Cisco CyberOps Associate 200-201 Questions & Answers

• Question 181:

  Which event is user interaction?

  A. gaining root access

  B. executing remote code

  C. reading and writing file permission

  D. opening a malicious file

  Correct Answer: D

• Question 182:

  Refer to the exhibit.

  

  What does this output indicate?

  A. HTTPS ports are open on the server.

  B. SMB ports are closed on the server.

  C. FTP ports are open on the server.

  D. Email ports are closed on the server.

  Correct Answer: D

• Question 183:

  What describes the impact of false-positive alerts compared to false-negative alerts?

  A. A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised

  B. A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring

  C. A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.

  D. A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.

  Correct Answer: C

• Question 184:

  What specific type of analysis is assigning values to the scenario to see expected outcomes?

  A. deterministic

  B. exploratory

  C. probabilistic

  D. descriptive

  Correct Answer: A

• Question 185:

  According to the NIST SP 800-86. which two types of data are considered volatile? (Choose two.)

  A. swap files

  B. temporary files

  C. login sessions

  D. dump files

  E. free space

  Correct Answer: CE

• Question 186:

  A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

  A. CD data copy prepared in Windows

  B. CD data copy prepared in Mac-based system

  C. CD data copy prepared in Linux system

  D. CD data copy prepared in Android-based system

  Correct Answer: C

• Question 187:

  Refer to the exhibit.

  

  A company employee is connecting to mail google.com from an endpoint device. The website is loaded but with an error. What is occurring?

  A. DNS hijacking attack

  B. Endpoint local time is invalid.

  C. Certificate is not in trusted roots.

  D. man-m-the-middle attack

  Correct Answer: C

• Question 188:

  An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task?

  A. Firepower

  B. Email Security Appliance

  C. Web Security Appliance

  D. Stealthwatch

  Correct Answer: C

• Question 189:

  How is attacking a vulnerability categorized?

  A. action on objectives

  B. delivery

  C. exploitation

  D. installation

  Correct Answer: C

• Question 190:

  An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.

  Which kind of evidence is this IP address?

  A. best evidence

  B. corroborative evidence

  C. indirect evidence

  D. forensic evidence

  Correct Answer: B