Cisco 200-201 Practice Test - Questions Answers, Page 27

Patch management is the process of distributing and managing updates to software and systems. These updates can include patches for security vulnerabilities, bug fixes, and enhancements to improve performance or add new features. It ensures that systems are up-to-date, secure, and performing optimally.Reference:=Cisco Cybersecurity Training

An Nmap scan can provide detailed information about a network including the functionality and purpose of servers on that network as well as any services that are currently running on those servers. This information can be used by an attacker to identify potential vulnerabilities or targets for exploitation during a cyber attack.Reference:=Cisco Cybersecurity Training

Full packet capture (FPC) is a valuable tool for investigating security breaches because it provides comprehensive data that can be used to reconstruct the event and identify the root cause. By capturing every packet, FPC allows engineers to see exactly what took place during the breach, including the TCP flags set within each packet, which can help focus on suspicious packets to identify malicious activity.It also collects metadata, including IP traffic packet data that is sorted, parsed, and indexed, and provides the full TCP streams to follow the metadata to identify the incoming threat

The log in the exhibit is generated by an Intrusion Prevention System (IPS) or Intrusion Detection System (IDS). It contains information about a TCP connection attempt, including the source IP address, destination IP address, and other details related to the connection. The presence of ''TCP MISS'' indicates that the system detected an anomaly or potential threat during the connection attempt.Reference:=Cisco Cybersecurity Operations Fundamentals

According to the NIST SP 800-61 incident handling process, the SOC team should first isolate the affected endpoints to prevent further spread of the attack and take disk images for analysis (A). This helps in preserving evidence for a thorough investigation.The next step would be to block the connection to the C&C server on the perimeter next-generation firewall , which helps to cut off the communication between the compromised endpoint and the attacker's server, thereby mitigating the threat123.

When analyzing Wireshark traffic for potential attacks, an engineer should look for patterns that indicate abnormal behavior, such as:

Excessive Requests: A high number of requests over a short period could suggest an attempt to overwhelm the server, known as an HTTP flood.

Status Codes: Repeated403 Forbiddenresponses may indicate that the server is rejecting requests due to a security rule being triggered.

Request Types: A mix ofGETandPOSTrequests could be used in various attack scenarios, including bandwidth flooding or cache bypassing.

Reflective XSS, also known as Non-Persistent XSS, occurs when an attacker sends a malicious script to a user through a web application, and the script is executed immediately in the user's browser without being stored on the server. This type of attack is typically carried out by including the malicious script in a URL, which is then sent to the victim.When the victim clicks on the link, the script runs in their browser, reflecting the attacker's actions without storing the payload for repeated use12.Reference:: OWASP Foundation's documentation on Cross-Site Scripting (XSS) provides detailed information on the different types of XSS attacks, including Reflective XSS

When a server is experiencing high CPU and memory load, the first step is to identify the processes that are consuming the most resources. The command ''ps -ef'' is used to display information about all the running processes, including their IDs, memory and CPU usage, and the commands that started them.This allows the engineer to pinpoint which processes are responsible for the high load and take appropriate action, such as terminating unnecessary processes or optimizing resource usage345.Reference:: Various resources on server management and troubleshooting recommend using the ''ps -ef'' command as a starting point for investigating high resource usage on servers