Cisco Cisco Certified CyberOps Associate 210-255 Questions & Answers

• Question 31:

  You have identified a malicious file in a sandbox analysis tool. Which piece of file information from the analysis is needed to search for additional downloads of this file by other hosts?

  A. file name

  B. file hash value

  C. file type

  D. file size

  Correct Answer: B

• Question 32:

  Refer to the exhibit.

  

  What does the output indicate about the server with IP address 172.18.104.139?

  A. open port of an FTP server

  B. open ports of a web server

  C. running processes of the server

  D. open ports of an email server

  Correct Answer: D

• Question 33:

  Which option is missing a malware variety per VERIS enumerations?

  A. backdoor, command and control, denial or service attack

  B. adware, brute force, client-side attack

  C. packet sniffer, password dumper, scan network

  D. abuse of functionality, cache poisoning, remote file inclusion

  Correct Answer: D

• Question 34:

  How do you verify that one of your hosts is potentially compromised based on their communication destinations?

  A. Search the communication destinations of the host in the Talos IP and Domain Reputation Center.

  B. Analyze how much traffic the host sent and received from each IP address or domain.

  C. See if any Stealthwatch alarms were triggered for the host communicating with internal hosts.

  D. Check the Firepower appliance to see if malicious files were downloaded.

  Correct Answer: A

• Question 35:

  Refer to the exhibit. Which item is depicted in this output?

  

  A. Windows Security audit log

  B. NetFlow data

  C. packet capture exported text

  D. VLAN 10 traffic

  Correct Answer: B

• Question 36:

  Which concept is used to understand instances of the same cybersecurity event occurring over the course of a few weeks that could be linked together through multiple illustrations and then linked back to the same adversary?

  A. threat model

  B. intrusion threat intelligence model

  C. compliance and Intrusion model

  D. diamond model of intrusion

  Correct Answer: C

• Question 37:

  

  Refer to the exhibit. What device is this taken from?

  A. web proxy

  B. IDS

  C. firewall

  D. NetFlow

  Correct Answer: C

• Question 38:

  Which CVSS Attach Vector metric value means that the vulnerable component is not bound to the network stack and the path of the attacker is via read/write/execute capabilities?

  A. network

  B. physical

  C. local

  D. adjacent

  Correct Answer: C

  Reference: https://www.first.org/cvss/specification-document

• Question 39:

  

  Refer to the exhibit. Which event is represented by this configuration?

  A. The ext3-test.img is being converted from read-only to read-write for analysis.

  B. A drive is being mounted using ext3-test.img file as a source.

  C. A /mnt/test directory is being created in the ext3-test.img file.

  D. The ext3-test.img file was found on the ext4 filesystem in the /mnt/test directory.

  Correct Answer: B

• Question 40:

  Which incident handling phase contains evidence gathering and handling?

  A. containment, eradication, and recovery

  B. identification

  C. post incident

  D. preparation

  Correct Answer: C