Cisco CyberOps Associate 200-201 Questions & Answers

• Question 111:

  Which category relates to improper use or disclosure of PII data?

  A. legal

  B. compliance

  C. regulated

  D. contractual

  Correct Answer: C

• Question 112:

  Which tool provides a full packet capture from network traffic?

  A. Nagios

  B. CAINE

  C. Hydra

  D. Wireshark

  Correct Answer: D

• Question 113:

  While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

  A. encapsulation

  B. TOR

  C. tunneling

  D. NAT

  Correct Answer: D

  Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.

• Question 114:

  A user received a malicious attachment but did not run it. Which category classifies the intrusion?

  A. weaponization

  B. reconnaissance

  C. installation

  D. delivery

  Correct Answer: D

• Question 115:

  One of the objectives of information security is to protect the CIA of information and systems. What does CIA mean in this context?

  A. confidentiality, identity, and authorization

  B. confidentiality, integrity, and authorization

  C. confidentiality, identity, and availability D. confidentiality, integrity, and availability

  Correct Answer: D

• Question 116:

  An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications. Which technology should be used to accomplish the task?

  A. digital certificates

  B. static IP addresses

  C. signatures

  D. cipher suite

  Correct Answer: A

• Question 117:

  What is a difference between an inline and a tap mode traffic monitoring?

  A. Inline monitors traffic without examining other devices, while a tap mode tags traffic and examines the data from monitoring devices.

  B. Tap mode monitors traffic direction, while inline mode keeps packet data as it passes through the monitoring devices.

  C. Tap mode monitors packets and their content with the highest speed, while the inline mode draws a packet path for analysis.

  D. Inline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network.

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/inline_sets_and_passive_interfaces_for_firepower_threat_defense.html

• Question 118:

  Which tool gives the ability to see session data in real time?

  A. tcpdstat

  B. trafdump

  C. tcptrace

  D. trafshow

  Correct Answer: D

  "trafshow" is a tool that provides real-time information about network traffic sessions. The tool captures and displays network packets and session data, allowing a network administrator to monitor network activity and troubleshoot problems. "tcpdstat" and "tcptrace" are also network analysis tools, but they do not provide real-time monitoring. "trafdump" is not a valid tool name.

• Question 119:

  Which type of evidence supports a theory or an assumption that results from initial evidence?

  A. probabilistic

  B. indirect

  C. best

  D. corroborative

  Correct Answer: D

  Corroborating evidence (or corroboration) is evidence that tends to support a theory or an assumption deduced by some initial evidence. This corroborating evidence confirms the proposition. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

• Question 120:

  Which of these describes SOC metrics in relation to security incidents?

  A. time it takes to detect the incident

  B. time it takes to assess the risks of the incident

  C. probability of outage caused by the incident

  D. probability of compromise and impact caused by the incident

  Correct Answer: A