Cisco CyberOps Associate 200-201 Questions & Answers

• Question 21:

  Which of these describes volatile evidence?

  A. logs

  B. registers and cache

  C. disk and removable drives

  D. usernames

  Correct Answer: B

  Caches and Registers- Data in memory is the most volatile. This includes data in centralprocessor unit (CPU) registers, caches, and system random access memory(RAM).- The data in cache and CPU registers is the most volatile,

  mostlybecause the storage space is so small.

  https://blogs.getcertifiedgetahead.com/cfr-and-order-of-volatility/#:~:text=Caches%20and%20Registers,storage%20space%20is%20so%20small.

• Question 22:

  Which type of data must an engineer capture to analyze payload and header information?

  A. full packet

  B. frame check sequence

  C. alert data

  D. session logs

  Correct Answer: A

• Question 23:

  Refer to the exhibit.

  

  Which application-level protocol is being targeted?

  A. FTP B. TCP

  C. HTTP

  D. HTTPS

  Correct Answer: C

• Question 24:

  Refer to the exhibit.

  

  Which alert is identified from this packet capture?

  A. man-in-the-middle attack

  B. brute-force attack

  C. ARP poisoning

  D. SQL injection

  Correct Answer: B

• Question 25:

  A company's cyber security team performed a phishing simulation campaign for employees and performed security awareness trainings to affected personal. According to NIST.SP800-61, at which phase of incident response is this action?

  A. post-incident activity phase

  B. detection and analyze phase

  C. preparation phase

  D. eradication and recovery phase

  Correct Answer: C

• Question 26:

  Which statement describes patch management?

  A. scanning servers and workstations for missing patches and vulnerabilities

  B. process of appropriate distribution of system or software updates

  C. managing and keeping previous patches lists documented for audit purposes

  D. workflow of distributing mitigations of newly found vulnerabilities

  Correct Answer: B

• Question 27:

  Refer to the exhibit.

  

  Which field contains DNS header information if the payload is a query or response?

  A. ID

  B. Z

  C. QR

  D. TC

  Correct Answer: C

• Question 28:

  What matches the regular expression c(rgr)+e?

  A. c(rgr)e

  B. crgrrgre

  C. crgr+e

  D. ce

  Correct Answer: B

• Question 29:

  A SOC analyst observed Ursnif malware at the SIEM dashboard. The analyst opened the PCAP file to search the certificate issue data. Where must the analyst navigate?

  A. under the rdnSequence line

  B. under the validity line

  C. under the subject

  D. under the signed certificate

  Correct Answer: B

• Question 30:

  Refer to exhibit.

  

  An analyst performs the analysis of the pcap file to detect the suspicious activity. What challenges did the analyst face in terms of data visibility?

  A. data encapsulation

  B. code obfuscation

  C. data encryption

  D. IP fragmentation

  Correct Answer: C