Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 91:

  Which security monitoring data type requires the largest storage space?

  A. transaction data
  B. statistical data
  C. session data
  D. full packet capture
  D. full packet capture

• Question 92:

  Which type of data collection requires the largest amount of storage space?

  A. alert data
  B. transaction data
  C. session data
  D. full packet capture
  D. full packet capture

• Question 93:

  According to CVSS, which condition is required for attack complexity metrics?

  A. man-in-the-middle attack
  B. attackers altering any file
  C. complete loss of protection
  D. total loss of availability
  A. man-in-the-middle attack

• Question 94:

  For which items is an end-point application greylist used?

  A. items that have been installed with a baseline
  B. items that have been established as malicious
  C. items before being established as harmful or malicious
  D. items that have been established as authorized
  C. items before being established as harmful or malicious

• Question 95:

  What is the role of NAT in data visibility?

  A. load balancing
  B. hiding IP addresses
  C. web filtering
  D. encrypting files
  B. hiding IP addresses

• Question 96:

  Which element is included in an incident response plan as stated in NIST.SP800-617

  A. security of sensitive information
  B. individual approach to incident response
  C. consistent threat identification
  D. approval of senior management
  D. approval of senior management

• Question 97:

  A member of the SOC team is checking the dashboard provided by the Cisco Firepower Manager for further Isolation actions.

  According to NIST SP800-61, in which phase of incident response is this action?

  A. Cost-incident activity phase
  B. Preparation phase
  C. Selection and analyze phase
  D. The radiation and recovery phase
  D. The radiation and recovery phase

  ---

  Explanation

  According to NIST SP800-61, the incident response lifecycle consists of four phases: Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. When a SOC team member checks the Cisco Firepower Manager dashboard for further isolation actions, they are working within the Eradication and Recovery phase.

  This phase focuses on removing the threat from the environment and recovering affected systems to normal operations.

  References NIST SP800-61 Computer Security Incident Handling Guide Incident Response Phases Explained

  Role of SOC in Incident Response

• Question 98:

  DRAG DROP

  Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

  Select and Place:

  

  

  ---

  Delivery: This step involves transmitting the weapon to the target. Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities. Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.

• Question 99:

  What is the difference between attack surface and vulnerability?

  A. A vulnerability is a way of taking advantage of a system or resource, and an attack surface is a specific technique utilized by the vulnerability.
  B. An attack surface is a way of taking advantage of a system or resource, and a vulnerability is a specific technique utilized by the vulnerability.
  C. An attack surface describes how software or a system is exposed to potential attacks, and a vulnerability is an actual weakness that exposes the potential risk.
  D. A vulnerability describes how software or a system is exposed to potential attacks, and an attack surface is an actual weakness that exposes the potential risk.
  C. An attack surface describes how software or a system is exposed to potential attacks, and a vulnerability is an actual weakness that exposes the potential risk.

• Question 100:

  What is the role of indicator of compromise in an investigation?

  A. It helps answer the question of why the attack took place.
  B. It identifies potentially malicious activity on a system or network.
  C. It is nonforensic data, which is easy to detect.
  D. It describes what and why something happened.
  B. It identifies potentially malicious activity on a system or network.