Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 331:

  Refer to the exhibit.

  

  What does this Cuckoo sandbox report indicate?

  A. The file is ransomware.
  B. The file is spyware.
  C. The file will open unsecure ports when executed.
  D. The file will open a command interpreter when executed.
  D. The file will open a command interpreter when executed.

• Question 332:

  Refer to the exhibit.

  

  An engineer needs to identify certificate information on server1234567890.

  What does the exhibit indicate?

  A. Elliptic-curve cryptography is used for the public keys.
  B. Key exchange is not secure as the SHA256 hashing algorithm is used.
  C. The certificate is signed by GTS CA on May 24 and is invalid.
  D. Asymmetric cryptography is used for key exchange.
  A. Elliptic-curve cryptography is used for the public keys.

• Question 333:

  What is vulnerability management?

  A. A security practice focused on clarifying and narrowing intrusion points.
  B. A security practice of performing actions rather than acknowledging the threats.
  C. A process to identify and remediate existing weaknesses.
  D. A process to recover from service interruptions and restore business-critical applications
  C. A process to identify and remediate existing weaknesses.

  ---

  Explanation

  References:

  https://www.brinqa.com/vulnerability-management-primer-part-2-challenges/Vulnerability

  management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities.[1] Vulnerability management is integral to computer security and network security, and must not be confused with Vulnerability assessment" source: (https://en.wikipedia.org/wiki/Vulnerability_management)

• Question 334:

  Refer to the exhibit.

  

  Which frame numbers contain a file that is extractable from Wireshark PCAP?

  A. Frames No. 20064 and 20066
  B. Frame No. 20064
  C. Frame No. 20086
  D. All Frames from No. 20061 to 20064
  D. All Frames from No. 20061 to 20064

  ---

  Explanation

  D. All Frames from No. 20061 to 20064 Here's why: Frame 20061: This frame shows the beginning of a TCP reassembled PDU (Packet Data Unit) with a length of 60512 bytes. This suggests that a file transfer is starting. Frame 20062: This frame continues the reassembled PDU, indicating that the file transfer is ongoing. Frame 20063: This frame shows the end of the reassembled PDU with a "TCP segment of a reassembled PDU" label, confirming that the file transfer is complete. Frame 20064: This frame shows a 75-byte payload identified as "Protected Payload (KPO), DCID-094e3bea2bcfbcce". This suggests that the extracted file might be encrypted or obfuscated in some way. Frames 20065 and 20066 show subsequent traffic related to HTTP and QUIC protocols, but not directly related to the file transfer initiated in frame 20061. Therefore, all frames from 20061 to 20064, including the reassembled PDU and the protected payload, are likely to contain the extractable file.

• Question 335:

  Refer to the exhibit.

  

  Which field contains DNS header information if the payload is a query or a response?

  A. Z
  B. ID
  C. TC
  D. QR
  B. ID

• Question 336:

  What is the purpose of command and control for network-aware malware?

  A. It controls and shuts down services on the infected host.
  B. It helps the malware to profile the host.
  C. It contacts a remote server for commands and updates.
  D. It takes over the user account for analysis.
  C. It contacts a remote server for commands and updates.

• Question 337:

  A user received a suspicious email and reported it to the SOC team. After analysis, the team concluded that it was a spear phishing attack.

  According to the Diamond Model, how is the phishing email categorized?

  A. capability
  B. infrastructure
  C. adversary
  D. victim
  A. capability

• Question 338:

  Refer to the exhibit.

  

  An engineer received an event log file to review.

  Which technology generated the log?

  A. NetFlow
  B. proxy
  C. firewall
  D. IDS/IPS
  C. firewall

• Question 339:

  A security engineer must determine why a new core application does not work as desired.

  The client can send requests toward the application server but receives no response.

  One of the requirements is to gather all packets Data needs to be reliable without any delay or packet drops.

  Which solution best meets this need?

  A. 3 device logs
  B. span port
  C. port mirroring
  D. tap device
  B. span port

• Question 340:

  Which risk approach eliminates activities posing a risk exposure?

  A. risk acknowledgment
  B. risk reduction
  C. risk retention
  D. risk avoidance
  D. risk avoidance