Cisco CyberOps Associate 200-201 Questions & Answers

• Question 311:

  A user received a targeted spear-phishing email and identified it as suspicious before opening the content. To which category of the Cyber Kill Chain model does to this type of event belong?

  A. weaponization

  B. delivery

  C. exploitation

  D. reconnaissance

  Correct Answer: B

• Question 312:

  How does an attack surface differ from an attack vector?

  A. An attack vector recognizes the potential outcomes of an attack, and the attack surface is choosing a method of an attack.

  B. An attack surface identifies vulnerable parts for an attack, and an attack vector specifies which attacks are feasible to those parts.

  C. An attack surface mitigates external vulnerabilities, and an attack vector identifies mitigation techniques and possible workarounds.

  D. An attack vector matches components that can be exploited, and an attack surface classifies the potential path for exploitation

  Correct Answer: B

• Question 313:

  An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.

  

  Which obfuscation technique is the attacker using?

  A. Base64 encoding

  B. TLS encryption

  C. SHA-256 hashing

  D. ROT13 encryption

  Correct Answer: B

  ROT13 is considered weak encryption and is not used with TLS (HTTPS:443). Source: https://en.wikipedia.org/wiki/ROT13

• Question 314:

  Which technology on a host is used to isolate a running application from other applications?

  A. sandbox

  B. application allow list

  C. application block list

  D. host-based firewall

  Correct Answer: A

  Reference: https://searchsecurity.techtarget.com/definition/sandbox#:~:text=Sandboxes%20can%20be%20used%20to,be%20run%20inside%20a%20sandbox

• Question 315:

  An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network. What is the impact of this traffic?

  A. ransomware communicating after infection

  B. users downloading copyrighted content

  C. data exfiltration

  D. user circumvention of the firewall

  Correct Answer: D

• Question 316:

  What is the communication channel established from a compromised machine back to the attacker?

  A. man-in-the-middle

  B. command and control

  C. IDS evasion

  D. port scanning

  Correct Answer: B

• Question 317:

  What is the role of NAT in data visibility?

  A. load balancing

  B. hiding IP addresses

  C. web filtering

  D. encrypting files

  Correct Answer: B

• Question 318:

  What is the purpose of command and control for network-aware malware?

  A. It controls and shuts down services on the infected host.

  B. It helps the malware to profile the host.

  C. It contacts a remote server for commands and updates.

  D. It takes over the user account for analysis.

  Correct Answer: C

• Question 319:

  Which classification of cross-site scripting attack executes the payload without storing it for repeated use?

  A. CSRF

  B. reflective

  C. DOM

  D. stored

  Correct Answer: B

• Question 320:

  A network engineer noticed in the NetFlow report that internal hosts are sending many DNS requests to external DNS servers. A SOC analyst checked the endpoints and discovered that they are infected and became part of the botnet. Endpoints are sending multiple DNS requests, but with spoofed IP addresses of valid external sources. What kind of attack are infected endpoints involved in?

  A. DNS tunneling

  B. DNS hijacking

  C. DNS amplification

  D. DNS flooding

  Correct Answer: C