Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 261:

  

  Refer to exhibit. An engineer is investigating an intrusion and is analyzing the pcap file.

  Which two key elements must an engineer consider? (Choose two.)

  A. variable "info" field and unchanging sequence number
  B. high volume of SYN packets with very little variance in time
  C. SYN packets acknowledged from several source IP addresses
  D. identical length of 120 and window size (64)
  E. same source IP address with a destination port 80
  B. high volume of SYN packets with very little variance in time
  C. SYN packets acknowledged from several source IP addresses

  ---

  Explanation

  The exhibit shows a pcap file capturing multiple TCP SYN packets directed at the same destination IP address.

  High volume of SYN packets with very little variance in time: This pattern is indicative of a SYN flood attack, a type of Denial of Service (DoS) attack where numerous SYN requests are sent to overwhelm the target system. SYN packets acknowledged from several source IP addresses: This can be indicative of a Distributed Denial of Service (DDoS) attack where multiple compromised hosts (botnet) are used to generate traffic. These characteristics suggest that the network is under a SYN flood or DDoS attack, aiming to exhaust the target's resources and disrupt service availability.

  References

  Understanding SYN Flood Attacks

  Analysis of DDoS Attack Patterns Wireshark Analysis Techniques for Intrusion Detection

• Question 262:

  What is the definition of threat intelligence in the context of cybersecurity?

  A. Update and hardening of IT infrastructure
  B. Design and implementation of advanced defense mechanisms
  C. Information and analysis related to potential security threats
  D. Design and delivery of sophisticated cyberattacks
  D. Design and delivery of sophisticated cyberattacks

• Question 263:

  A company encountered a breach on its web servers using IIS 7 5 Dunng the investigation, an engineer discovered that an attacker read and altered the data on a secure communication using TLS 1 2 and intercepted sensitive information by downgrading a connection to export-grade cryptography. The engineer must mitigate similar incidents in the future and ensure that clients and servers always negotiate with the most secure protocol versions and cryptographic parameters.

  Which action does the engineer recommend?

  A. Upgrade to TLS v1 3.
  B. Install the latest IIS version.
  C. Downgrade to TLS 1.1.
  D. Deploy an intrusion detection system
  A. Upgrade to TLS v1 3.

• Question 264:

  A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.

  Which type of evidence is this?

  A. best evidence
  B. prima facie evidence
  C. indirect evidence
  D. physical evidence
  C. indirect evidence

  ---

  Explanation

  Indirect evidence is evidence that does not directly prove a fact, but rather implies or infers it from other facts or circumstances. Indirect evidence is also known as circumstantial evidence or corroborating evidence. A video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor is an example of indirect evidence, because it does not directly show that the suspect was involved in the file transfer, but rather suggests a possible connection or correlation between the two events.

  References:

  Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 5: Security Policies and Procedures, Lesson 5.3: Digital Forensics, Topic 5.3.1: Evidence, page 5-24.

• Question 265:

  Refer to the exhibit.

  

  A company's user HTTP connection to a malicious site was blocked according to configured policy.

  What is the source technology used for this measure?

  A. network application control
  B. firewall
  C. IPS
  D. web proxy
  C. IPS

• Question 266:

  Refer to the exhibit.

  

  Which set of actions must an engineer perform to identify and fix this issue?

  A. Reinstall the IIS server to reset certificate details to default and try to connect to the server.
  B. Remove the intermediate certificates and install the CA root certificate on each server.
  C. Implement a different version of CA authority and install intermediate certificates.
  D. Add client authentication to the certificate template, reissue, and apply the certificate.
  D. Add client authentication to the certificate template, reissue, and apply the certificate.

• Question 267:

  An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts.

  What is causing the lack of data visibility needed to detect the attack?

  A. The threat actor used a dictionary-based password attack to obtain credentials.
  B. The threat actor gained access to the system by known credentials.
  C. The threat actor used the teardrop technique to confuse and crash login services.
  D. The threat actor used an unknown vulnerability of the operating system that went undetected.
  B. The threat actor gained access to the system by known credentials.

• Question 268:

  What is a description of a man-in-the-middle network attack?

  A. After attackers penetrate a network, they can use privilege escalation to expand their reach.
  B. Attackers build botnets, large fleets of compromised devices, and use them to direct false traffic at networks or servers.
  C. It involves attackers intercepting traffic, either between a network and external sites or within a network.
  D. Attackers replicate malicious traffic as legitimate and bypass network protection solutions.
  C. It involves attackers intercepting traffic, either between a network and external sites or within a network.

• Question 269:

  What are two denial-of-service (DoS) attacks? (Choose two)

  A. port scan
  B. SYN flood
  C. man-in-the-middle
  D. phishing
  E. teardrop
  B. SYN flood
  E. teardrop

  ---

  Explanation

  Teardrop is a type of DoS attack where an attacker sends fragmented packets with overlapping offsets to a target system, causing it to crash or become unresponsive. SYN flood is another type of DoS attack where an attacker sends a large number of SYN packets to a target system, overwhelming its ability to respond to legitimate connection requests and causing it to become unresponsive.

• Question 270:

  According to CVSS, what is a description of the attack vector score?

  A. It depends on how far away the attacker is located and the vulnerable component.
  B. The metric score will be larger when a remote attack is more likely.
  C. It depends on how many physical and logical manipulations are possible on a vulnerable component.
  D. The metric score will be larger when it is easier to physically touch or manipulate the vulnerable component.
  B. The metric score will be larger when a remote attack is more likely.