Which piece of information is needed for attribution in an investigation?

proxy logs showing the source RFC 1918 IP addresses

802.1x RADIUS authentication pass arid fail logs

What is a purpose of a vulnerability management framework?

identifies, removes, and mitigates system vulnerabilities

detects and removes vulnerabilities in source code

conducts vulnerability scans on the network

manages a list of reported vulnerabilities

A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this situation?

the foreign government that conducted the attack

the intellectual property that was stolen

the defense contractor who stored the intellectual property

the method used to conduct the attack

the foreign government that conducted the attack

What is the difference between an attack vector and attack surface?

An attack vector identifies components that can be exploited, and an attack surface identifies the potential path an attack can take to penetrate the network.

An attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.

An attack vector identifies components that can be exploited, and an attack surface identifies the potential path an attack can take to penetrate the network.

An attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible with these vulnerabilities.

An attack vector identifies the potential outcomes of an attack; and an attack surface launches an attack using several methods against the identified vulnerabilities.

What is the principle of defense-in-depth?

Several distinct protective layers are involved.

Agentless and agent-based protection for security are used.

Several distinct protective layers are involved.

Access control models are involved.

Authentication, authorization, and accounting mechanisms are used.

What is the difference between the rule-based detection when compared to behavioral detection?

Rule-Based systems have established patterns that do not change with new data, while behavioral changes.

Rule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature.

Rule-Based systems have established patterns that do not change with new data, while behavioral changes.

Behavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags potentially abnormal patterns using signatures.

Behavioral systems find sequences that match a particular attack signature, while Rule-Based identifies potential attacks.

Which two components reduce the attack surface on an endpoint? (Choose two.)

full packet captures at the endpoint

What is an attack surface as compared to a vulnerability?

the sum of all paths for data into and out of the environment

any potential danger to an asset

the sum of all paths for data into and out of the environment

an exploitable weakness in a system or its design

the individuals who perform an attack

Refer to the exhibit. What is the expected result when the 'Allow subdissector to reassemble TCP streams' feature is enabled?

extract a file from a packet capture

Which event is user interaction?

reading and writing file permission

What is a benefit of agent-based protection when compared to agentless protection?

It collects and detects all traffic locally

It provides a centralized platform

It collects and detects all traffic locally

It manages numerous devices simultaneously

One of the objectives of information security is to protect the CIA of information and systems. What does CIA mean in this context?

confidentiality, integrity, and availability

confidentiality, identity, and authorization

confidentiality, integrity, and authorization

confidentiality, identity, and availability

confidentiality, integrity, and availability

What is rule-based detection when compared to statistical detection?

falsification of a user's identity

What is a difference between SOAR and SIEM?

SOAR platforms are used for threat and vulnerability management, but SIEM applications are not

SIEM applications are used for threat and vulnerability management, but SOAR platforms are not

SOAR receives information from a single platform and delivers it to a SIEM

SIEM receives information from a single platform and delivers it to a SOAR

What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?

MAC is the strictest of all levels of control and DAC is object-based access

MAC is controlled by the discretion of the owner and DAC is controlled by an administrator

MAC is the strictest of all levels of control and DAC is object-based access

DAC is controlled by the operating system and MAC is controlled by an administrator

DAC is the strictest of all levels of control and MAC is object-based access

What is the virtual address space for a Windows process?

set of virtual memory addresses that can be used

physical location of an object in memory

set of pages that reside in the physical memory

system-level memory protection feature built into the operating system

set of virtual memory addresses that can be used

What is the function of a command and control server?

It sends instruction to a compromised system

It enumerates open ports on a network device

It drops secondary payload into malware

It is used to regain control of the network after a compromise

It sends instruction to a compromised system

What is the difference between deep packet inspection and stateful inspection?

Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4

Deep packet inspection is more secure than stateful inspection on Layer 4

Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7

Stateful inspection is more secure than deep packet inspection on Layer 7

Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4

What is the difference between statistical detection and rule-based detection models?

Statistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis

Rule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time

Statistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis

Statistical detection involves the evaluation of an object on its intended actions before it executes that behavior

Rule-based detection defines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis

What is the difference between a threat and a risk?

Threat represents a potential danger that could take advantage of a weakness in a system

Risk represents the known and identified loss or danger in the system

Risk represents the nonintentional interaction with uncertainty in the system

Threat represents a state of being exposed to an attack or a compromise, either physically or logically.

Cisco 200-201 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

resource exhaustion

tunneling

traffic fragmentation

timing attack

Comment (0)

Cisco 200-201 Practice Test 1

Question

Cisco 200-201 Practice Tests

Practice Tests