What is sliding window anomaly detection?

Identify uncommon patterns that do not fit usual behavior.

Detect changes in operations and management processes.

Identify uncommon patterns that do not fit usual behavior.

Define response times for requests for owned applications.

Apply lowest privilege/permission level to software

What is a difference between SI EM and SOAR security systems?

SIEM raises alerts in the event of detecting any suspicious activity, and SOAR automates investigation path workflows and reduces time spent on alerts

SOAR ingests numerous types of logs and event data infrastructure components and SIEM can fetch data from endpoint security software and external threat intelligence feeds

SOAR collects and stores security data at a central point and then converts it into actionable intelligence, and SIEM enables SOC teams to automate and orchestrate manual tasks

SIEM raises alerts in the event of detecting any suspicious activity, and SOAR automates investigation path workflows and reduces time spent on alerts

SIEM combines data collecting, standardization, case management, and analytics for a defense-in-depth concept, and SOAR collects security data antivirus logs, firewall logs, and hashes of downloaded files

What is the dataflow set in the NetFlow flow-record format?

Dataflow set is a collection of data records.

Dataflow set is a collection of HEX records.

Dataflow set provides basic information about the packet such as the NetFlow version

Dataflow set is a collection of binary patterns

Dataflow set is a collection of data records.

Which element is included in an incident response plan as stated m NIST SP800-617

consistent threat identification

security of sensitive information

individual approach to incident response

consistent threat identification

What does the Zero Trust security model signify?

Zero Trust security means that no one is trusted by default from inside or outside the network

Zero Trust states that no users should be given enough privileges to misuse the system on their own

Zero Trust addresses access control and states that an individual should have only the minimum access privileges necessary to perform specific tasks

Zero Trust states that unless a subject is given explicit access to an object, it should be denied access to that object

Which action matches the weaponization step of the Cyber Kill Chain model?

Construct the appropriate malware and deliver it to the victim.

Scan a host to find open ports and vulnerabilities

Construct the appropriate malware and deliver it to the victim.

Test and construct the appropriate malware to launch the attack

Research data on a specific vulnerability

Refer to the exhibit. What is the outcome of the command?

TCP rule that detects TCP packets with a SYN flag in the internal network

TCP rule that detects TCP packets with the SYN flag in an external FTP server

TCP rule that detects TCP packets with a SYN flag in the internal network

TCP rule that detects TCP packets with a ACK flag in the internal network

TCP rule that detects TCP packets with the ACK flag in an external FTP server

Which items is an end-point application greylist used?

Items before being established as harmful or malicious

Items that have been established as malicious

Items that have been established as authorized

Items that have been installed with a baseline

Items before being established as harmful or malicious

An engineer must investigate suspicious connections. Data has been gathered using a tcpdump command on a Linux device and saved as sandboxmatware2022-12-22.pcaps file. The engineer is trying to open the tcpdump in the Wireshark tool. What is the expected result?

The tool does not support Linux.

The file has an incorrect extension.

The file does not support the'-' character.

Refer to the exhibit. What does this Cuckoo sandbox report indicate?

The file will open a command interpreter when executed.

The file will open unsecure ports when executed.

The file will open a command interpreter when executed.

An engineer configured regular expression ''.''\.(pd][Oo][Cc)|[Xx][LI][Ss]|[Pp][Pp][Tt]) HTTP/1 .[01]' on Cisco ASA firewall. What does this regular expression do?

It captures Word, Excel, and PowerPoint files in HTTPv1.0 and v1.1.

It captures documents in an HTTP network session.

It captures .doc, .xls, and .pdf files in HTTP v1.0 and v1.1.

It captures .doc, .xls, and .ppt files extensions in HTTP v1.0.

It captures Word, Excel, and PowerPoint files in HTTPv1.0 and v1.1.

What is a comparison between rule-based and statistical detection?

Rule-based uses data known beforehand and statistical is based on assumptions.

Statistical is based on measured data while rule-based uses the evaluated probability approach.

Rule-based Is based on assumptions and statistical uses data Known beforehand.

Rule-based uses data known beforehand and statistical is based on assumptions.

Statistical uses the probability approach while rule-based Is based on measured data.

What is a comparison between rule-based and statistical detection?

Rule-based uses data known beforehand and statistical is based on assumptions.

Statistical is based on measured data while rule-based uses the evaluated probability approach.

Rule-based Is based on assumptions and statistical uses data Known beforehand.

Rule-based uses data known beforehand and statistical is based on assumptions.

Statistical uses the probability approach while rule-based Is based on measured data.

Cisco 200-201 Practice Test 8 - Free Online Exam Prep & Questions

An organization that develops high-end technology is going through an internal audit The organization uses two databases The main database stores patent information and a secondary database stores employee names and contact information A compliance team is asked to analyze the infrastructure and identify protected data Which two types of protected data should be identified? (Choose two)

Become a Premium Member for full access

Unlock Premium Member

Cisco 200-201 Practice Test 8

Question

Cisco 200-201 Practice Tests

Practice Tests