What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

Tapping interrogation replicates signals to a separate port for analyzing traffic

Tapping interrogations detect and block malicious traffic

Inline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies

Inline interrogation detects malicious traffic but does not block the traffic

What is a difference between inline traffic interrogation and traffic mirroring?

Inline inspection acts on the original traffic data flow

Traffic mirroring passes live traffic to a tool for blocking

Traffic mirroring inspects live traffic for analysis and mitigation

Inline traffic copies packets for analysis and security

A system administrator is ensuring that specific registry information is accurate.Which type of configuration information does the HKEY_LOCAL_MACHINE hive contain?

hardware, software, and security settings for the system

currently logged in users, including folders and control panel settings

all users on the system, including visual settings

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

Design criteria for reviewing alerts.

Modify the settings of the intrusion detection system.

Design criteria for reviewing alerts.

What is the impact of false positive alerts on business compared to true positive?

False positive alerts are blocked by mistake as potential attacks affecting application availability.

True positives affect security as no alarm is raised when an attack has taken place, resulting in a potential breach.

True positive alerts are blocked by mistake as potential attacks affecting application availability.

False positives affect security as no alarm is raised when an attack has taken place, resulting in a potential breach.

False positive alerts are blocked by mistake as potential attacks affecting application availability.

Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16

src=10.11.0.0/16 and dst=10.11.0.0/16

ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16

ip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16

src==10.11.0.0/16 and dst==10.11.0.0/16

A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engineer needs to analyze the network and identify ways to improve traffic movement to minimize delays. Which information must the engineer obtain for this analysis?

total throughput on the interface of the router and NetFlow records

output of routing protocol authentication failures and ports used

running processes on the applications and their total network usage

deep packet captures of each application flow and duration

Which incidence response step includes identifying all hosts affected by an attack?

containment, eradication, and recovery

A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

CD data copy prepared in Windows

CD data copy prepared in Mac-based system

CD data copy prepared in Linux system

CD data copy prepared in Android-based system

Refer to the exhibit. What does this output indicate?

Email ports are closed on the server.

HTTPS ports are open on the server.

SMB ports are closed on the server.

FTP ports are open on the server.

Email ports are closed on the server.

Which metric should be used when evaluating the effectiveness and scope of a Security Operations Center?

The average time the SOC takes to detect and resolve the incident.

The average time the SOC takes to register and assign the incident.

The total incident escalations per week.

The average time the SOC takes to detect and resolve the incident.

The total incident escalations per month.

A developer is working on a project using a Linux tool that enables writing processes to obtain these required results:If the process is unsuccessful, a negative value is returned.If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process.Which component results from this operation?

new process created by parent process

parent directory name of a file pathname

new process created by parent process

An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide?

Identify lessons learned from the threat.

Reduce the probability of similar threats.

Refer to the exhibit. What is shown in this PCAP file?

Timestamps are indicated with error.

What is a difference between tampered and untampered disk images?

Untampered images are used for forensic investigations.

Tampered images have the same stored and computed hash.

Tampered images are used as evidence.

Untampered images are used for forensic investigations.

Untampered images are deliberately altered to preserve as evidence

The SOC team has confirmed a potential indicator of compromise on an endpoint. The team has narrowed the executable file's type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling this event?

Collect public information on the malware behavior.

Isolate the infected endpoint from the network.

Perform forensics analysis on the infected endpoint.

Collect public information on the malware behavior.

Prioritize incident handling based on the impact.

Cisco 200-201 Practice Test 4 - Free Online Exam Questions 121-160

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

Become a Premium Member for full access

Unlock Premium Member

Cisco 200-201 Practice Test 4

Question

Cisco 200-201 Practice Tests

Practice Tests