Cisco CyberOps Associate 200-201 Questions & Answers

• Question 351:

  According to CVSS, what is attack complexity?

  A. existing exploits available in the wild exploiting the vulnerability

  B. existing circumstances beyond the attacker's control to exploit the vulnerability

  C. number of actions an attacker should perform to exploit the vulnerability

  D. number of patches available for certain attack mitigation and how complex the workarounds are

  Correct Answer: B

• Question 352:

  A security engineer must protect the company from known issues that trigger adware. Recently a new incident has been raised that could harm the system. Which security concepts are present in this scenario?

  A. vulnerability and threat

  B. exploit and patching

  C. risk and evidence

  D. analysis and remediation

  Correct Answer: A

• Question 353:

  For which items is an end-point application greylist used?

  A. items that have been installed with a baseline

  B. items that have been established as malicious

  C. items before being established as harmful or malicious

  D. items that have been established as authorized

  Correct Answer: C

• Question 354:

  How does rule-based detection differ from behavioral detection?

  A. Rule-based systems have predefined patterns, and behavioral systems learn the patterns that are specific to the environment.

  B. Rule-based systems search for patterns linked to specific types of attacks, and behavioral systems identify attacks per signature.

  C. Behavioral systems have patterns are for complex environments, and rule-based systems can be used on low-mid-sized businesses.

  D. Behavioral systems find sequences that match particular attack behaviors, and rule-based systems identify potential zero-day attacks.

  Correct Answer: A

• Question 355:

  A vulnerability is discovered on a network. If successfully exploited, it will completely remove the ability of the system to limit disclosure of information to an unauthorized user. Which concept and value describes this vulnerability?

  A. confidentiality, none

  B. availability, none

  C. availability, high

  D. confidentiality, high

  Correct Answer: D

• Question 356:

  Which of these is a defense-in-depth strategy principle?

  A. Identify the minimum resource required per employee.

  B. Provide the minimum permissions needed to perform job functions.

  C. Disable administrative accounts to avoid unauthorized changes.

  D. Assign the least network privileges to segment network permissions.

  Correct Answer: D

• Question 357:

  Which principle reduces the risk of attackers gaining access to sensitive data by compromising a low-level user account?

  A. separation of duties

  B. limited access

  C. least privilege

  D. privilege separation

  Correct Answer: C

• Question 358:

  Which description is a defense-in-depth principal strategy?

  A. isolating employees with access to critical data

  B. implementing VLANs to segment network traffic

  C. developing approval flow for new hires

  D. designing Active Directory groups

  Correct Answer: B

• Question 359:

  What is a threat actor?

  A. an external party, typically a business partner with the capability to accidentally or intentionally compromise computer systems

  B. an internal individual, typically an insider with the capability to accidentally or intentionally compromise computer systems

  C. an individual or group that is external or internal and may include nation-states, hacktivists, organized crime, and trusted insiders

  D. an unauthorized person, such as script kiddies or hackers who attempt to breach network systems

  Correct Answer: C

• Question 360:

  An engineer must create a SIEM rule to test events and traffic for spikes and changes that occur in regular patterns to detect irregularities. Which rules achieve the desired results?

  A. anomaly

  B. behavioral

  C. threshold

  D. availability

  Correct Answer: B