Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CyberOps Associate
200-201
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Questions and Answers

Pass the Cisco CyberOps Associate 200-201 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 200-201 Premium Access

View all detail and faqs for the 200-201 exam

Go to Exam

794 Students Passed

89% Average Score

95% Same Questions

Viewing page 12 out of 15 pages

Viewing questions 111-120 out of questions

Questions # 111:

What is the difference between attack surface and vulnerability?

Options:

An attack surface is a way of taking advantage of a system or resource, and a vulnerability is a specific technique utilized by the vulnerability.

A vulnerability describes how software or a system is exposed to potential attacks, and an attack surface is an actual weakness that exposes the potential risk.

A vulnerability is a way of taking advantage of a system or resource, and an attack surface is a specific technique utilized by the vulnerability.

An attack surface describes how software or a system is exposed to potential attacks, and a vulnerability is an actual weakness that exposes the potential risk.

Answer

Questions # 112:

Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

Options:

Hypertext Transfer Protocol

SSL Certificate

Tunneling

VPN

Answer

Explanation

SSL Certificate guarantees the integrity and authenticity of all messages transferred to and from a web application. It encrypts the data transferred between the user’s browser and the website, ensuring that all data passed between them remains private and integral. References := Cisco CyberOps Engineer - Module 3: Secure Communications

Questions # 113:

Which regular expression matches "color" and "colour"?

Options:

colo?ur

col[0−8]+our

colou?r

col[0−9]+our

Answer

Explanation

The regular expression that matches both “color” and “colour” is colo?ur. In this expression, the ? denotes that the preceding character u is optional, meaning it may appear zero or one time. This allows the expression to match both the American spelling “color” and the British spelling “colour”.

References := Understanding regular expressions is fundamental in various computing tasks, including cybersecurity operations. The Cisco Cybersecurity Operations Fundamentals (CBROPS) material covers the use of regular expressions for searching through logs and data, which is a critical skill for a cybersecurity analyst.

Questions # 114:

A network engineer informed a security team of a large amount of traffic and suspicious activity from an unknown source to the company DMZ server The security team reviewed the data and identified a potential DDoS attempt According to NIST, at which phase of incident response is the security team?

Options:

containment and eradication

preparation

recovery

detection and analysis

Answer

Questions # 115:

A malicious file has been identified in a sandbox analysis tool.

Question # 115

Which piece of information is needed to search for additional downloads of this file by other hosts?

Options:

file header type

file size

file name

file hash value

Answer

Explanation

To search for additional downloads of a malicious file by other hosts, the file hash value is needed. The hash value provides a unique identifier for each specific file version, enabling cybersecurity professionals to track down identical files across networks. References := Cisco Certified CyberOps Associate Overview

Questions # 116:

When an event is investigated, which type of data provides the investigate capability to determine if data exfiltration has occurred?

Options:

full packet capture

NetFlow data

session data

firewall logs

Answer

Explanation

Full packet capture provides the complete recording of all the packets that are transmitted over the network. This data is essential for in-depth analysis during an investigation, as it allows investigators to reconstruct the session, observe the content of the traffic, and determine if data exfiltration has occurred.

[: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) study materials would typically cover the importance of full packet capture in network forensics and incident response., ]

Questions # 117:

What are two differences between tampered disk images and untampered disk images'? (Choose two.)

Options:

Tampered Images are used in a security investigation process

Untampered images can be used as law enforcement evidence.

The image is untampered if the existing stored hash matches the computed one

The image is tampered if the stored hash and the computed hash are identical

Tampered images are used as an element for the root cause analysis report

Answer

C, E

Explanation

An untampered disk image is one that has not been altered since its creation. This is verified by comparing the stored hash of the image at the time of creation with a newly computed hash; if they match, the image is considered untampered. Tampered images, on the other hand, may be used during the root cause analysis process to understand how and what was altered12. References: The differences between tampered and untampered disk images are discussed in cybersecurity literature, including Cisco’scertification guides, which explain the importance of hash matching for verifying the integrity of disk images

Questions # 118:

Refer to the exhibit.

Question # 118

What does this output indicate?

Options:

HTTPS ports are open on the server.

SMB ports are closed on the server.

FTP ports are open on the server.

Email ports are closed on the server.

Answer

Explanation

What Are Ports 139 And 445? SMB has always been a network file sharing protocol. As such, SMB requires network ports on a computer or server to enable communication to other systems. SMB uses either IP port 139 or 445. Port 139 - SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network. Port 445 - Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet. https://www.varonis.com/blog/smb-port SMB Ports 139 and 445 are open Email Ports 25 and 110 are closed Therefore "D. Email Ports are closed on the Server."

Questions # 119:

An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?

Options:

The threat actor used a dictionary-based password attack to obtain credentials.

The threat actor gained access to the system by known credentials.

The threat actor used the teardrop technique to confuse and crash login services.

The threat actor used an unknown vulnerability of the operating system that went undetected.

Answer

Explanation

The lack of data visibility needed to detect the attack is caused by the threat actor gaining access to the system by known credentials. This means that the threat actor either obtained the employee’s username and password through phishing, social engineering, or other means, or used a compromised account that had legitimate access to the system. This would explain why there were no suspicious logs, alerts, or failed login attempts, as the threat actor appeared to be a normal user. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html (Module 2, Lesson 2.1.2)

Questions # 120:

Question # 120