Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 451:

  Refer to the exhibit.

  

  What is occurring in this network?

  A. ARP cache poisoning
  B. DNS cache poisoning
  C. MAC address table overflow
  D. MAC flooding attack
  A. ARP cache poisoning

• Question 452:

  Which type of data must an engineer capture to analyze payload and header information?

  A. full packet
  B. frame check sequence
  C. alert data
  D. session logs
  A. full packet

• Question 453:

  Refer to the exhibit.

  

  A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted.

  What is occurring?

  A. indicators of denial-of-service attack due to the frequency of requests
  B. garbage flood attack attacker is sending garbage binary data to open ports
  C. indicators of data exfiltration HTTP requests must be plain text
  D. cache bypassing attack: attacker is sending requests for noncacheable content
  D. cache bypassing attack: attacker is sending requests for noncacheable content

• Question 454:

  The security team has detected an ongoing spam campaign targeting the organization. The team's approach is to push back the cyber kill chain and mitigate ongoing incidents.

  At which phase of the cyber kill chain should the security team mitigate this type of attack?

  A. actions
  B. delivery
  C. reconnaissance
  D. installation
  B. delivery

  ---

  Explanation

  The cyber kill chain is a framework that describes the stages of a typical cyber attack. These stages include reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions/objectives.

  In the context of a spam campaign, the delivery phase is where the malicious emails are sent to the target recipients. This phase involves the actual transmission or delivery of the spam emails to the victims' email accounts. It is during this phase that the security team should focus on mitigating the attack by implementing measures to detect and block the malicious emails, such as filtering or blocking techniques, spam detection mechanisms, and email security controls.

  By addressing the attack at the delivery phase, the security team aims to prevent the spam emails from reaching the intended recipients, thereby reducing the potential impact and mitigating the ongoing incidents related to the spam campaign.

• Question 455:

  Refer to the exhibit.

  

  What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

  A. insert TCP subdissectors
  B. extract a file from a packet capture
  C. disable TCP streams
  D. unfragment TCP
  B. extract a file from a packet capture

  ---

  Explanation

  Enabling the "Allow subdissector to reassemble TCP streams" feature in Wireshark allows the tool to reassemble TCP segments into a contiguous sequence, which can be used by higher-level protocols to reconstruct a full message, such as an HTTP request or response. This is particularly useful for extracting files or data transmitted over TCP that are spread across multiple packets.

  References:

  The explanation is based on the Wireshark documentation, which details how the reassembly feature works and its use in analyzing TCP streams

• Question 456:

  Refer to the exhibit.

  

  An engineer is reviewing a Cuckoo report of a file.

  What must the engineer interpret from the report?

  A. The file will appear legitimate by evading signature-based detection.
  B. The file will not execute its behavior in a sandbox environment to avoid detection.
  C. The file will insert itself into an application and execute when the application is run.
  D. The file will monitor user activity and send the information to an outside source.
  B. The file will not execute its behavior in a sandbox environment to avoid detection.

• Question 457:

  An analyst see that this security alert "Default-Botnet-Communication-Detection-By-Endpoint" has been raised from the IPS. The analyst checks and finds that an endpoint communicates to the C&C.

  How must an impact from this event be categorized?

  A. true positive
  B. true negative
  C. false positive
  D. false negative
  A. true positive

• Question 458:

  What is an incident response plan?

  A. an organizational approach to events that could lead to asset loss or disruption of operations
  B. an organizational approach to security management to ensure a service lifecycle and continuous improvements
  C. an organizational approach to disaster recovery and timely restoration of operational services
  D. an organizational approach to system backup and data archiving aligned to regulations
  A. an organizational approach to events that could lead to asset loss or disruption of operations

• Question 459:

  Refer to the exhibit.

  

  An analyst received this alert from the Cisco ASA device, and numerous activity logs were produced.

  How should this type of evidence be categorized?

  A. indirect
  B. circumstantial
  C. corroborative
  D. best
  C. corroborative

  ---

  Explanation

  The alert from the Cisco ASA device and the numerous activity logs are examples of circumstantial evidence. Circumstantial evidence is evidence that relies on an inference or deduction to connect it to a conclusion of fact, such as a security incident or an attack. Circumstantial evidence does not directly prove the fact in question, but rather suggests or implies it. In this case, the alert and the logs indicate that a TCP connection attempt was denied by an access group, but they do not directly prove that an attack occurred or who was behind it. There could be other explanations for the denied connection, such as a misconfiguration, a network error, or a legitimate request. Therefore, this type of evidence is circumstantial and requires further investigation and analysis to confirm or rule out the possibility of an attack.

  References:

  Circumstantial evidence - Wikipedia

  Circumstantial Evidence - Definition, Examples, Cases, Processes

  Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 92.

• Question 460:

  DRAG DROP

  Drag and drop the uses on the left onto the type of security system on the right.

  Select and Place: