Cisco 200-201 Online Practice Questions and Exam Preparation

Cisco 200-201 Online Questions & Answers

• Question 461:

  The SOC team detected an ongoing port scan. After investigation, the team concluded that the scan was targeting the company servers.

  According to the Cyber Kill Chain model, which step must be assigned to this type of event?

  A. delivery
  B. exploitation
  C. reconnaissance
  D. actions on objectives
  C. reconnaissance

• Question 462:

  How is SQL injection prevented?

  A. sanitize user input
  B. address space layout randomization
  C. run the web server as a nonprivileged user
  D. host profiling
  A. sanitize user input

• Question 463:

  Which piece of information is needed for attribution in an investigation?

  A. proxy logs showing the source RFC 1918 IP addresses
  B. RDP allowed from the Internet
  C. known threat actor behavior
  D. 802.1x RADIUS authentication pass arid fail logs
  C. known threat actor behavior

  ---

  Explanation

  Actually this is the most important thing: know who, what, how, why, etc..attack the network.

• Question 464:

  What are two categories of DDoS attacks? (Choose two.)

  A. direct
  B. reflected
  C. split brain
  D. scanning
  E. phishing
  A. direct
  B. reflected

• Question 465:

  What describes the defense-m-depth principle?

  A. defining precise guidelines for new workstation installations
  B. categorizing critical assets within the organization
  C. isolating guest Wi-Fi from the focal network
  D. implementing alerts for unexpected asset malfunctions
  C. isolating guest Wi-Fi from the focal network

• Question 466:

  Refer to the exhibit.

  

  Which type of data filtering is provided?

  A. Web
  B. Firewall
  C. Mail
  D. Application
  B. Firewall

• Question 467:

  Refer to the exhibit.

  

  An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server

  Which display filters should the analyst use to filter the FTP traffic?

  A. dstport == FTP
  B. tcp.port==21
  C. tcpport = FTP
  D. dstport = 21
  B. tcp.port==21

  ---

  Explanation

  The correct display filter for analyzing FTP traffic in a PCAP file is "tcp.port==21". This filter will show all TCP packets where the port number is 21, which is the standard port for FTP control messages.

• Question 468:

  What is a benefit of agent-based protection when compared to agentless protection?

  A. It lowers maintenance costs
  B. It provides a centralized platform
  C. It collects and detects all traffic locally
  D. It manages numerous devices simultaneously
  C. It collects and detects all traffic locally

  ---

  Explanation

  Host-based antivirus protection is also known as agent-based. Agent-based antivirus runs on every protected machine. Agentless antivirus protection performs scans on hosts from a centralized system. Agentless systems have become popular for virtualized environments in which multiple OS instances are running on a host simultaneously. Agent-based antivirus running in each virtualized system can be a serious drain on system resources. Agentless antivirus for virtual hosts involves the use of a special security virtual appliance that performs optimized scanning tasks on the virtual hosts. An example of this is VMware's vShield.

• Question 469:

  What is the difference between indicator of attack (loA) and indicators of compromise (loC)?

  A. loA is the evidence that a security breach has occurred, and loC allows organizations to act before the vulnerability can be exploited.
  B. loA refers to the individual responsible for the security breach, and loC refers to the resulting loss.
  C. loC is the evidence that a security breach has occurred, and loA allows organizations to act before the vulnerability can be exploited.
  D. loC refers to the individual responsible for the security breach, and loA refers to the resulting loss.
  C. loC is the evidence that a security breach has occurred, and loA allows organizations to act before the vulnerability can be exploited.

• Question 470:

  A security engineer notices confidential data being exfiltrated to a domain "Ranso4134- mware31-895" address that is attributed to a known advanced persistent threat group.

  The engineer discovers that the activity is part of a real attack and not a network misconfiguration.

  Which category does this event fall under as defined in the Cyber Kill Chain?

  A. reconnaissance
  B. delivery
  C. action on objectives
  D. weaponization
  D. weaponization