Cisco CyberOps Associate 200-201 Questions & Answers

• Question 171:

  What is the difference between discretionary access control (DAC) and role-based access control (RBAC)?

  A. DAC requires explicit authorization for a given user on a given object, and RBAC requires specific conditions.

  B. RBAC access is granted when a user meets specific conditions, and in DAC, permissions are applied on user and group levels.

  C. RBAC is an extended version of DAC where you can add an extra level of authorization based on time.

  D. DAC administrators pass privileges to users and groups, and in RBAC, permissions are applied to specific groups

  Correct Answer: D

• Question 172:

  Which regex matches only on all lowercase letters?

  A. [az]+

  B. [^az]+

  C. az+

  D. a*z+

  Correct Answer: A

• Question 173:

  What is a sandbox interprocess communication service?

  A. A collection of rules within the sandbox that prevent the communication between sandboxes.

  B. A collection of network services that are activated on an interface, allowing for inter-port communication.

  C. A collection of interfaces that allow for coordination of activities among processes.

  D. A collection of host services that allow for communication between sandboxes.

  Correct Answer: C

  Inter-process communication (IPC) allows communication between different processes. A process is one or more threads running inside its own, isolated address space. https://docs.legato.io/16_10/basicIPC.html

• Question 174:

  What is threat hunting?

  A. Managing a vulnerability assessment report to mitigate potential threats.

  B. Focusing on proactively detecting possible signs of intrusion and compromise.

  C. Pursuing competitors and adversaries to infiltrate their system to acquire intelligence data.

  D. Attempting to deliberately disrupt servers by altering their availability

  Correct Answer: B

• Question 175:

  A security engineer notices confidential data being exfiltrated to a domain "Ranso4134- mware31-895" address that is attributed to a known advanced persistent threat group The engineer discovers that the activity is part of a real attack and not a network misconfiguration. Which category does this event fall under as defined in the Cyber Kill Chain?

  A. reconnaissance

  B. delivery

  C. action on objectives

  D. weaponization

  Correct Answer: D

• Question 176:

  Which event artifact is used to identify HTTP GET requests for a specific file?

  A. destination IP address

  B. TCP ACK

  C. HTTP status code

  D. URI

  Correct Answer: D

• Question 177:

  In a SOC environment, what is a vulnerability management metric?

  A. code signing enforcement

  B. full assets scan

  C. internet exposed devices

  D. single factor authentication

  Correct Answer: C

• Question 178:

  What describes a buffer overflow attack?

  A. injecting new commands into existing buffers

  B. fetching data from memory buffer registers

  C. overloading a predefined amount of memory

  D. suppressing the buffers in a process

  Correct Answer: C

• Question 179:

  Which security principle requires more than one person is required to perform a critical task?

  A. least privilege

  B. need to know

  C. separation of duties

  D. due diligence

  Correct Answer: C

• Question 180:

  An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

  A. tagged protocols being used on the network

  B. all firewall alerts and resulting mitigations

  C. tagged ports being used on the network

  D. all information and data within the datagram

  Correct Answer: D