Cisco CyberOps Associate 200-201 Questions & Answers

• Question 151:

  What describes the concept of data consistently and readily being accessible for legitimate users?

  A. integrity

  B. availability

  C. accessibility

  D. confidentiality

  Correct Answer: B

• Question 152:

  Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

  A. NetScout

  B. tcpdump

  C. SolarWinds

  D. netsh

  Correct Answer: B

• Question 153:

  What is the principle of defense-in-depth?

  A. Agentless and agent-based protection for security are used.

  B. Several distinct protective layers are involved.

  C. Access control models are involved.

  D. Authentication, authorization, and accounting mechanisms are used.

  Correct Answer: B

• Question 154:

  Which technology should be used to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes?

  A. AWS

  B. IIS

  C. Load balancer

  D. Proxy server

  Correct Answer: C

  Load Balancing: HTTP(S) load balancing is one of the oldest forms of load balancing. This form of load balancing relies on layer 7, which means it operates in the application layer. This allows routing decisions based on attributes like HTTP header, uniform resource identifier, SSL session ID, and HTML form data. Load balancing applies to layers 4-7 in the seven-layer Open System Interconnection (OSI) model. Its capabilities are: L4. Directing traffic based on network data and transport layer protocols, e.g., IP address and TCP port. L7. Adds content switching to load balancing, allowing routing decisions depending on characteristics such as HTTP header, uniform resource identifier, SSL session ID, and HTML form data. GSLB. Global Server Load Balancing expands L4 and L7 capabilities to servers in different sites

• Question 155:

  Which two elements of the incident response process are stated in NIST SP 800-61 r2? (Choose two.)

  A. detection and analysis

  B. post-incident activity

  C. vulnerability scoring

  D. vulnerability management

  E. risk assessment

  Correct Answer: AB

• Question 156:

  An engineer is addressing a connectivity issue between two servers where the remote server is unable to establish a successful session. Initial checks show that the remote server is not receiving an SYN-ACK while establishing a session by

  sending the first SYN.

  What is causing this issue?

  A. incorrect TCP handshake

  B. incorrect UDP handshake

  C. incorrect OSI configuration

  D. incorrect snaplen configuration

  Correct Answer: A

  Reference: https://www.sciencedirect.com/topics/computer-science/three-way- handshake#:~:text=The%20TCP%20handshake,as%20shown%20in%20Figure%203.8

• Question 157:

  Refer to the exhibit.

  

  A workstation downloads a malicious docx file from the Internet and a copy is sent to FTDv. The FTDv sends the file hash to FMC and the tile event is recorded What would have occurred with stronger data visibility?

  A. The traffic would have been monitored at any segment in the network.

  B. Malicious traffic would have been blocked on multiple devices

  C. An extra level of security would have been in place

  D. Detailed information about the data in real time would have been provided

  Correct Answer: D

• Question 158:

  Refer to the exhibit.

  

  An engineer received an event log file to review. Which technology generated the log?

  A. NetFlow

  B. proxy

  C. firewall

  D. IDS/IPS

  Correct Answer: C

• Question 159:

  What does cyber attribution identify in an investigation?

  A. cause of an attack

  B. exploit of an attack

  C. vulnerabilities exploited

  D. threat actors of an attack

  Correct Answer: D

  https://www.techtarget.com/searchsecurity/definition/cyber-attribution

• Question 160:

  What are two denial-of-service (DoS) attacks? (Choose two)

  A. port scan

  B. SYN flood

  C. man-in-the-middle

  D. phishing

  E. teardrop

  Correct Answer: BE

  Teardrop is a type of DoS attack where an attacker sends fragmented packets with overlapping offsets to a target system, causing it to crash or become unresponsive.

  SYN flood is another type of DoS attack where an attacker sends a large number of SYN packets to a target system, overwhelming its ability to respond to legitimate connection requests and causing it to become unresponsive.