Cisco CyberOps Associate 200-201 Questions & Answers

• Question 91:

  Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

  A. resource exhaustion

  B. tunneling

  C. traffic fragmentation

  D. timing attack

  Correct Answer: A

  Resource exhaustion is a type of denial-of-service attack; however, it can also be used to evade detection by security defenses. A simple definition of resource exhaustion is "consuming the resources necessary to perform an action." Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

• Question 92:

  What is a difference between tampered and untampered disk images?

  A. Tampered images have the same stored and computed hash.

  B. Tampered images are used as evidence.

  C. Untampered images are used for forensic investigations.

  D. Untampered images are deliberately altered to preserve as evidence

  Correct Answer: B

• Question 93:

  An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

  A. true negative

  B. false negative

  C. false positive

  D. true positive

  Correct Answer: B

  A false negative occurs when the security system (usually a WAF) fails to identify a threat. It produces a "negative" outcome (meaning that no threat has been observed), even though a threat exists.

• Question 94:

  What is a difference between SOAR and SIEM?

  A. SOAR platforms are used for threat and vulnerability management, but SIEM applications are not

  B. SIEM applications are used for threat and vulnerability management, but SOAR platforms are not

  C. SOAR receives information from a single platform and delivers it to a SIEM

  D. SIEM receives information from a single platform and delivers it to a SOAR

  Correct Answer: A

• Question 95:

  Refer to the exhibit.

  

  Which field contains DNS header information if the payload is a query or a response?

  A. Z

  B. ID

  C. TC

  D. QR

  Correct Answer: B

• Question 96:

  A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?

  A. reconnaissance

  B. action on objectives

  C. installation

  D. exploitation

  Correct Answer: D

• Question 97:

  Which metric is used to capture the level of access needed to launch a successful attack?

  A. privileges required

  B. user interaction

  C. attack complexity

  D. attack vector

  Correct Answer: D

  Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200201 Chapter7:

  Introduction to Security Operations Management.

• Question 98:

  What is a difference between data obtained from Tap and SPAN ports?

  A. Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.

  B. SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times.

  C. SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility.

  D. Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination

  Correct Answer: D

  Reference: https://www.gigamon.com/resources/resource-library/white-paper/to-tap-or-to-span.html

• Question 99:

  What is a purpose of a vulnerability management framework?

  A. identifies, removes, and mitigates system vulnerabilities

  B. detects and removes vulnerabilities in source code

  C. conducts vulnerability scans on the network

  D. manages a list of reported vulnerabilities

  Correct Answer: A

• Question 100:

  Which type of data collection requires the largest amount of storage space?

  A. alert data

  B. transaction data

  C. session data

  D. full packet capture

  Correct Answer: D