Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Cisco
CyberOps Associate
200-201
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Questions and Answers

Pass the Cisco CyberOps Associate 200-201 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 200-201 Premium Access

View all detail and faqs for the 200-201 exam

Go to Exam

794 Students Passed

89% Average Score

95% Same Questions

Viewing page 7 out of 15 pages

Viewing questions 61-70 out of questions

Questions # 61:

A suspicious user opened a connection from a compromised host inside an organization. Traffic was going through a router and the network administrator was able to identify this flow. The admin was following 5-tuple to collect needed data. Which information was gathered based on this approach?

Options:

direct path

user name

protocol

NAT

Answer

Questions # 62:

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

Options:

Modify the settings of the intrusion detection system.

Design criteria for reviewing alerts.

Redefine signature rules.

Adjust the alerts schedule.

Answer

Explanation

When a system is overwhelmed with alerts, designing criteria for reviewing alerts can help prioritize and manage them more effectively. This approach allows for a structured review process that can distinguish between false positives, false negatives, and legitimate alerts, reducing the overall number of alerts that require attention3.

References := The strategy of designing criteria for reviewing alerts is recommended in cybersecurity best practices to manage alert fatigue and improve the efficiency of security operations3.

Questions # 63:

Refer to the exhibit.

Question # 63

An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server Which display filters should the analyst use to filter the FTP traffic?

Options:

dstport == FTP

tcp.port==21

tcpport = FTP

dstport = 21

Answer

Explanation

The correct display filter for analyzing FTP traffic in a PCAP file is “tcp.port==21”. This filter will show all TCP packets where the port number is 21, which is the standard port for FTP control messages.

Questions # 64:

According to CVSS, what is attack complexity?

Options:

existing exploits available in the wild exploiting the vulnerability

existing circumstances beyond the attacker's control to exploit the vulnerability

number of actions an attacker should perform to exploit the vulnerability

number of patches available for certain attack mitigation and how complex the workarounds are

Answer

Explanation

In the Common Vulnerability Scoring System (CVSS), attack complexity refers to the conditions beyond the attacker’s control that must exist for the vulnerability to be successfully exploited.

This includes factors such as the need for user interaction, the presence of specific configurations, or network conditions that are not easily controlled by the attacker.

A high attack complexity means that these external factors make exploitation more difficult, while a low attack complexity indicates that fewer such conditions are required.

References

CVSS v3.1 Specifications Document

Understanding Attack Complexity in Vulnerability Assessments

Cybersecurity Frameworks and Metrics

Questions # 65:

What is the difference between indicator of attack (loA) and indicators of compromise (loC)?

Options:

loA is the evidence that a security breach has occurred, and loC allows organizations to act before the vulnerability can be exploited.

loA refers to the individual responsible for the security breach, and loC refers to the resulting loss.

loC is the evidence that a security breach has occurred, and loA allows organizations to act before the vulnerability can be exploited.

loC refers to the individual responsible for the security breach, and loA refers to the resulting loss.

Answer

Explanation

Indicators of Compromise (IoC) are pieces of forensic data, such as system log entries or files, that suggest an intrusion may have occurred. Indicators of Attack (IoA) are signs that an attack may be underway, allowing organizations to take action before any potential breach occurs.

[: The CBROPS course materials cover the concepts of IoC and IoA, explaining how they are used in cybersecurity operations to detect and prevent security incidents., , ]

Questions # 66:

Which two elements are used by the defense-in-depth strategy? (Choose two)

Options:

packet segmentation

least privilege principle

single unified security solution

distributed database management system

firewalls

Answer

B, E

Questions # 67:

Which regex matches only on all lowercase letters?

Options:

[a−z]+

[^a−z]+

a−z+

a*z+

Answer

Explanation

The regex [a−z]+ matches one or more lowercase letters from a to z. The plus sign (+) indicates that the preceding character set [a−z] can appear one or more times, thus matching strings of only lowercase letters1.

References := This explanation is consistent with standard regex syntax as described in various programming and scripting languages documentation

Questions # 68:

What is an advantage of symmetric over asymmetric encryption?

Options:

A key is generated on demand according to data type.

A one-time encryption key is generated for data transmission

It is suited for transmitting large amounts of data.

It is a faster encryption mechanism for sessions

Answer

Explanation

Symmetric encryption is a type of encryption that uses the same key to encrypt and decrypt data. Asymmetric encryption is a type of encryption that uses a pair of keys: a public key and a private key. The public key can be used to encrypt data, but only the private key can decrypt it, and vice versa. An advantage of symmetric encryption over asymmetric encryption is that it is faster and more efficient for encrypting large amounts of data, such as in sessions or bulk transfers. Asymmetric encryption is slower and more computationally intensive, but it is more secure and suitable for key exchange or digital signatures. References := Cisco Cybersecurity Operations Fundamentals, Module 2: Security Monitoring, Lesson 2.3: Cryptography and PKI, Topic 2.3.1: Cryptography

Questions # 69:

What is the difference between the ACK flag and the RST flag in the NetFlow log session?

Options:

The RST flag confirms the beginning of the TCP connection, and the ACK flag responds when the data for the payload is complete

The ACK flag confirms the beginning of the TCP connection, and the RST flag responds when the data for the payload is complete

The RST flag confirms the receipt of the prior segment, and the ACK flag allows for the spontaneous termination of a connection

The ACK flag confirms the receipt of the prior segment, and the RST flag allows for the spontaneous termination of a connection

Answer

Explanation

In NetFlow log sessions within TCP connections; ACK flag is used for acknowledging that data has been successfully received while RST flag is used when there’s an error or when closing a connection spontaneously without following standard procedures. References := Cisco Cybersecurity source documents or study guide

Questions # 70:

Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

Options:

syslog messages

full packet capture

NetFlow

firewall event logs

Answer

Explanation

NetFlow provides a more efficient way of recording and analyzing network traffic patterns over an extended period of time compared to syslog messages, full packet capture, or firewall event logs. It collects metadata about traffic flows traversing the network devices which can be used for understanding normal baseline behavior as well as identifying anomalies. References := Cisco Certified CyberOps Associate Overview

Viewing page 7 out of 15 pages

Viewing questions 61-70 out of questions