Cisco CyberOps Associate 200-201 Questions & Answers

• Question 51:

  How does certificate authority impact a security system?

  A. It authenticates client identity when requesting SSL certificate

  B. It validates domain identity of a SSL certificate

  C. It authenticates domain identity when requesting SSL certificate

  D. It validates client identity when communicating with the se

  Correct Answer: B

• Question 52:

  Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

  A. Modify the settings of the intrusion detection system.

  B. Design criteria for reviewing alerts.

  C. Redefine signature rules.

  D. Adjust the alerts schedule.

  Correct Answer: A

  Traditional intrusion detection system (IDS) and intrusion prevention system (IPS) devices need to be tuned to avoid false positives and false negatives. Next- generation IPSs do not need the same level of tuning compared to traditional IPSs.

  Also, you can obtain much deeper reports and functionality, including advanced malware protection and retrospective analysis to see what happened after an attack took place.

  Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

• Question 53:

  Refer to the exhibit.

  

  An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server Which display filters should the analyst use to filter the FTP traffic?

  A. dstport == FTP

  B. tcp.port==21

  C. tcpport = FTP

  D. dstport = 21

  Correct Answer: B

• Question 54:

  An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?

  A. data from a CD copied using Mac-based system

  B. data from a CD copied using Linux system

  C. data from a DVD copied using Windows system

  D. data from a CD copied using Windows

  Correct Answer: B

  CDfs is a virtual file system for Unix-like operating systems; it provides access to data and audio tracks on Compact Discs. When the CDfs driver mounts a Compact Disc, it represents each track as a file. This is consistent with the Unix convention "everything is a file". Source: https://en.wikipedia.org/wiki/CDfs

• Question 55:

  Refer to the exhibit.

  

  What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

  A. insert TCP subdissectors

  B. extract a file from a packet capture

  C. disable TCP streams

  D. unfragment TCP

  Correct Answer: B

• Question 56:

  Which attack method intercepts traffic on a switched network?

  A. denial of service

  B. ARP cache poisoning

  C. DHCP snooping

  D. command and control

  Correct Answer: B

  An ARP-based MITM attack is achieved when an attacker poisons the ARP cache of two devices with the MAC address of the attacker's network interface card (NIC). Once the ARP caches have been successfully poisoned, each victim device sends all its packets to the attacker when communicating to the other device and puts the attacker in the middle of the communications path between the two victim devices. It allows an attacker to easily monitor all communication between victim devices. The intent is to intercept and view the information being passed between the two victim devices and potentially introduce sessions and traffic between the two victim devices

• Question 57:

  Refer to the exhibit.

  

  What information is depicted?

  A. IIS data

  B. NetFlow data

  C. network discovery event

  D. IPS event data

  Correct Answer: B

• Question 58:

  Which information must an organization use to understand the threats currently targeting the organization?

  A. threat intelligence

  B. risk scores

  C. vendor suggestions

  D. vulnerability exposure

  Correct Answer: A

• Question 59:

  What is a difference between inline traffic interrogation and traffic mirroring?

  A. Inline inspection acts on the original traffic data flow

  B. Traffic mirroring passes live traffic to a tool for blocking

  C. Traffic mirroring inspects live traffic for analysis and mitigation

  D. Inline traffic copies packets for analysis and security

  Correct Answer: A

  Inline traffic interrogation analyzes traffic in real time and has the ability to prevent certain traffic from being forwarded Traffic mirroring doesn't pass the live traffic instead it copies traffic from one or more source ports and sends the copied traffic to one or more destinations for analysis by a network analyzer or other monitoring device

• Question 60:

  A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engineer needs to analyze the network and identify ways to improve traffic movement to minimize delays. Which information must the engineer obtain for this analysis?

  A. total throughput on the interface of the router and NetFlow records

  B. output of routing protocol authentication failures and ports used

  C. running processes on the applications and their total network usage

  D. deep packet captures of each application flow and duration

  Correct Answer: A