Cisco Cisco Certified CyberOps Associate 210-255 Questions & Answers

• Question 1:

  When evidence is collected, what does NIST SP800-86 specify as a guideline to follow for the order of collection?

  A. order of volatility

  B. order of importance

  C. most difficult to access first

  D. least difficult to access first

  Correct Answer: B

• Question 2:

  An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise. Which kind of evidence is this IP address?

  A. indirect evidence

  B. best evidence

  C. forensic evidence

  D. corroborative evidence

  Correct Answer: D

• Question 3:

  What does 5-typle refer to?

  A. set of five different values that comprise a SSL connection

  B. set of five different values that comprise a HTTPS connection

  C. set of five different values that comprise a UDP connection

  D. set of five different values that comprise a TCP/IP connection

  Correct Answer: D

• Question 4:

  

  Refer to the exhibit. Which information is interesting about the HTTP GET shown?

  A. The User-Agent is Mozilla/4.0

  B. The HTTP GET is encoded

  C. timestamps

  D. The protocol is TCP

  Correct Answer: B

• Question 5:

  In which type of analysis is all data used for the analysis known beforehand?

  A. dynamic

  B. statistical

  C. probabilistic

  D. deterministic

  Correct Answer: D

• Question 6:

  Why do SOC analysts use 5-tuple?

  A. to identify the requirements for creating a functional network connection between two laptops

  B. to identify the requirements for creating a wireless network connection between an access point and a host

  C. to identify the requirements for creating a data center using best practices

  D. to identify the requirements for creating a secure network connection between two or more remote and local machines

  Correct Answer: D

• Question 7:

  Which component of the Linux ext4 file system records the intentions of changes made to the main part of the file system?

  A. MBR

  B. swap

  C. journal

  D. checksum

  Correct Answer: C

• Question 8:

  

  Refer to the exhibit. Which description of the IP addresses under the Trajectory section is true?

  A. victim systems running Microsoft Word

  B. spoofed IP addresses

  C. victim systems running Adobe Acrobat

  D. attackers

  Correct Answer: A

• Question 9:

  

  Refer to the exhibit. Which function of the Cisco Firepower Management Console correlation rules does the screenshot demonstrate?

  A. operating system whitelist events

  B. whitelisted true positive events

  C. whitelisted false positive events

  D. whitelisted command and control communication events

  Correct Answer: B

• Question 10:

  What is missing from the data correlated by using security intelligence?

  A. security intelligence categories

  B. time stamps of data transmission at the frame level

  C. ports

  D. time stamps of data transmission at the packet level

  Correct Answer: B