Refer to the exhibit. An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

The file will not execute its behavior in a sandbox environment to avoid detection.

The file will appear legitimate by evading signature-based detection.

The file will not execute its behavior in a sandbox environment to avoid detection.

The file will insert itself into an application and execute when the application is run.

The file will monitor user activity and send the information to an outside source.

What is the difference between deep packet inspection and stateful inspection?

Deep packet inspection is more secure than stateful inspection on Layer 4.

Stateful inspection verifies contents at Layer 4. and deep packet inspection verifies connection at Layer 7.

Stateful inspection is more secure than deep packet inspection on Layer 7.

Deep packet inspection is more secure than stateful inspection on Layer 4.

Deep packet inspection allows visibility on Layer 7, and stateful inspection allows visibility on Layer 4.

What should an engineer use to aid the trusted exchange of public keys between user tom0411976943 and dan1968754032?

trusted certificate authorities

What is a description of a social engineering attack?

fake offer for free music download to trick the user into providing sensitive data

package deliberately sent to the wrong receiver to advertise a new product

mistakenly received valuable order destined for another person and hidden on purpose

email offering last-minute deals on various vacations around the world with a due date and a counter

What describes a buffer overflow attack?

overloading a predefined amount of memory

injecting new commands into existing buffers

fetching data from memory buffer registers

overloading a predefined amount of memory

suppressing the buffers in a process

Why is HTTPS traffic difficult to screen?

The communication is encrypted and the data in transit is secured.

HTTPS is used internally and screening traffic (or external parties is hard due to isolation.

The communication is encrypted and the data in transit is secured.

Digital certificates secure the session, and the data is sent at random intervals.

Traffic is tunneled to a specific destination and is inaccessible to others except for the receiver.

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?

Win32.polip.a.exe is an executable file and should be flagged as malicious.

The file is clean and does not represent a risk.

Cuckoo cleaned the malicious file and prepared it for usage.

MD5 of the file was not identified as malicious.

What is the difference between indicator of attack (loA) and indicators of compromise (loC)?

loC is the evidence that a security breach has occurred, and loA allows organizations to act before the vulnerability can be exploited.

loA is the evidence that a security breach has occurred, and loC allows organizations to act before the vulnerability can be exploited.

loA refers to the individual responsible for the security breach, and loC refers to the resulting loss.

loC is the evidence that a security breach has occurred, and loA allows organizations to act before the vulnerability can be exploited.

loC refers to the individual responsible for the security breach, and loA refers to the resulting loss.

Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

Identified open SMB ports on the server

Identified a firewall device preventing the pert state from being returned.

Identified open SMB ports on the server

Gathered information on processes running on the server

Gathered a list of Active Directory users

Which statement describes patch management?

process of appropriate distribution of system or software updates

scanning servers and workstations for missing patches and vulnerabilities

managing and keeping previous patches lists documented for audit purposes

process of appropriate distribution of system or software updates

workflow of distributing mitigations of newly found vulnerabilities

Refer to the exhibit. An attacker gained initial access to the company s network and ran an Nmap scan to advance with the lateral movement technique and to search the sensitive data. Which two elements can an attacker identify from the scan? (Choose two.)

functionality and purpose of the server

workload and the configuration details

number of users and requests that the server is handling

functionality and purpose of the server

Why should an engineer use a full packet capture to investigate a security breach?

It reconstructs the event allowing the engineer to identify the root cause by seeing what took place during the breach

It captures the TCP flags set within each packet for the engineer to focus on suspicious packets to identify malicious activity

It collects metadata for the engineer to analyze, including IP traffic packet data that is sorted, parsed, and indexed.

It provides the full TCP streams for the engineer to follow the metadata to identify the incoming threat.

It reconstructs the event allowing the engineer to identify the root cause by seeing what took place during the breach

A SOC analyst detected connections to known C&C and port scanning activity to main HR database servers from one of the HR endpoints via Cisco StealthWatch. What are the two next steps of the SOC team according to the NISTSP800-61 incident handling process? (Choose two)

Isolate affected endpoints and take disk images for analysis

Block connection to this C&C server on the perimeter next-generation firewall

Isolate affected endpoints and take disk images for analysis

Provide security awareness training to HR managers and employees

Block connection to this C&C server on the perimeter next-generation firewall

Update antivirus signature databases on affected endpoints to block connections to C&C

Detect the attack vector and analyze C&C connections

Exhibit. An engineer received a ticket about a slowdown of a web application, Drug analysis of traffic, the engineer suspects a possible attack on a web server. How should the engineer interpret the Wiresharat traffic capture?

