Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 361:

  How does rule-based detection differ from behavioral detection?

  A. Rule-based systems have predefined patterns, and behavioral systems learn the patterns that are specific to the environment.
  B. Rule-based systems search for patterns linked to specific types of attacks, and behavioral systems identify attacks per signature.
  C. Behavioral systems have patterns are for complex environments, and rule-based systems can be used on low-mid-sized businesses.
  D. Behavioral systems find sequences that match particular attack behaviors, and rule-based systems identify potential zero-day attacks.
  A. Rule-based systems have predefined patterns, and behavioral systems learn the patterns that are specific to the environment.

  ---

  Explanation

  Rule-based detection systems operate using predefined patterns and signatures to identify known threats. These patterns are based on prior knowledge of attack methods and vulnerabilities. Behavioral detection systems, on the other hand, analyze the normal behavior of a network or system to establish a baseline. They then monitor for deviations from this baseline, which may indicate potential threats. Rule-based systems are effective at detecting known threats but may struggle with novel or zero-day attacks that do not match existing signatures. Behavioral systems can detect unknown threats by recognizing abnormal activities, making them useful in identifying zero-day exploits and other sophisticated attacks.

  References

  Comparison of Rule-based and Behavioral Detection Methods in IDS Advantages of Behavioral Analysis in Network Security Cybersecurity Detection Techniques

• Question 362:

  A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property.

  What is the threat agent in this situation?

  A. the intellectual property that was stolen
  B. the defense contractor who stored the intellectual property
  C. the method used to conduct the attack
  D. the foreign government that conducted the attack
  D. the foreign government that conducted the attack

  ---

  Explanation

  A threat agent is the entity that is responsible for initiating a threat action that exploits a vulnerability. A threat agent can be a person, a group, an organization, or a system. In this scenario, the threat agent is the foreign government that hacked the defense contractor and stole the intellectual property. The threat agent's motivation, capability, and resources determine the level of threat they pose to the target.

  References:

  Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 1-3

  200-201 CBROPS - Cisco, exam topic 1.1.b

• Question 363:

  During which phase of the forensic process are tools and techniques used to extract information from the collected data?

  A. investigation
  B. examination
  C. reporting
  D. collection
  D. collection

• Question 364:

  An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load.

  What is the next step the engineer should take to investigate this resource usage?

  A. Run "ps -d" to decrease the priority state of high load processes to avoid resource exhaustion.
  B. Run "ps -u" to find out who executed additional processes that caused a high load on a server.
  C. Run "ps -ef" to understand which processes are taking a high amount of resources.
  D. Run "ps -m" to capture the existing state of daemons and map required processes to find the gap.
  C. Run "ps -ef" to understand which processes are taking a high amount of resources.

  ---

  Explanation

  When a server is experiencing high CPU and memory load, the first step is to identify the processes that are consuming the most resources. The command "ps -ef" is used to display information about all the running processes, including their IDs, memory and CPU usage, and the commands that started them. This allows the engineer to pinpoint which processes are responsible for the high load and take appropriate action, such as terminating unnecessary processes or optimizing resource usage 345.

  References:

  Various resources on server management and troubleshooting recommend using the "ps -ef" command as a starting point for investigating high resource usage on servers

• Question 365:

  Endpoint logs indicate that a machine has obtained an unusual gateway address and unusual DNS servers via DHCP.

  Which type of attack is occurring?

  A. evasion methods
  B. phishing
  C. man in the middle attack
  D. command injection
  C. man in the middle attack

  ---

  Explanation

  The situation where endpoint logs show a machine receiving an unusual gateway address and DNS servers via DHCP is indicative of a Man-in-the-Middle (MitM) attack, specifically a DHCP spoofing attack. In this type of attack, an adversary can set up a rogue DHCP server or manipulate the DHCP communication to provide false gateway and DNS information to clients. This allows the attacker to intercept, monitor, or manipulate traffic between the client and the intended gateway or DNS servers 2. : Cisco's best practices for network protections and attack identification3, and additional insights on securing networks from DHCP attacks

• Question 366:

  A SOC analyst observed Ursnif malware at the SIEM dashboard. The analyst opened the PCAP file to search the certificate issue data.

  Where must the analyst navigate?

  A. under the rdnSequence line
  B. under the validity line
  C. under the subject
  D. under the signed certificate
  B. under the validity line

• Question 367:

  A SOC analyst observes repeated outbound connections from an internal host to multiple external IP addresses over TCP port 443. The packet payloads cannot be inspected.

  What is the most likely reason for this limitation?

  A. The packets are fragmented
  B. The packets are encrypted
  C. The packets are malformed
  D. The packets are spoofed
  B. The packets are encrypted

  ---

  Explanation

  The inability to inspect packet payloads, especially when traffic is using TCP port 443, is typically due to encryption. Port 443 is commonly associated with HTTPS, which uses TLS/SSL encryption to secure communications between endpoints. Encryption ensures confidentiality and integrity of data, but it also prevents traditional inspection tools from analyzing packet contents. This creates a blind spot for security monitoring tools such as IDS/IPS unless SSL/TLS inspection is implemented. Fragmentation (A) affects packet reassembly but not necessarily visibility of payload content once reassembled. Malformed packets (C) may trigger alerts but are still inspectable. Spoofed packets (D) involve falsified source addresses but do not inherently prevent payload inspection. In cybersecurity operations, encrypted traffic is a known challenge because attackers often leverage it to hide command-and-control communications or data exfiltration activities, making it critical for analysts to rely on metadata and behavioral analysis instead.

• Question 368:

  An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.

  Which testing method did the intruder use?

  A. social engineering
  B. eavesdropping
  C. piggybacking
  D. tailgating
  A. social engineering

• Question 369:

  What is the communication channel established from a compromised machine back to the attacker?

  A. man-in-the-middle
  B. command and control
  C. IDS evasion
  D. port scanning
  B. command and control

• Question 370:

  A security analyst reviews the firewall and observes the large number of frequent events.

  The analyst starts the packet capture with the Wireshark and identifies that TCP port reuse was detected incorrectly as a TCP split-handshake attack by the firewall.

  How must an impact from this event be categorized?

  A. false positive
  B. true positive
  C. true negative
  D. false negative
  B. true positive