Cisco CyberOps Associate 200-201 Questions & Answers

• Question 21:

  Refer to the exhibit.

  

  What is the potential threat identified in this Stealthwatch dashboard?

  A. A policy violation is active for host 10.10.101.24.

  B. A host on the network is sending a DDoS attack to another inside host.

  C. There are three active data exfiltration alerts.

  D. A policy violation is active for host 10.201.3.149.

  Correct Answer: C

  "EX" = exfiltration

  And there are three.

  Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration

  https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/management_console/sm c_users_guide/SW_6_9_0_SMC_Users_Guide_DV_1_2.pdf page 177.

• Question 22:

  What is a difference between data obtained from Tap and SPAN ports?

  A. Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.

  B. SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times.

  C. SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility.

  D. Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination

  Correct Answer: D

  Reference: https://www.gigamon.com/resources/resource-library/white-paper/to-tap-or-to-span.html

• Question 23:

  Which metric is used to capture the level of access needed to launch a successful attack?

  A. privileges required

  B. user interaction

  C. attack complexity

  D. attack vector

  Correct Answer: D

  Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200201 Chapter7:

  Introduction to Security Operations Management.

• Question 24:

  What is a difference between tampered and untampered disk images?

  A. Tampered images have the same stored and computed hash.

  B. Tampered images are used as evidence.

  C. Untampered images are used for forensic investigations.

  D. Untampered images are deliberately altered to preserve as evidence

  Correct Answer: B

• Question 25:

  Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

  A. resource exhaustion

  B. tunneling

  C. traffic fragmentation

  D. timing attack

  Correct Answer: A

  Resource exhaustion is a type of denial-of-service attack; however, it can also be used to evade detection by security defenses. A simple definition of resource exhaustion is "consuming the resources necessary to perform an action." Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide

• Question 26:

  A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.

  Which technology should be used to accomplish this task?

  A. application whitelisting/blacklisting

  B. network NGFW

  C. host-based IDS

  D. antivirus/antispyware software

  Correct Answer: A

• Question 27:

  Which event is a vishing attack?

  A. obtaining disposed documents from an organization

  B. using a vulnerability scanner on a corporate network

  C. setting up a rogue access point near a public hotspot

  D. impersonating a tech support agent during a phone call

  Correct Answer: D

  Reference: https://www.cisco.com/c/en/us/products/security/email-security/what-is-phishing.html#~types-of-phishing-attacks

• Question 28:

  Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

  A. detection and analysis

  B. post-incident activity

  C. vulnerability management

  D. risk assessment

  E. vulnerability scoring

  Correct Answer: AB

  Reference: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

• Question 29:

  Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

  A. src=10.11.0.0/16 and dst=10.11.0.0/16

  B. ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16

  C. ip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16

  D. src==10.11.0.0/16 and dst==10.11.0.0/16

  Correct Answer: B

• Question 30:

  Which attack represents the evasion technique of resource exhaustion?

  A. SQL injection

  B. man-in-the-middle

  C. bluesnarfing

  D. denial-of-service

  Correct Answer: D

  Reference: https://www.ciscopress.com/articles/article.asp?p=3100055andseqNum=3