Cisco CyberOps Associate 200-201 Questions & Answers

• Question 291:

  What is the virtual address space for a Windows process?

  A. physical location of an object in memory

  B. set of pages that reside in the physical memory

  C. system-level memory protection feature built into the operating system

  D. set of virtual memory addresses that can be used

  Correct Answer: D

• Question 292:

  Which metric should be used when evaluating the effectiveness and scope of a Security Operations Center?

  A. The average time the SOC takes to register and assign the incident.

  B. The total incident escalations per week.

  C. The average time the SOC takes to detect and resolve the incident.

  D. The total incident escalations per month.

  Correct Answer: C

• Question 293:

  Which vulnerability type is used to read, write, or erase information from a database?

  A. cross-site scripting

  B. cross-site request forgery

  C. buffer overflow

  D. SQL injection

  Correct Answer: D

• Question 294:

  What is the difference between the ACK flag and the RST flag?

  A. The RST flag approves the connection, and the ACK flag terminates spontaneous connections.

  B. The ACK flag confirms the received segment, and the RST flag terminates the connection.

  C. The RST flag approves the connection, and the ACK flag indicates that a packet needs to be resent

  D. The ACK flag marks the connection as reliable, and the RST flag indicates the failure within TCP Handshake

  Correct Answer: B

• Question 295:

  An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day, an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?

  A. Recovery

  B. Detection

  C. Eradication

  D. Analysis

  Correct Answer: D

• Question 296:

  What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

  A. least privilege

  B. need to know

  C. integrity validation

  D. due diligence

  Correct Answer: A

• Question 297:

  What is a benefit of using asymmetric cryptography?

  A. decrypts data with one key

  B. fast data transfer

  C. secure data transfer

  D. encrypts data with one key

  Correct Answer: C

• Question 298:

  What makes HTTPS traffic difficult to monitor?

  A. SSL interception

  B. packet header size

  C. signature detection time

  D. encryption

  Correct Answer: D

• Question 299:

  What is a difference between SIEM and SOAR?

  A. SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

  B. SlEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

  C. SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

  D. SOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

  Correct Answer: B

  Reference: https://www.cisco.com/c/en/us/products/security/what-is-a-security- platform.html siem is log managment soar is vulnerability managment that automat and response

• Question 300:

  Refer to the exhibit.

  

  What is occurring?

  A. Cross-Site Scripting attack

  B. XML External Entitles attack

  C. Insecure Deserialization

  D. Regular GET requests

  Correct Answer: A