Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 251:

  An engineer must compare NIST vs ISO frameworks. The engineer deeded to compare as readable documentation and also to watch a comparison video review. Using Windows 10 OS. the engineer started a browser and searched for a NIST document and then opened a new tab in the same browser and searched for an ISO document for comparison.

  The engineer tried to watch the video, but there 'was an audio problem with OS so the engineer had to troubleshoot it. At first, the engineer started CMD and looked fee a driver path then locked for a corresponding registry in the registry editor. The engineer enabled "Audiosrv" in task manager and put it on auto start and the problem was solved.

  Which two components of the OS did the engineer touch? (Choose two)

  A. permissions
  B. PowerShell logs
  C. service
  D. MBR
  E. process and thread
  C. service
  E. process and thread

• Question 252:

  Refer to the exhibit.

  

  A suspicious IP address is tagged by Threat Intelligence as a brute-force attempt source. After the attacker produces many of failed login entries it successfully compromises the account.

  Which stakeholder is responsible for the incident response detection step?

  A. employee 2
  B. employee 3
  C. employee 4
  D. employee 5
  C. employee 4

• Question 253:

  Refer to the exhibit.

  

  Which type of attack is being executed?

  A. SQL injection
  B. cross-site scripting
  C. cross-site request forgery
  D. command injection
  A. SQL injection

  ---

  Explanation

  References:

  https://www.w3schools.com/sql/sql_injection.asp

• Question 254:

  Which action matches the weaponization step of the Cyber Kill Chain model?

  A. Research data on a specific vulnerability.
  B. Test and construct the appropriate malware to launch the attack.
  C. Scan a host to find open ports and vulnerabilities.
  D. Construct the appropriate malware and deliver it to the victim.
  B. Test and construct the appropriate malware to launch the attack.

• Question 255:

  Where is a host-based intrusion detection system located?

  A. on a dedicated proxy server monitoring egress traffic
  B. on a tap switch port
  C. on a span switch port
  D. on an end-point as an agent
  D. on an end-point as an agent

• Question 256:

  What is the key difference between mandatory access control (MAC) and discretionary access control (DAC)?

  A. MAC is controlled by the discretion of the owner and DAC is controlled by an administrator
  B. MAC is the strictest of all levels of control and DAC is object-based access
  C. DAC is controlled by the operating system and MAC is controlled by an administrator
  D. DAC is the strictest of all levels of control and MAC is object-based access
  B. MAC is the strictest of all levels of control and DAC is object-based access

• Question 257:

  What is the difference between a vulnerability and an attack surface?

  A. A vulnerability is the risk of exploiting a weakness in the application, and the target application itself is the attack surface
  B. The attack surface is the SQL injection targeted on the database, and the database is the vulnerability that might be exploited.
  C. The attack surface is a sum of measured risks for a particular asset, and the vulnerability is an unmeasured exploitable risk
  D. A vulnerability is unsanitized user input sent to exploit a web application and the browser is the attack surface for the web application
  A. A vulnerability is the risk of exploiting a weakness in the application, and the target application itself is the attack surface

• Question 258:

  Which layer of the OSI model is responsible for deep packet inspection in modern firewalls?

  A. data link
  B. network
  C. transport
  D. application
  D. application

  ---

  Explanation

  Deep packet inspection (DPI) operates at the application layer (Layer 7) of the OSI model. Unlike traditional packet filtering or stateful inspection that focuses on header information at Layers 3 and 4, DPI analyzes the actual payload of packets. This allows security devices to identify specific applications, detect malicious content, and enforce granular security policies. For example, DPI can inspect HTTP traffic to detect embedded malware or identify suspicious patterns such as command-and-control communications. Data link (A) and network (B) layers handle frame and IP addressing, respectively, while the transport layer (C) manages ports and sessions but does not inspect payload content. DPI is essential for identifying advanced threats that use legitimate protocols to bypass traditional defenses. However, it is resource-intensive and may face limitations when traffic is encrypted, requiring SSL/TLS decryption capabilities for full visibility.

• Question 259:

  A security engineer must investigate a recent breach within the organization. An engineer noticed that a breached workstation is trying to connect to the domain "Ranso4730- mware92-647". which is known as malicious.

  In which step of the Cyber Kill Chain is this event?

  A. Vaporization
  B. Delivery
  C. reconnaissance
  D. Action on objectives
  D. Action on objectives

  ---

  Explanation

  The event where a breached workstation is trying to connect to a known malicious domain suggests that the attacker is moving towards their end goals, which typically involves actions on objectives. In the Cyber Kill Chain framework, "Action on objectives" refers to the steps taken by an attacker to achieve their intended outcomes, such as data exfiltration, destruction, or ransom demands. This phase involves the attacker executing their final mission within the target environment, leveraging access gained in earlier stages of the attack.

  References

  Lockheed Martin Cyber Kill Chain

  Understanding the Stages of Cyber Attacks Incident Response and the Cyber Kill Chain

• Question 260:

  According to the September 2020 threat intelligence feeds a new malware called Egregor was introduced and used in many attacks. Distnbution of Egregor is pnmanly through a Cobalt Strike that has been installed on victim's workstations using RDP exploits Malware exfiltrates the victim's data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it.

  Which type of attack is described?

  A. malware attack
  B. ransomware attack
  C. whale-phishing
  D. insider threat
  B. ransomware attack