Cisco CyberOps Associate 200-201 Questions & Answers

• Question 61:

  While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

  A. encapsulation

  B. TOR

  C. tunneling

  D. NAT

  Correct Answer: D

  Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.

• Question 62:

  Which category relates to improper use or disclosure of PII data?

  A. legal

  B. compliance

  C. regulated

  D. contractual

  Correct Answer: C

• Question 63:

  Which tool provides a full packet capture from network traffic?

  A. Nagios

  B. CAINE

  C. Hydra

  D. Wireshark

  Correct Answer: D

• Question 64:

  What is rule-based detection when compared to statistical detection?

  A. proof of a user's identity

  B. proof of a user's action

  C. likelihood of user's action

  D. falsification of a user's identity

  Correct Answer: B

• Question 65:

  Refer to the exhibit.

  

  A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted What is occurring?

  A. indicators of denial-of-service attack due to the frequency of requests

  B. garbage flood attack attacker is sending garbage binary data to open ports

  C. indicators of data exfiltration HTTP requests must be plain text

  D. cache bypassing attack: attacker is sending requests for noncacheable content

  Correct Answer: C

• Question 66:

  Refer to the exhibit.

  

  Which type of log is displayed?

  A. proxy

  B. NetFlow

  C. IDS

  D. sys

  Correct Answer: B

• Question 67:

  A company encountered a breach on its web servers using IIS 7 5 Dunng the investigation, an engineer discovered that an attacker read and altered the data on a secure communication using TLS 1 2 and intercepted sensitive information by downgrading a connection to export-grade cryptography. The engineer must mitigate similar incidents in the future and ensure that clients and servers always negotiate with the most secure protocol versions and cryptographic parameters. Which action does the engineer recommend?

  A. Upgrade to TLS v1 3.

  B. Install the latest IIS version.

  C. Downgrade to TLS 1.1.

  D. Deploy an intrusion detection system

  Correct Answer: B

• Question 68:

  Which tool gives the ability to see session data in real time?

  A. tcpdstat

  B. trafdump

  C. tcptrace

  D. trafshow

  Correct Answer: C

• Question 69:

  What is an advantage of symmetric over asymmetric encryption?

  A. A key is generated on demand according to data type.

  B. A one-time encryption key is generated for data transmission

  C. It is suited for transmitting large amounts of data.

  D. It is a faster encryption mechanism for sessions

  Correct Answer: D

  Symmetric Encryption is generally faster than asymmetric encryption, as it requires less computational power, making it suitable for encrypting large amounts of data

• Question 70:

  Refer to the exhibit.

  

  A workstation downloads a malicious docx file from the Internet and a copy is sent to FTDv. The FTDv sends the file hash to FMC and the tile event is recorded What would have occurred with stronger data visibility?

  A. The traffic would have been monitored at any segment in the network.

  B. Malicious traffic would have been blocked on multiple devices

  C. An extra level of security would have been in place

  D. Detailed information about the data in real time would have been provided

  Correct Answer: B