Cisco CyberOps Associate 200-201 Questions & Answers

• Question 401:

  A company plans to implement network segmentations and use IP address inventory management best practices. Servers and end-user devices are using the same VLANs and IP subnets with manual address assignment. What are the first two steps the engineers must take to meet these requirements? (Choose two.)

  A. Configure packet captures to perform deep packet inspection for further traffic analysis and implementation of access rules.

  B. Implement deep network traffic analysis using NetFlow v5 from routers and switches.

  C. Deploy an Active Directory server and add all assets to the created domain for better visibility.

  D. Assign separate hard-coded IP address spaces for critical assets, according to their role and functions.

  E. Create IP address inventory database and deploy separate role-based IP subnetting for users using centralized DHCP server.

  Correct Answer: DE

• Question 402:

  What does the SOC metric MTTC provide in incident analysis?

  A. average time it takes to recognize and stop the incident

  B. average time it takes to fix the issues caused by the incident

  C. average time it takes to detect that the incident has occurred

  D. average time the attacker has access to the environment

  Correct Answer: A

• Question 403:

  During a quarterly vulnerability scan, a security analyst discovered unused uncommon ports open and in a listening state. Further investigation showed that the unknown application was communicating with an external IP address on an encrypted channel. A deeper analysis revealed a command and control communication on an infected server. At which step of the Cyber Kill Chain was the attack detected?

  A. Exploitation

  B. Actions on Objectives

  C. Weaponization

  D. Delivery

  Correct Answer: B

• Question 404:

  According to NIST, at which step of the incident response process should an organization apply lessons learned from practice?

  A. preparation

  B. detection and analysis

  C. containment

  D. post-incident activity

  Correct Answer: D

• Question 405:

  The SOC team detected an ongoing port scan. After investigation, the team concluded that the scan was targeting the company servers. According to the Cyber Kill Chain model, which step must be assigned to this type of event?

  A. delivery

  B. exploitation

  C. reconnaissance

  D. actions on objectives

  Correct Answer: C

• Question 406:

  DRAG DROP Cisco's Zero Trust Architecture simplifies the Zero Trust journey into three critical areas. Drag the definitions onto the graphic to describe Zero Trust from the Cisco perspective

  Select and Place:

  

  Correct Answer: