Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 1:

  DRAG DROP

  Refer to the exhibit.

  

  Drag and drop the element names from the left onto the corresponding pieces of the PCAP file on the right.

  Select and Place:

  

  

• Question 2:

  DRAG DROP

  Cisco's Zero Trust Architecture simplifies the Zero Trust journey into three critical areas. Drag the definitions onto the graphic to describe Zero Trust from the Cisco perspective.

  Select and Place:

  

  

• Question 3:

  DRAG DROP

  Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

  Select and Place:

  

  

  ---

  explanation:

  Delivery: This step involves transmitting the weapon to the target. Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities. Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.

• Question 4:

  DRAG DROP

  Drag and drop the data source from the left onto the data type on the right.

  Select and Place:

  

  

• Question 5:

  DRAG DROP

  Drag and drop the event term from the left onto the description on the right.

  Select and Place:

  

  

• Question 6:

  DRAG DROP

  Drag and drop the type of evidence from the left onto the description of that evidence on the right.

  Select and Place:

  

  

• Question 7:

  DRAG DROP

  Drag and drop the security concept from the left onto the example of that concept on the right.

  Select and Place:

  

  

• Question 8:

  DRAG DROP

  Drag and drop the elements from the left into the correct order for incident handling on the right.

  Select and Place:

  

  

• Question 9:

  Refer to the exhibit.

  

  A SOC team member receives a case from his colleague with notes attached. The artifacts and alerts associated with the case must be analyzed and a conclusion must be provided. What is the cause of the alert?

  A. An insider threat compromised the service account to delete sensitive data.
  B. External attackers gained access and are exfiltrating data stealthily.
  C. A ransomware attack is underway, encrypting files and deleting originals.
  D. A misconfigured backup process malfunctioned, causing unexpected file changes.
  C. A ransomware attack is underway, encrypting files and deleting originals.

  ---

  explanation: Explanation Explanation/Reference:

• Question 10:

  A software development company develops high-end technology for the customer that will go through the HIPAA audit program. The technology will be hosted in the cloud, and the healthcare, employee names, and contact information will be

  stored on two separate logically isolated private cloud services. The patents and inventions will be hosted on a separate encrypted database. A compliance team is asked to analyze the cloud infrastructure and architecture to identify the

  protected data.

  Which two types of protected data should be identified? (Choose two.)

  A. Federated Identity ID (FII)
  B. Protected Health Information (PHI)
  C. Personally Identifiable Information (PII)
  D. Payment Card Industry (PCI)
  E. Self-sovereign Identity (SSI)
  B. Protected Health Information (PHI)
  C. Personally Identifiable Information (PII)