What is an advantage of symmetric over asymmetric encryption?

It is a faster encryption mechanism for sessions

A key is generated on demand according to data type.

A one-time encryption key is generated for data transmission

It is suited for transmitting large amounts of data.

It is a faster encryption mechanism for sessions

What is the difference between a threat and an exploit?

A threat is a potential attack on an asset and an exploit takes advantage of the vulnerability of the asset

A threat is a result of utilizing flow in a system, and an exploit is a result of gaining control over the system.

A threat is a potential attack on an asset and an exploit takes advantage of the vulnerability of the asset

An exploit is an attack vector, and a threat is a potential path the attack must go through.

An exploit is an attack path, and a threat represents a potential vulnerability

Refer to the exhibit. What should be interpreted from this packet capture?

192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.

81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.

192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.

192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.

81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.

What are the two characteristics of the full packet captures? (Choose two.)

Troubleshooting the cause of security and performance issues.

Reassembling fragmented traffic from raw data.

Identifying network loops and collision domains.

Troubleshooting the cause of security and performance issues.

Reassembling fragmented traffic from raw data.

Detecting common hardware faults and identify faulty assets.

Providing a historical record of a network transaction.

Refer to the exhibit. An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?

The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

The file has an embedded executable and was matched by PEiD threat signatures for further analysis.

The file has an embedded non-Windows executable but no suspicious features are identified.

The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.

Refer to the exhibit. What is occurring in this network traffic?

High rate of SYN packets being sent from a multiple source towards a single destination IP.

High rate of ACK packets being sent from a single source IP towards multiple destination IPs.

Flood of ACK packets coming from a single source IP to multiple destination IPs.

Flood of SYN packets coming from a single source IP to a single destination IP.

An engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Application Visibility and Control should the engineer use to accomplish this goal? (Choose two.)

metrics collection and exporting

An engineer is investigating a case of the unauthorized usage of the ''Tcpdump'' tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

all information and data within the datagram

tagged protocols being used on the network

all firewall alerts and resulting mitigations

tagged ports being used on the network

all information and data within the datagram

An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

nmap --top-ports 192.168.1.0/24

Refer to the exhibit. Which event is occurring?

A binary is being submitted to run on VM cuckoo1

A binary named 'submit' is running on VM cuckoo1.

A binary is being submitted to run on VM cuckoo1

A binary on VM cuckoo1 is being submitted for evaluation

A URL is being evaluated to see if it has a malicious binary

An analyst is exploring the functionality of different operating systems.What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?

has a Common Information Model, which describes installed hardware and software

queries Linux devices that have Microsoft Services for Linux installed

deploys Windows Operating Systems in an automated fashion

is an efficient tool for working with Active Directory

has a Common Information Model, which describes installed hardware and software

What causes events on a Windows system to show Event Code 4625 in the log messages?

Someone is trying a brute force attack on the network

The system detected an XSS attack

Someone is trying a brute force attack on the network

Another device is gaining root access to the system

A privileged user successfully logged into the system

Refer to the exhibit. What does the message indicate?

a successful access attempt was made to retrieve the root of the website

an access attempt was made from the Mosaic web browser

a successful access attempt was made to retrieve the password file

a successful access attempt was made to retrieve the root of the website

a denied access attempt was made to retrieve the password file

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

application identification number

active process identification number

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

The computer has a HIDS installed on it.

The computer has a HIPS installed on it.

The computer has a NIPS installed on it.

The computer has a HIDS installed on it.

The computer has a NIDS installed on it.

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.201.3.149.

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are three active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

What is a difference between tampered and untampered disk images?

Untampered images are used for forensic investigations.

Tampered images have the same stored and computed hash.

Untampered images are deliberately altered to preserve as evidence.

Tampered images are used as evidence.

Untampered images are used for forensic investigations.

What is a sandbox interprocess communication service?

A collection of interfaces that allow for coordination of activities among processes.

A collection of rules within the sandbox that prevent the communication between sandboxes.

A collection of network services that are activated on an interface, allowing for inter-port communication.

A collection of interfaces that allow for coordination of activities among processes.

A collection of host services that allow for communication between sandboxes.

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.Which technology should be used to accomplish this task?

application whitelisting/blacklisting

Cisco 200-201 Practice Test 3 - Free Online Exam Questions 81-120

Syslog collecting software is installed on the server For the log containment, a disk with FAT type partition is used An engineer determined that log files are being corrupted when the 4 GB tile size is exceeded. Which action resolves the issue?

Become a Premium Member for full access

Unlock Premium Member

Cisco 200-201 Practice Test 3

Question

Cisco 200-201 Practice Tests

Practice Tests