Cisco 200-201 Practice Test - Questions Answers, Page 19
Question list
List of questions
Related questions
Which of these describes SOC metrics in relation to security incidents?
time it takes to detect the incident
time it takes to assess the risks of the incident
probability of outage caused by the incident
probability of compromise and impact caused by the incident
What is the difference between the ACK flag and the RST flag?
The RST flag approves the connection, and the ACK flag terminates spontaneous connections.
The ACK flag confirms the received segment, and the RST flag terminates the connection.
The RST flag approves the connection, and the ACK flag indicates that a packet needs to be resent
The ACK flag marks the connection as reliable, and the RST flag indicates the failure within TCP Handshake
Refer to the exhibit.
An engineer is analyzing a PCAP file after a recent breach An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers. Further analysis showed several SSH Server Banner and Key Exchange Initiations. The engineer cannot see the exact data being transmitted over an encrypted channel and cannot identify how the attacker gained access How did the attacker gain access?
by using the buffer overflow in the URL catcher feature for SSH
by using an SSH Tectia Server vulnerability to enable host-based authentication
by using an SSH vulnerability to silently redirect connections to the local host
by using brute force on the SSH service to gain access
Refer to the exhibit.
What is occurring within the exhibit?
regular GET requests
XML External Entities attack
insecure deserialization
cross-site scripting attack
Refer to the exhibit.
Which component is identifiable in this exhibit?
Trusted Root Certificate store on the local machine
Windows PowerShell verb
Windows Registry hive
local service in the Windows Services Manager
An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?
Run 'ps -d' to decrease the priority state of high load processes to avoid resource exhaustion.
Run 'ps -u' to find out who executed additional processes that caused a high load on a server.
Run 'ps -ef' to understand which processes are taking a high amount of resources.
Run 'ps -m' to capture the existing state of daemons and map required processes to find the gap.
What is a difference between an inline and a tap mode traffic monitoring?
Inline monitors traffic without examining other devices, while a tap mode tags traffic and examines the data from monitoring devices.
Tap mode monitors traffic direction, while inline mode keeps packet data as it passes through the monitoring devices.
Tap mode monitors packets and t heir content with the highest speed, while the inline mode draws a packet path for analysis.
Inline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network.
Which regular expression is needed to capture the IP address 192.168.20.232?
^ (?:[0-9]{1,3}\.){3}[0-9]{1,3}
^ (?:[0-9]f1,3}\.){1,4}
^ (?:[0-9]{1,3}\.)'
^ ([0-9]-{3})
How does a certificate authority impact security?
It validates client identity when communicating with the server.
It authenticates client identity when requesting an SSL certificate.
It authenticates domain identity when requesting an SSL certificate.
It validates the domain identity of the SSL certificate.
What is a difference between SIEM and SOAR?
SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.
SlEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.
SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.
SOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.
Question