Cisco CyberOps Associate 200-201 Questions & Answers

• Question 81:

  What should an engineer use to aid the trusted exchange of public keys between user tom0411976943 and dan1968754032?

  A. central key management server

  B. web of trust

  C. trusted certificate authorities

  D. registration authority data

  Correct Answer: C

• Question 82:

  Which data type is necessary to get information about source/destination ports?

  A. statistical data

  B. session data

  C. connectivity data

  D. alert data

  Correct Answer: B

  Session data provides information about the five tuples; source IP address/port number, destination IP address/port number and the protocol What is Connectivity Data? According to IBM - Connectivity data defines how entities are connected in the network. It includes connections between different devices, and VLAN- related connections within the same device https://www.ibm.com/docs/en/networkmanager/4.2.0?topic=relationships-connectivity-data

• Question 83:

  Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

  A. detection and analysis

  B. post-incident activity

  C. vulnerability management

  D. risk assessment

  E. vulnerability scoring

  Correct Answer: AB

  Reference: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

• Question 84:

  Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

  A. src=10.11.0.0/16 and dst=10.11.0.0/16

  B. ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16

  C. ip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16

  D. src==10.11.0.0/16 and dst==10.11.0.0/16

  Correct Answer: B

• Question 85:

  Which attack represents the evasion technique of resource exhaustion?

  A. SQL injection

  B. man-in-the-middle

  C. bluesnarfing

  D. denial-of-service

  Correct Answer: D

  Reference: https://www.ciscopress.com/articles/article.asp?p=3100055andseqNum=3

• Question 86:

  A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.

  Which technology should be used to accomplish this task?

  A. application whitelisting/blacklisting

  B. network NGFW

  C. host-based IDS

  D. antivirus/antispyware software

  Correct Answer: A

• Question 87:

  Which event is a vishing attack?

  A. obtaining disposed documents from an organization

  B. using a vulnerability scanner on a corporate network

  C. setting up a rogue access point near a public hotspot

  D. impersonating a tech support agent during a phone call

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/products/security/email-security/what-is-phishing.html#~types-of-phishing-attacks

• Question 88:

  An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, "File: Clean." Which regex must the analyst import?

  A. File: Clean

  B. ^Parent File Clean$

  C. File: Clean (.*)

  D. ^File: Clean$

  Correct Answer: A

• Question 89:

  How does an attacker observe network traffic exchanged between two users?

  A. port scanning

  B. man-in-the-middle

  C. command injection

  D. denial of service

  Correct Answer: B

• Question 90:

  Refer to the exhibit.

  

  What is the potential threat identified in this Stealthwatch dashboard?

  A. A policy violation is active for host 10.10.101.24.

  B. A host on the network is sending a DDoS attack to another inside host.

  C. There are three active data exfiltration alerts.

  D. A policy violation is active for host 10.201.3.149.

  Correct Answer: C

  "EX" = exfiltration

  And there are three.

  Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration

  https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/management_console/sm c_users_guide/SW_6_9_0_SMC_Users_Guide_DV_1_2.pdf page 177.