact of encryption? 

A. Confidentiality of the data is kept secure and permissions are validated  
B. Data is accessible and available to permitted individuals  
C. Data is unaltered and its integrity is preserved  
D. Data is secure and unreadable without decrypting it  

Show Answer

Question # 23

Which type of data is used to detect anomalies in the network? 

A. statistical data  
B. alert data  
C. transaction data  
D. metadata  

Show Answer

Question # 24

What is the purpose of command and control for network-aware malware? 

A. It contacts a remote server for commands and updates  
B. It takes over the user account for analysis  
C. It controls and shuts down services on the infected host.  
D. It helps the malware to profile the host  

Show Answer

Question # 25

What describes the defense-m-depth principle? 

A. defining precise guidelines for new workstation installations  
B. categorizing critical assets within the organization  
C. isolating guest Wi-Fi from the focal network  
D. implementing alerts for unexpected asset malfunctions  

Show Answer

Question # 26

Why is encryption challenging to security monitoring? 

A. Encryption analysis is used by attackers to monitor VPN tunnels.  
B. Encryption is used by threat actors as a method of evasion and obfuscation.  
C. Encryption introduces additional processing requirements by the CPU.  
D. Encryption introduces larger packet sizes to analyze and store.  

Show Answer

Question # 27

What are the two differences between stateful and deep packet inspection? (Choose two ) 

A. Stateful inspection is capable of TCP state tracking, and deep packet filtering checksonly TCP source and destination ports
B. Deep packet inspection is capable of malware blocking, and stateful inspection is not  
C. Deep packet inspection operates on Layer 3 and 4. and stateful inspection operates onLayer 3 of the OSI model
D. Deep packet inspection is capable of TCP state monitoring only, and stateful inspectioncan inspect TCP and UDP.
E. Stateful inspection is capable of packet data inspections, and deep packet inspection isnot 

Show Answer

Question # 28

What describes the concept of data consistently and readily being accessible for legitimate users?

A. integrity  
B. availability  
C. accessibility  
D. confidentiality  

Show Answer

Question # 29

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones? 

A. known-plaintext  
B. replay  
C. dictionary  
D. man-in-the-middle  

Show Answer

Question # 30

How is SQL injection prevented? 

A. Address space layout randomization  
B. Validate and sanitize user input  
C. ...in the web server as a nonprivileged user  
D. ...cost profiling  

Show Answer

Question # 31

An intruder attempted malicious activity and exchanged emails with a user and receivedcorporate information, including email distribution lists. The intruder asked the user toengage with a link in an email. When the fink launched, it infected machines and theintruder was able to access the corporate network.Which testing method did the intruder use? 

A. social engineering  
B. eavesdropping  
C. piggybacking  
D. tailgating  

Show Answer

Question # 32

Why should an engineer use a full packet capture to investigate a security breach?

A. It captures the TCP flags set within each packet for the engineer to focus on suspicious packets to identify malicious activity
B. It collects metadata for the engineer to analyze, including IP traffic packet data that is sorted, parsed, and indexed. 
C. It provides the full TCP streams for the engineer to follow the metadata to identify the incoming threat.
D. It reconstructs the event allowing the engineer to identify the root cause by seeing what took place during the breach 

Show Answer

Question # 33

An engineer is sharing folders and files with different departments and got this error: "No such file or directory". What must the engineer verify next?

A. memory allocation  
B. symlinks  
C. permission  
D. disk space  

Show Answer