Cisco CyberOps Associate 200-201 Questions & Answers

• Question 201:

  What is a benefit of agent-based protection when compared to agentless protection?

  A. It lowers maintenance costs

  B. It provides a centralized platform

  C. It collects and detects all traffic locally

  D. It manages numerous devices simultaneously

  Correct Answer: C

  Host-based antivirus protection is also known as agent-based. Agent-based antivirus runs on every protected machine. Agentless antivirus protection performs scans on hosts from a centralized system. Agentless systems have become popular for virtualized environments in which multiple OS instances are running on a host simultaneously. Agent-based antivirus running in each virtualized system can be a serious drain on system resources. Agentless antivirus for virtual hosts involves the use of a special security virtual appliance that performs optimized scanning tasks on the virtual hosts. An example of this is VMware's vShield.

• Question 202:

  Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

  A. integrity

  B. confidentiality

  C. availability

  D. scope

  Correct Answer: A

• Question 203:

  Refer to the exhibit.

  

  An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

  A. The file will appear legitimate by evading signature-based detection.

  B. The file will not execute its behavior in a sandbox environment to avoid detection.

  C. The file will insert itself into an application and execute when the application is run.

  D. The file will monitor user activity and send the information to an outside source.

  Correct Answer: B

• Question 204:

  Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

  A. Hypertext Transfer Protocol

  B. SSL Certificate

  C. Tunneling

  D. VPN

  Correct Answer: B

• Question 205:

  What is obtained using NetFlow?

  A. session data

  B. application logs

  C. network downtime report

  D. full packet capture

  Correct Answer: A

• Question 206:

  Refer to the exhibit.

  

  Which application protocol is in this PCAP file?

  A. SSH

  B. TCP

  C. TLS

  D. HTTP

  Correct Answer: C

• Question 207:

  What are two denial of service attacks? (Choose two.)

  A. MITM

  B. TCP connections

  C. ping of death

  D. UDP flooding

  E. code red

  Correct Answer: CD

• Question 208:

  Which two elements are used for profiling a network? (Choose two.)

  A. session duration

  B. total throughput

  C. running processes

  D. listening ports

  E. OS fingerprint

  Correct Answer: AB

  A network profile should include some important elements, such as the following:

  Total throughput the amount of data passing from a given source to a given destination in a given period of time Session duration the time between the establishment of a data flow and its termination Ports used a list of TCP or UDP processes that are available to accept data Critical asset address space the IP addresses or the logical location of essential systems or data Profiling data are data that system has gathered, these data helps for incident response and to detect incident Network profiling = throughput, sessions duration, port used, Critical Asset Address Space Host profiling = Listening ports, logged in accounts, running processes, running tasks,applications

• Question 209:

  What is the difference between statistical detection and rule-based detection models?

  A. Rule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time

  B. Statistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis

  C. Statistical detection involves the evaluation of an object on its intended actions before it executes that behavior

  D. Rule-based detection defines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis

  Correct Answer: B

• Question 210:

  How does TOR alter data content during transit?

  A. It spoofs the destination and source information protecting both sides.

  B. It encrypts content and destination information over multiple layers.

  C. It redirects destination traffic through multiple sources avoiding traceability.

  D. It traverses source traffic through multiple destinations before reaching the receiver

  Correct Answer: B