10.0.0.2 sends HTTP FORBIDDEN /1.1 And Post request, while the target responds with HTTP/1.1 200 Get and HTTP/1.1 403. This is an HTTP GET flood attack.

10.0.0.2 sends GET/ HTTP/1.1 And Post request and the target responds with HTTP/1.1. 200 OC and HTTP/1.1 403 accordingly. This is an HTTP flood attempt.

10.0.0.2 sends HTTP FORBIDDEN /1.1 And Post request, while the target responds with HTTP/1.1 200 Get and HTTP/1.1 403. This is an HTTP GET flood attack.

10.128.0.2 sends POST/1.1 And POST requests, and the target responds with HTTP/1.1 200 Ok and HTTP/1.1 403 accordingly. This is an HTTP Reserve Bandwidth flood.

10.128.0.2 sends HTTP/FORBIDDEN/ 1.1 and Get requests, and the target responds with HTTP/1.1 200 OK and HTTP/1.1 403. This is an HTTP cache bypass attack.

Refer to the exhibit. An attacker scanned the server using Nmap.What did the attacker obtain from this scan?

Identified a firewall device preventing the port state from being returned

Identified open SMB ports on the server

Gathered information on processes running on the server

Gathered a list of Active Directory users.

An engineer received an alert affecting the degraded performance of a critical server Analysis showed a heavy CPU and memory load What is the next step the engineer should take to investigate this resource usage7

Run 'ps -ef to understand which processes are taking a high amount of resources

Run 'ps -u' to find out who executed additional processes that caused a high load on a server

Run 'ps -m' to capture the existing state of daemons and map the required processes to find the gap

Run 'ps -d' to decrease the priority state of high-load processes to avoid resource exhaustion

What are two differences between tampered disk images and untampered disk images'? (Choose two.)

The image is untampered if the existing stored hash matches the computed one

Tampered images are used as an element for the root cause analysis report

Tampered Images are used in a security investigation process

Untampered images can be used as law enforcement evidence.

The image is untampered if the existing stored hash matches the computed one

The image is tampered if the stored hash and the computed hash are identical

Tampered images are used as an element for the root cause analysis report

According to CVSS, what is a description of the attack vector score?

The metric score will be larger when a remote attack is more likely.

The metric score will be larger when it is easier to physically touch or manipulate the vulnerable component

It depends on how many physical and logical manipulations are possible on a vulnerable component

The metric score will be larger when a remote attack is more likely.

It depends on how far away the attacker is located and the vulnerable component

What is a difference between a threat and a risk?

A risk is an intersection between threat and vulnerabilities, and a threat is what a security engineer is trying to protect against

A threat is a sum of risks and a risk itself represents a specific danger toward the asset

A threat can be people property, or information, and risk is a probability by which these threats may bring harm to the business

A risk is a flaw or hole in security, and a threat is what is being used against that flaw

A risk is an intersection between threat and vulnerabilities, and a threat is what a security engineer is trying to protect against

An engineer is working on a ticket for an incident from the incident management team A week ago. an external web application was targeted by a DDoS attack Server resources were exhausted and after two hours it crashed. An engineer was able to identify the attacker and technique used Three hours after the attack, the server was restored and the engineer recommended implementing mitigation by Blackhole filtering and transferred the incident ticket back to the IR team According to NIST SP800-61, at which phase of the incident response did the engineer finish work?

containment eradication and recovery

Cisco 200-201 Practice Test 7 - Free Online Exam Prep & Questions

A user received a targeted spear-phishing email and identified it as suspicious before opening the content. To which category of the Cyber Kill Chain model does to this type of event belong?

Become a Premium Member for full access

Unlock Premium Member

Cisco 200-201 Practice Test 7

Question

Cisco 200-201 Practice Tests

Practice Tests