Cisco CyberOps Associate 200-201 Questions & Answers

• Question 141:

  Which signature impacts network traffic by causing legitimate traffic to be blocked?

  A. false negative

  B. true positive

  C. true negative

  D. false positive

  Correct Answer: D

• Question 142:

  Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?

  A. ClientStart, ClientKeyExchange, cipher-suites it supports, and suggested compression methods

  B. ClientStart, TLS versions it supports, cipher-suites it supports, and suggested compression methods

  C. ClientHello, TLS versions it supports, cipher-suites it supports, and suggested compression methods

  D. ClientHello, ClientKeyExchange, cipher-suites it supports, and suggested compression methods

  Correct Answer: C

• Question 143:

  Refer to the exhibit.

  

  During the analysis of a suspicious scanning activity incident, an analyst discovered multiple local TCP connection events Which technology provided these logs?

  A. antivirus

  B. proxy

  C. IDS/IPS

  D. firewall

  Correct Answer: D

• Question 144:

  Which security monitoring data type requires the largest storage space?

  A. transaction data

  B. statistical data

  C. session data

  D. full packet capture

  Correct Answer: D

• Question 145:

  Refer to the exhibit.

  

  What does the message indicate?

  A. an access attempt was made from the Mosaic web browser

  B. a successful access attempt was made to retrieve the password file

  C. a successful access attempt was made to retrieve the root of the website

  D. a denied access attempt was made to retrieve the password file

  Correct Answer: C

• Question 146:

  What is the impact of encryption?

  A. Confidentiality of the data is kept secure and permissions are validated

  B. Data is accessible and available to permitted individuals

  C. Data is unaltered and its integrity is preserved

  D. Data is secure and unreadable without decrypting it

  Correct Answer: D

• Question 147:

  A malicious file has been identified in a sandbox analysis tool.

  

  Which piece of information is needed to search for additional downloads of this file by other hosts?

  A. file header type

  B. file size

  C. file name

  D. file hash value

  Correct Answer: D

• Question 148:

  An engineer received a flood of phishing emails from HR with the source address HRjacobm@companycom. What is the threat actor in this scenario?

  A. phishing email

  B. sender

  C. HR

  D. receiver

  Correct Answer: B

• Question 149:

  A threat actor penetrated an organization's network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?

  A. event name, log source, time, source IP, and host name

  B. protocol, source IP, source port, destination IP, and destination port

  C. event name, log source, time, source IP, and username

  D. protocol, log source, source IP, destination IP, and host name

  Correct Answer: B

  Reference: https://blogs.cisco.com/security/the-dreaded-5-tuple

• Question 150:

  A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor. Which type of evidence is this?

  A. best evidence

  B. prima facie evidence

  C. indirect evidence

  D. physical evidence

  Correct Answer: C

  There are three general types of evidence:

  --> Best evidence: can be presented in court in the original form (for example, an exact copy of a hard disk drive).

  --> Corroborating evidence: tends to support a theory or an assumption deduced by some initial evidence. This corroborating evidence confirms the proposition. --> Indirect or circumstantial evidence: extrapolation to a conclusion of fact (such

  as fingerprints, DNA evidence, and so on).