Cisco CyberOps Associate 200-201 Questions & Answers

• Question 331:

  Refer to the exhibit. What is the logical source device for these events?

  

  A. proxy server

  B. IDS/IPS

  C. NetFlow collector

  D. web server

  Correct Answer: B

• Question 332:

  What is a Heartbleed vulnerability?

  A. denial of service

  B. information disclosure

  C. buffer overflow

  D. command injection

  Correct Answer: B

• Question 333:

  What are two types of cross site scripting attacks? (Choose two.)

  A. directed

  B. encoded

  C. reflected

  D. stored

  E. cascaded

  Correct Answer: CD

• Question 334:

  Which piece of information is needed for attribution in an investigation?

  A. attack surface and the threat posing the risk

  B. attack vector and exploited vulnerability

  C. asset value and an asset owner

  D. threat actor and associated behavior

  Correct Answer: D

• Question 335:

  What is the impact of a ransomware infection?

  A. Data on infected endpoints is encrypted.

  B. Encrypted data cannot be restored from backup.

  C. Multiple connections are made to external CandC servers.

  D. User must pay ransom to decrypt data.

  Correct Answer: A

• Question 336:

  According to CVSS, which metric group does user interaction belong to?

  A. temporal

  B. temporary

  C. base

  D. environmental

  Correct Answer: C

• Question 337:

  Refer to the exhibit. Which type of evidence is this file?

  

  A. direct evidence

  B. corroborating evidence

  C. best evidence

  D. circumstantial evidence

  Correct Answer: A

• Question 338:

  What is used to maintain persistent control of an exploited device?

  A. encryption

  B. ARP spoof

  C. rootkit

  D. DDoS

  Correct Answer: C

• Question 339:

  What is email greylisting by the mail transfer agent?

  A. denying any email from a sender it does not recognize

  B. returning emails that are potential phishing attempts

  C. allowing emails from unknown senders temporarily

  D. quarantining emails sent from outside of the organization

  Correct Answer: A

• Question 340:

  Refer to the exhibit.

  

  A security analyst received a ticket about suspicious traffic from one of the workstations. During the investigation, the analyst discovered that the workstation is communicating with an external IP The analyst was not able to investigate further and escalated the case to a T2 security analyst. What are the two data visibility challenges that the security analyst should identify? (Choose two.)

  A. A default user agent is present in the headers.

  B. Traffic is not encrypted.

  C. Encrypted data is being transmitted.

  D. POST requests have a "Microsoft-IIS/7.5" server header.

  E. HTTP requests and responses are sent in plaintext.

  Correct Answer: BE