Which type of access control depends on the job function of the user?

nondiscretionary access control

What describes the defense-m-depth principle?

implementing alerts for unexpected asset malfunctions

defining precise guidelines for new workstation installations

categorizing critical assets within the organization

isolating guest Wi-Fi from the focal network

implementing alerts for unexpected asset malfunctions

Refer to the exhibit. A workstation downloads a malicious docx file from the Internet and a copy is sent to FTDv. The FTDv sends the file hash to FMC and the tile event is recorded what would have occurred with stronger data visibility.

Detailed information about the data in real time would have been provided

The traffic would have been monitored at any segment in the network.

Malicious traffic would have been blocked on multiple devices

An extra level of security would have been in place

Detailed information about the data in real time would have been provided

What is the impact of encryption?

Data is secure and unreadable without decrypting it

Confidentiality of the data is kept secure and permissions are validated

Data is accessible and available to permitted individuals

Data is unaltered and its integrity is preserved

Data is secure and unreadable without decrypting it

An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist. Further analysis shows that the threat actor connected an externa USB device to bypass security restrictions and steal data. The engineer could not find an external USB device Which piece of information must an engineer use for attribution in an investigation?

receptionist and the actions performed

list of security restrictions and privileges boundaries bypassed

receptionist and the actions performed

stolen data and its criticality assessment

Refer to the exhibit. A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted What is occurring?

cache bypassing attack: attacker is sending requests for noncacheable content

indicators of denial-of-service attack due to the frequency of requests

garbage flood attack attacker is sending garbage binary data to open ports

indicators of data exfiltration HTTP requests must be plain text

cache bypassing attack: attacker is sending requests for noncacheable content

A company encountered a breach on its web servers using IIS 7 5 Dunng the investigation, an engineer discovered that an attacker read and altered the data on a secure communication using TLS 1 2 and intercepted sensitive information by downgrading a connection to export-grade cryptography. The engineer must mitigate similar incidents in the future and ensure that clients and servers always negotiate with the most secure protocol versions and cryptographic parameters. Which action does the engineer recommend?

Install the latest IIS version.

Deploy an intrusion detection system

What is the difference between discretionary access control (DAC) and role-based access control (RBAC)?

RBAC access is granted when a user meets specific conditions, and in DAC, permissions are applied on user and group levels.

DAC requires explicit authorization for a given user on a given object, and RBAC requires specific conditions.

RBAC access is granted when a user meets specific conditions, and in DAC, permissions are applied on user and group levels.

RBAC is an extended version of DAC where you can add an extra level of authorization based on time.

DAC administrators pass privileges to users and groups, and in RBAC, permissions are applied to specific groups

What are the two differences between stateful and deep packet inspection? (Choose two )

Stateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports

Deep packet inspection is capable of malware blocking, and stateful inspection is not

Stateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports

Deep packet inspection is capable of malware blocking, and stateful inspection is not

Deep packet inspection operates on Layer 3 and 4. and stateful inspection operates on Layer 3 of the OSI model

Deep packet inspection is capable of TCP state monitoring only, and stateful inspection can inspect TCP and UDP.

Stateful inspection is capable of packet data inspections, and deep packet inspection is not

What is the purpose of command and control for network-aware malware?

It contacts a remote server for commands and updates

It takes over the user account for analysis

It controls and shuts down services on the infected host.

It helps the malware to profile the host

Which two measures are used by the defense-m-depth strategy? (Choose two)

Implement the patch management process

Bridge the single connection into multiple.

Reduce the load on network devices.

Implement the patch management process

Which option describes indicators of attack?

malware reinfection within a few minutes of removal

spam emails on an employee workstation

virus detection by the AV software

blocked phishing attempt on a company

malware reinfection within a few minutes of removal

What is a scareware attack?

inserting malicious code that causes popup windows with flashing colors

using the spoofed email addresses to trick people into providing login credentials

overwhelming a targeted website with fake traffic

gaming access to your computer and encrypting data stored on it

inserting malicious code that causes popup windows with flashing colors

Which process represents the application-level allow list?

allowing specific files and deny everything else

allowing everything and denying specific applications protocols

allowing everything and denying specific executable files

allowing specific format files and deny executable files

allowing specific files and deny everything else

What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?

SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.

TAPS interrogation is more complex because traffic mirroring applies additional tags to data and SPAN does not alter integrity and provides full duplex network.

SPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.

TAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools

SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.

What is threat hunting?

Focusing on proactively detecting possible signs of intrusion and compromise.

Managing a vulnerability assessment report to mitigate potential threats.

Focusing on proactively detecting possible signs of intrusion and compromise.

Pursuing competitors and adversaries to infiltrate their system to acquire intelligence data.

Attempting to deliberately disrupt servers by altering their availability

What describes the impact of false-positive alerts compared to false-negative alerts?

A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.

A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised

A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring

A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.

A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.

Refer to the exhibit. An engineer received a ticket about a slowed-down web application. The engineer runs the #netstat -an command. How must the engineer interpret the results?

The engineer must gather more data.

The web application is receiving a common, legitimate traffic

The engineer must gather more data.

The web application server is under a denial-of-service attack.

The server is under a man-in-the-middle attack between the web application and its database

What is the difference between deep packet inspection and stateful inspection?

Deep packet inspection gives insights up to Layer 7, and stateful inspection gives insights only up to Layer 4.

Deep packet inspection is more secure due to its complex signatures, and stateful inspection requires less human intervention.

Stateful inspection is more secure due to its complex signatures, and deep packet inspection requires less human intervention.

Stateful inspection verifies data at the transport layer and deep packet inspection verifies data at the application layer

How does statistical detection differ from rule-based detection?

Statistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules

Statistical detection involves the evaluation of events, and rule-based detection requires an evaluated set of events to function.

Statistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules

Rule-based detection involves the evaluation of events, and statistical detection requires an evaluated set of events to function Rule-based detection defines

legitimate data over a period of time, and statistical detection works on a predefined set of rules

Refer to the exhibit. What must be interpreted from this packet capture?

IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol.

IP address 192.168.88 12 is communicating with 192 168 88 149 with a source port 74 to destination port 49098 using TCP protocol

IP address 192.168.88.12 is communicating with 192 168 88 149 with a source port 49098 to destination port 80 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.

What is the difference between vulnerability and risk?

A vulnerability represents a flaw in a security that can be exploited, and the risk is the potential damage it might cause.

A vulnerability is a sum of possible malicious entry points, and a risk represents the possibility of the unauthorized entry itself.

A risk is a potential threat that an exploit applies to, and a vulnerability represents the threat itself

A vulnerability represents a flaw in a security that can be exploited, and the risk is the potential damage it might cause.

A risk is potential threat that adversaries use to infiltrate the network, and a vulnerability is an exploit

Cisco 200-201 Practice Test 6 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Cisco 200-201 Practice Test 6

Question

Cisco 200-201 Practice Tests

Practice Tests