Cisco CyberOps Associate 200-201 Questions & Answers

• Question 161:

  An organization's security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning How should the analyst collect the traffic to isolate the suspicious host?

  A. by most active source IP

  B. by most used ports

  C. based on the protocols used

  D. based on the most used applications

  Correct Answer: A

• Question 162:

  An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?

  A. The threat actor used a dictionary-based password attack to obtain credentials.

  B. The threat actor gained access to the system by known credentials.

  C. The threat actor used the teardrop technique to confuse and crash login services.

  D. The threat actor used an unknown vulnerability of the operating system that went undetected.

  Correct Answer: C

• Question 163:

  Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

  A. known-plaintext

  B. replay

  C. dictionary

  D. man-in-the-middle

  Correct Answer: D

• Question 164:

  How is NetFlow different from traffic mirroring?

  A. NetFlow collects metadata and traffic mirroring clones data.

  B. Traffic mirroring impacts switch performance and NetFlow does not.

  C. Traffic mirroring costs less to operate than NetFlow.

  D. NetFlow generates more data than traffic mirroring.

  Correct Answer: A

• Question 165:

  An engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Application Visibility and Control should the engineer use to accomplish this goal? (Choose two.)

  A. management and reporting

  B. traffic filtering

  C. adaptive AVC

  D. metrics collection and exporting

  E. application recognition

  Correct Answer: AE

• Question 166:

  A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this situation?

  A. the intellectual property that was stolen

  B. the defense contractor who stored the intellectual property

  C. the method used to conduct the attack

  D. the foreign government that conducted the attack

  Correct Answer: D

• Question 167:

  An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist Further analysis shows that the threat actor connected an externa USB device to bypass security restrictions and steal data The engineer could not find an external USB device Which piece of information must an engineer use for attribution in an investigation?

  A. list of security restrictions and privileges boundaries bypassed

  B. external USB device

  C. receptionist and the actions performed

  D. stolen data and its criticality assessment

  Correct Answer: C

• Question 168:

  What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?

  A. MAC is controlled by the discretion of the owner and DAC is controlled by an administrator

  B. MAC is the strictest of all levels of control and DAC is object-based access

  C. DAC is controlled by the operating system and MAC is controlled by an administrator

  D. DAC is the strictest of all levels of control and MAC is object-based access

  Correct Answer: B

• Question 169:

  What describes the defense-m-depth principle?

  A. defining precise guidelines for new workstation installations

  B. categorizing critical assets within the organization

  C. isolating guest Wi-Fi from the focal network

  D. implementing alerts for unexpected asset malfunctions

  Correct Answer: C

• Question 170:

  What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?

  A. TAPS interrogation is more complex because traffic mirroring applies additional tags to data and SPAN does not alter integrity and provides full duplex network.

  B. SPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.

  C. TAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools

  D. SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.

  Correct Answer: D

  Reference: https://insights.profitap.com/tap-vs-span