Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CyberOps Associate
200-201
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Questions and Answers

Pass the Cisco CyberOps Associate 200-201 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 200-201 Premium Access

View all detail and faqs for the 200-201 exam

Go to Exam

794 Students Passed

89% Average Score

95% Same Questions

Viewing page 5 out of 15 pages

Viewing questions 41-50 out of questions

Questions # 41:

Which items is an end-point application greylist used?

Options:

Items that have been established as malicious

Items that have been established as authorized

Items that have been installed with a baseline

Items before being established as harmful or malicious

Answer

Explanation

A greylist in endpoint applications refers to a list of items that are not yet classified as either good (whitelisted) or bad (blacklisted).

The primary function of a greylist is to hold applications, processes, or files that are under observation due to their unknown status.

These items are neither trusted nor immediately flagged as harmful, allowing security teams to monitor them closely for any suspicious behavior.

By placing items on a greylist, security operations can prevent potential threats without disrupting legitimate processes, awaiting further analysis to determine their true nature.

References

Cisco Cybersecurity Operations Fundamentals

Endpoint Security Best Practices

Greylisting Concepts in Cybersecurity

Questions # 42:

According to the NIST SP 800-86. which two types of data are considered volatile? (Choose two.)

Options:

swap files

temporary files

dump files

free space

Answer

A, C

Explanation

Volatile data is information that is stored in memory or other temporary storage that is lost when the power is turned off or lost. According to NIST SP 800-86, login sessions and swap files are considered volatile because they exist in the system’s memory and can be lost or changed rapidly

Questions # 43:

According to CVSS, which condition is required for attack complexity metrics?

Options:

man-in-the-middle attack

attackers altering any file

complete loss of protection

total loss of availability

Answer

Questions # 44:

Refer to the exhibit.

Question # 44

Which attack is being attempted against a web application?

Options:

SQL injection

man-in-the-middle

command injection

denial of service

Answer

Explanation

The exhibit shows an HTTP GET request with a parameter that includes; /bin/sh -c id.

This indicates a command injection attempt, where the attacker is trying to execute shell commands on the server.

Command injection vulnerabilities allow an attacker to execute arbitrary commands on the host operating system via a vulnerable application.

The use of/bin/shand the-cflag is typical in command injection exploits to run shell commands, such asid, which returns user identity information.

References

OWASP Command Injection

Analyzing HTTP Requests for Injection Attacks

Web Application Security Testing Guidelines

Questions # 45:

Refer to the exhibit.

Question # 45

What kind of activity occurs in the network?

Options:

TCP reset attack

DNS redirect attack

DNS flood

UDP flood

Answer

Questions # 46:

An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.

Question # 46

Which obfuscation technique is the attacker using?

Options:

Base64 encoding

TLS encryption

SHA-256 hashing

ROT13 encryption

Answer

Questions # 47:

What are indicators of attack?

Options:

large numbers of requests for the same file

multiple tog ins from different regions

swells in database read volume

suspicious registry or system file changes

Answer

Questions # 48:

Refer to the exhibit.

Question # 48

What must be interpreted from this packet capture?

Options:

IP address 192.168.88 12 is communicating with 192 168 88 149 with a source port 74 to destination port 49098 using TCP protocol

IP address 192.168.88.12 is communicating with 192 168 88 149 with a source port 49098 to destination port 80 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.

Answer

Explanation

The packet capture shows that IP address 192.168.88.149, using source port 80 (common for HTTP traffic), initiated communication with IP address 192.168.88.12 at destination port 49098, using the TCP protocol, indicating a typical client-server interaction over the web.

[: = These explanations are based on general cybersecurity principles as outlined in Cisco’s training and certification content, such as the Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) and other related Cisco resources., ]

Questions # 49:

Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

Options:

forgery attack

plaintext-only attack

ciphertext-only attack

meet-in-the-middle attack

Answer

Explanation

When a stream cipher like RC4 is used twice with the same key, it becomes vulnerable to a ciphertext-only attack. In this type of attack, the attacker has access to several ciphertexts that are encrypted with the same key but does not know anything about the plaintexts. By analyzing these ciphertexts, an attacker can gain insights into the plaintext or even recover parts or all of it. References := Cisco Cybersecurity source documents or study guide (I need to search for specific references as I don’t have direct access to Cisco’s proprietary content)

Questions # 50:

Which difficulty occurs when log messages are compared from two devices separated by a Layer 3 device that performs Network Address Translation?