Cisco CyberOps Associate 200-201 Questions & Answers

• Question 41:

  According to CVSS, what is a description of the attack vector score?

  A. It depends on how far away the attacker is located and the vulnerable component.

  B. The metric score will be larger when a remote attack is more likely.

  C. It depends on how many physical and logical manipulations are possible on a vulnerable component.

  D. The metric score will be larger when it is easier to physically touch or manipulate the vulnerable component.

  Correct Answer: B

• Question 42:

  Which two elements are assets in the role of attribution in an investigation? (Choose two.)

  A. context

  B. session

  C. laptop

  D. firewall logs

  E. threat actor

  Correct Answer: CD

  The following are some factors that are used during attribution in an investigation: Assets, Threat actor, Indicators of Compromise (IoCs), Indicators of Attack (IoAs), Chain of custody Asset: This factor identifies which assets were compromised by a threat actor or hacker. An example of an asset can be an organization's domain controller (DC) that runs Active Directory Domain Services (AD DS). AD is a service that allows an administrator to manage user accounts, user groups, and policies across a Microsoft Windows environment. Keep in mind that an asset is anything that has value to an organization; it can be something physical, digital, or even people. Cisco Certified CyberOps Associate 200-201 Certification Guide

• Question 43:

  A SOC analyst detected connections to known CandC and port scanning activity to main HR database servers from one of the HR endpoints, via Cisco StealthWatch. What are the two next steps of the SOC team according to the NIST.SP80061 incident handling process? (Choose two.)

  A. Update antivirus signature databases on affected endpoints to block connections to CandC.

  B. Isolate affected endpoints and take disk images for analysis.

  C. Block connection to this CandC server on the perimeter next-generation firewall.

  D. Provide security awareness training to HR managers and employees

  E. Detect the attack vector and analyze CandC connections.

  Correct Answer: BE

• Question 44:

  The SOC team has confirmed a potential indicator of compromise on an isolated endpoint. The team has narrowed the potential malware type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling the event?

  A. Perform an AV scan on the infected endpoint.

  B. Isolate the infected endpoint from the network.

  C. Prioritize incident handling based on the impact.

  D. Analyze the malware behavior.

  Correct Answer: B

• Question 45:

  Which element is included in an incident response plan as stated in NIST.SP800-617

  A. security of sensitive information

  B. individual approach to incident response

  C. consistent threat identification

  D. approval of senior management

  Correct Answer: D

• Question 46:

  An engineer is working on a ticket for an incident from the incident management team. A week ago, an external web application was targeted by a DDoS attack. Server resources were exhausted and after two hours, it crashed. An engineer was able to identify the attacker and technique used. Three hours after the attack, the server was restored and the engineer recommended implementing mitigation by Blackhole filtering and transferred the incident ticket back to the IR team. According to NIST.SP800-61, at which phase of the incident response did the engineer finish work?

  A. post-incident activity

  B. preparation

  C. detection and analysis

  D. containment, eradication, and recovery

  Correct Answer: D

• Question 47:

  A user received a malicious email attachment named "DS045-report1122345.exe" and executed it. In which step of the Cyber Kill Chain is this event?

  A. reconnaissance

  B. delivery

  C. weaponization

  D. installation

  Correct Answer: D

  The attachment is already executed. It should be Exploitation, but once it is not an option so it is installation.

• Question 48:

  Which action matches the weaponization step of the Cyber Kill Chain model?

  A. Research data on a specific vulnerability.

  B. Test and construct the appropriate malware to launch the attack.

  C. Scan a host to find open ports and vulnerabilities.

  D. Construct the appropriate malware and deliver it to the victim.

  Correct Answer: B

• Question 49:

  A cyberattacker notices a security flaw in a software that a company is using. They decide to tailor a specific worm to exploit this flaw and extract saved passwords from the software. To which category of the Cyber Kill Chain model does this event belong?

  A. weaponization

  B. reconnaissance

  C. delivery

  D. exploitation

  Correct Answer: A

• Question 50:

  Refer to the exhibit.

  

  A suspicious IP address is tagged by Threat Intelligence as a brute-force attempt source. After the attacker produces many of failed login entries it successfully compromises the account. Which stakeholder is responsible for the incident response detection step?

  A. employee 2

  B. employee 3

  C. employee 4

  D. employee 5

  Correct Answer: C