Cisco CyberOps Associate 200-201 Questions & Answers

• Question 391:

  A forensic investigator is analyzing a recent breach case. An external USB drive was discovered to be connected and transmitting the data outside of the organization, and the owner of the USB drive could not be identified. Video surveillance shows six people during a two-month period had close contact with the affected asset. How must this type of evidence be categorized?

  A. best evidence

  B. indirect evidence

  C. direct evidence

  D. corroborative evidence

  Correct Answer: B

• Question 392:

  An engineer configured regular expression ".*\.([Dd][Oo][Cc]|[Xx][LI][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]" on Cisco ASA firewall. What does this regular expression do?

  A. It captures .doc, .xls, and .pdf files in HTTP v1.0 and v1.1.

  B. It captures documents in an HTTP network session.

  C. It captures Word, Excel, and PowerPoint files in HTTP v1.0 and v1.1.

  D. It captures .doc, .xls, and .ppt files extensions in HTTP v1.0.

  Correct Answer: C

  Explanation:

  The regular expression pattern captures file extensions like .doc, .xls, and .ppt (or variations in letter case, such as DOC, XLS, PPT) within HTTP traffic sessions, as indicated by the ".([Dd][Oo][Cc]|[Xx][LI][Ss]|[Pp][Pp][Tt])" part of the regex.

  Additionally, it specifies HTTP versions 1.0 and 1.1 by ending with " HTTP/1.[01]" to focus the matching on HTTP sessions using these versions.

• Question 393:

  

  Refer to exhibit. An engineer is investigating an intrusion and is analyzing the pcap file. Which two key elements must an engineer consider? (Choose two.)

  A. variable "info" field and unchanging sequence number

  B. high volume of SYN packets with very little variance in time

  C. SYN packets acknowledged from several source IP addresses

  D. identical length of 120 and window size (64)

  E. same source IP address with a destination port 80

  Correct Answer: BC

• Question 394:

  A user reports difficulties accessing certain external web pages. When an engineer examines traffic to and from the external domain in full packet captures, they notice that many SYNs have the same sequence number, source, and destination IP address, but they have different payloads. What is causing this situation?

  A. failure of the full packet capture solution

  B. misconfiguration of a web filter

  C. insufficient network resources

  D. TCP injection

  Correct Answer: D

• Question 395:

  What is the impact of false negative alerts when compared to true negative alerts?

  A. A false negative is someone trying to hack into the system and no alert is raised, and a true negative is an event that never happened and an alert was not raised.

  B. A true negative is an alert for an exploit attempt when no attack was detected, and a false negative is when no attack happens and an alert is still raised.

  C. A true negative is a legitimate attack that triggers a brute force alert, and a false negative is when no alert and no attack is occurring.

  D. A false negative is an event that alerts for injection attack when no attack is happening, and a true negative is an attack that happens and an alert that is appropriately raised.

  Correct Answer: A

• Question 396:

  What matches the regular expression r(ege)+x?

  A. r(ege)x

  B. regeegex

  C. rx

  D. rege+x

  Correct Answer: B

• Question 397:

  

  Refer to the exhibit. What is occurring in this network traffic?

  A. legitimate network traffic

  B. flood of SYN-ACK packets

  C. ICMP flood

  D. flood of SYN packets

  Correct Answer: C

• Question 398:

  

  Refer to the exhibit. What is occurring?

  A. ARP spoofing attack

  B. man-in-the-middle attack

  C. brute-force attack

  D. denial-of-service attack

  Correct Answer: D

• Question 399:

  Which action matches the weaponization step of the Cyber Kill Chain Model?

  A. Develop a specific malware to exploit a vulnerable server.

  B. Construct a trojan and deliver it to the victim.

  C. Match a known script to a vulnerability.

  D. Scan open services and ports on a server.

  Correct Answer: A

• Question 400:

  What describes the framework that enables to control user access to critical information in the heterogenous technology environments?

  A. vulnerability scanner

  B. configuration management

  C. mobile device management

  D. identity and access management

  Correct Answer: D