Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CyberOps Associate
200-201
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Questions and Answers

Pass the Cisco CyberOps Associate 200-201 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 200-201 Premium Access

View all detail and faqs for the 200-201 exam

Go to Exam

794 Students Passed

89% Average Score

95% Same Questions

Viewing page 15 out of 15 pages

Viewing questions 141-150 out of questions

Questions # 141:

Refer to the exhibit.

Question # 141

A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted What is occurring?

Options:

indicators of denial-of-service attack due to the frequency of requests

garbage flood attack attacker is sending garbage binary data to open ports

indicators of data exfiltration HTTP requests must be plain text

cache bypassing attack: attacker is sending requests for noncacheable content

Answer

Explanation

The presence of a default user agent in the headers of requests and data being transmitted suggests a cache bypassing attack. In this scenario, the attacker is likely requesting noncacheable content to avoid detection by caching mechanisms that could otherwise identify and block malicious traffic.

Questions # 142:

Which evasion method involves performing actions slower than normal to prevent detection?

Options:

timing attack

traffic fragmentation

resource exhaustion

tunneling

Answer

Explanation

Traffic fragmentation is an evasion technique where an attacker splits malicious payloads into smaller packets. This can help avoid detection since some security systems may not reassemble these packets to inspect the complete payload.

Questions # 143:

What describes the usage of a rootkit in endpoint based attacks?

Options:

set of tools used by an attacker to maintain control of a compromised system while avoiding detection

exploit that can be used to perform remote code execution

set of vulnerabilities used by an attacker lo disable root access on the system

remote code execution that causes a denial-of-service on the system

Answer

Questions # 144:

Which two elements of the incident response process are stated in NIST SP 800-61 r2? (Choose two.)

Options:

detection and analysis

post-incident activity

vulnerability scoring

vulnerability management

risk assessment

Answer

A, B

Explanation

NIST SP 800-61 r2 outlines a structured incident handling lifecycle composed of four phases: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity. Detection and Analysis involve identifying and investigating incidents, while Post-Incident Activity focuses on lessons learned and evidence retention for future reference.

SP 800-61 Rev. 2, Computer Security Incident Handling Guide | CSRC, Computer Security Incident Handling Guide - NIST, We Read NIST SP 800-61 so You Don’t Have to.

Questions # 145:

What matches the regular expression c(rgr)+e?

Options:

crgrrgre

np+e

c(rgr)e

Answer

Explanation

The regular expression c(rgr)+e matches strings where “rgr” occurs one or more times between “c” and “e”. The string “crgrrgre” fits this pattern as it has the sequence “rgr” repeated twice between “c” and “e”. The plus sign (+) in the regular expression indicates that the preceding element must appear one or more times for a match to occur

Questions # 146:

What is the difference between authentication and authorization?

Options:

Authorization is used by a server when the server needs to know exactly who is accessing resources, and authentication is a process by which a server determines the permissions.

Authorization allows an engineer to control the user access level privileges to the router, and authentication is the process of giving the user-specific permissions.

Authentication is coupled with authorization so that the server knows who the requestor is, and authorization is used by a requestor that knows the server.

Authentication allows an engineer to identify who can connect to a router, and authorization is the function of specifying access rights and privileges to resources.

Answer

Questions # 147:

Refer to the exhibit.

Question # 147

This request was sent to a web application server driven by a database. Which type of web server attack is represented?

Options:

parameter manipulation

heap memory corruption

command injection

blind SQL injection

Answer

Questions # 148:

Refer to the exhibit.

Question # 148

Which type of attack is represented?

Options:

TCP/SYN flooding

UDP flooding

IP flooding

MAC flooding

Answer

Questions # 149:

Question # 149

Refer to the exhibit. Which type of data filtering is provided?

Options:

Web

Firewall

Mail

Application

Answer

Questions # 150:

What are two differences between tampered disk images and untampered disk images'? (Choose two.)

Options:

Tampered Images are used in a security investigation process

Untampered images can be used as law enforcement evidence.

The image is untampered if the existing stored hash matches the computed one

The image is tampered if the stored hash and the computed hash are identical

Tampered images are used as an element for the root cause analysis report

Answer

C, E

Explanation

An untampered disk image is one that has not been altered since its creation. This is verified by comparing the stored hash of the image at the time of creation with a newly computed hash; if they match, the image is considered untampered. Tampered images, on the other hand, may be used during the root cause analysis process to understand how and what was altered12. References: The differences between tampered and untampered disk images are discussed in cybersecurity literature, including Cisco’scertification guides, which explain the importance of hash matching for verifying the integrity of disk images

Viewing page 15 out of 15 pages

Viewing questions 141-150 out of questions