Cisco CyberOps Associate 200-201 Questions & Answers

• Question 131:

  According to the September 2020 threat intelligence feeds a new malware called Egregor was introduced and used in many attacks. Distnbution of Egregor is pnmanly through a Cobalt Strike that has been installed on victim's workstations using RDP exploits Malware exfiltrates the victim's data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it. Which type of attack is described?

  A. malware attack

  B. ransomware attack

  C. whale-phishing

  D. insider threat

  Correct Answer: B

• Question 132:

  Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

  A. forgery attack

  B. plaintext-only attack

  C. ciphertext-only attack

  D. meet-in-the-middle attack

  Correct Answer: C

• Question 133:

  Refer to the exhibit.

  

  What is the potential threat identified in this Stealthwatch dashboard?

  A. A policy violation is active for host 10.10.101.24.

  B. A host on the network is sending a DDoS attack to another inside host.

  C. There are two active data exfiltration alerts.

  D. A policy violation is active for host 10.201.3.149.

  Correct Answer: C

• Question 134:

  Refer to the exhibit.

  

  What must be interpreted from this packet capture?

  A. IP address 192.168.88 12 is communicating with 192 168 88 149 with a source port 74 to destination port 49098 using TCP protocol

  B. IP address 192.168.88.12 is communicating with 192 168 88 149 with a source port 49098 to destination port 80 using TCP protocol.

  C. IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol.

  D. IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.

  Correct Answer: B

• Question 135:

  Refer to the exhibit.

  

  Which component is identifiable in this exhibit?

  A. Trusted Root Certificate store on the local machine

  B. Windows PowerShell verb

  C. Windows Registry hive

  D. local service in the Windows Services Manager

  Correct Answer: C

  https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-hives https://ldapwiki.com/wiki/HKEY_LOCAL_MACHINE#:~:text=HKEY_LOCAL_MACHINE%20Windows%20registry%20hive%20contains,detected%20hardware%20and%20device%20d rivers.

• Question 136:

  When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.

  Which information is available on the server certificate?

  A. server name, trusted subordinate CA, and private key

  B. trusted subordinate CA, public key, and cipher suites

  C. trusted CA name, cipher suites, and private key

  D. server name, trusted CA, and public key

  Correct Answer: D

• Question 137:

  Which regular expression is needed to capture the IP address 192.168.20.232?

  A. ^ (?:[0-9]{1,3}\.){3}[0-9]{1,3}

  B. ^ (?:[0-9]f1,3}\.){1,4}

  C. ^ (?:[0-9]{1,3}\.)'

  D. ^ ([0-9]-{3})

  Correct Answer: A

  Reference: https://www.cisco.com/c/en/us/td/docs/security/security_management/cs-mars/4-3/user/guide/local_controller/appreexp.html

• Question 138:

  Refer to the exhibit.

  

  Which packet contains a file that is extractable within Wireshark?

  A. 2317

  B. 1986

  C. 2318

  D. 2542

  Correct Answer: D

• Question 139:

  An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.

  Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)

  A. signatures

  B. host IP addresses

  C. file size

  D. dropped files

  E. domain names

  Correct Answer: BE

• Question 140:

  Refer to the exhibit.

  

  What should be interpreted from this packet capture?

  A. 81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.

  B. 192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.

  C. 192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.

  D. 81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.

  Correct Answer: B