Cisco Cisco Certified CyberOps Associate 210-255 Questions & Answers

• Question 181:

  Which option creates a display filter on Wireshark on a host IP address or name?

  A. ip.address ==

  or ip.network ==

  B. [tcp|udp] ip.[src|dst] port

  C. ip.addr == or ip.name ==

  D. ip.addr == or ip.host ==

  Correct Answer: D

• Question 182:

  Which two options can be used by a threat actor to determine the role of a server? (Choose two.)

  A. PCAP

  B. tracert

  C. running processes

  D. hard drive configuration

  E. applications

  Correct Answer: CE

• Question 183:

  Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?

  

  A. 1986

  B. 2318

  C. 2542

  D. 2317

  Correct Answer: B

• Question 184:

  Which two components are included in a 5-tuple? (Choose two.)

  A. port number

  B. destination IP address

  C. data packet

  D. user name

  E. host logs

  Correct Answer: AB

• Question 185:

  In VERIS, an incident is viewed as a series of events that adversely affects the information assets of an organization. Which option contains the elements that every event is comprised of according to VERIS incident model'?

  A. victim demographics, incident description, incident details, discovery and response

  B. victim demographics, incident details, indicators of compromise, impact assessment

  C. actors, attributes, impact, remediation

  D. actors, actions, assets, attributes

  Correct Answer: D

• Question 186:

  During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

  A. collection

  B. examination

  C. reporting

  D. investigation

  Correct Answer: A

• Question 187:

  Which information must be left out of a final incident report?

  A. server hardware configurations

  B. exploit or vulnerability used

  C. impact and/or the financial loss

  D. how the incident was detected

  Correct Answer: A

• Question 188:

  Which CVSSv3 metric value increases when the attacker is able to modify all files protected by the vulnerable component?

  A. confidentiality

  B. integrity

  C. availability

  D. complexity

  Correct Answer: B

• Question 189:

  Which option has a drastic impact on network traffic because it can cause legitimate traffic to be blocked?

  A. true positive

  B. true negative

  C. false positive

  D. false negative

  Correct Answer: C

• Question 190:

  Refer to the exhibit. We have performed a malware detection on the Cisco website. Which statement about the result is true?

  

  A. The website has been marked benign on all 68 checks.

  B. The threat detection needs to run again.

  C. The website has 68 open threats.

  D. The website has been marked benign on 0 checks.

  Correct Answer: A