Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CyberOps Associate
200-201
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Questions and Answers

Pass the Cisco CyberOps Associate 200-201 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 200-201 Premium Access

View all detail and faqs for the 200-201 exam

Go to Exam

794 Students Passed

89% Average Score

95% Same Questions

Viewing page 13 out of 15 pages

Viewing questions 121-130 out of questions

Questions # 121:

Refer to the exhibit.

Question # 121

A security analyst is investigating unusual activity from an unknown IP address Which type of evidence is this file1?

Options:

indirect evidence

best evidence

corroborative evidence

direct evidence

Answer

Explanation

The file in question, which contains logs of unsuccessful login attempts from an unknown IP address, is considered indirect evidence. It suggests that there may have been an attempt to gain unauthorized access, but it does not directly prove who was responsible for the attempts. Indirect evidence can be used to support other evidence that may lead to a direct identification of the threat actor. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) and other Cisco cybersecurity resources provide information on how to analyze and categorize different types of evidence in the context of security incidents.

Questions # 122:

What is the difference between authentication and authorization?

Options:

Authorization is used by a server when the server needs to know exactly who is accessing resources, and authentication is a process by which a server determines the permissions.

Authorization allows an engineer to control the user access level privileges to the router, and authentication is the process of giving the user-specific permissions.

Authentication is coupled with authorization so that the server knows who the requestor is, and authorization is used by a requestor that knows the server.

Authentication allows an engineer to identify who can connect to a router, and authorization is the function of specifying access rights and privileges to resources.

Answer

Questions # 123:

What is a difference between SIEM and SOAR?

Options:

SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

SlEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

SOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

Answer

Explanation

SIEM (Security Information and Event Management) systems are solutions that provide real-time analysis of security alerts generated by applications and network hardware. They collect, store, analyze, and report on log data for incident response, forensics, and regulatory compliance. On the other hand, SOAR (Security Orchestration Automation and Response) platforms allow organizations to collect data about security threats from multiple sources and respond to low-level security events without human assistance. References: Cisco Cybersecurity Operations Fundamentals

[Reference:https://www.cisco.com/c/en/us/products/security/what-is-a-security-platform.html, , , ]

Questions # 124:

Which statement describes patch management?

Options:

scanning servers and workstations for missing patches and vulnerabilities

managing and keeping previous patches lists documented for audit purposes

process of appropriate distribution of system or software updates

workflow of distributing mitigations of newly found vulnerabilities

Answer

Explanation

Patch management is the process of distributing and managing updates to software and systems. These updates can include patches for security vulnerabilities, bug fixes, andenhancements to improve performance or add new features. It ensures that systems are up-to-date, secure, and performing optimally. References := Cisco Cybersecurity Training

Questions # 125:

What is the difference between the rule-based detection when compared to behavioral detection?

Options:

Rule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature.

Rule-Based systems have established patterns that do not change with new data, while behavioral changes.

Behavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags potentially abnormal patterns using signatures.

Behavioral systems find sequences that match a particular attack signature, while Rule-Based identifies potential attacks.

Answer

Explanation

Rule-based detection involves identifying malicious activities based on predefined rules or patterns of known attacks; it does not adapt or change with new data. In contrast, behavioral detection adapts over time by learning from new data; it identifies malicious activities based on deviations from established norms or behaviors. References: CiscoCertified CyberOps Associate Overview, Section 1.0: Security Concepts, Subsection 1.1: Compare and contrast the characteristics of data obtained from taps, NetFlow, and packet capture)

Questions # 126:

A security engineer notices confidential data being exfiltrated to a domain "Ranso4134-mware31-895" address that is attributed to a known advanced persistent threat group The engineer discovers that the activity is part of a real attack and not a network misconfiguration. Which category does this event fall under as defined in the Cyber Kill Chain?

Options:

reconnaissance

delivery

action on objectives

weaponization

Answer

Explanation

The event described falls under the ‘action on objectives’ category of the Cyber Kill Chain. This stage occurs after the attacker has established a foothold within the network and begins to execute their intended actions, such as data exfiltration. References: The Cyber Kill Chain framework outlines the stages of a cyberattack, with ‘action onobjectives’ being the final step where attackers achieve their primary goal, such as data theft

Questions # 127:

What specific type of analysis is assigning values to the scenario to see expected outcomes?

Options:

deterministic

exploratory

probabilistic

descriptive

Answer

Explanation

This type of analysis is deterministic because it assigns fixed values to the scenario and calculates the expected outcomes based on those values. Deterministic analysis does not account for uncertainty or randomness in the scenario. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html (Module 3, Lesson 3.1.2)

Questions # 128:

Drag and drop the access control models from the left onto the correct descriptions on the right.

Question # 128