[2023] 200-201 by CyberOps Associate Actual Free Exam Practice Test [Q104-Q128]

4.6/5 - (7 votes)

[2023] 200-201 by CyberOps Associate Actual Free Exam Practice Test

Free CyberOps Associate 200-201 Exam Question

Career Path with Cisco 200-201 Exam

When you complete the Cisco 200-201 exam with flying colors, you will be awarded the Cisco Certified CyberOps Associate certification. This certificate can be very beneficial to you in many ways, including making you more employable. With this certification, you can apply for the following job roles:

Security Operations Manager;
Data Analyst;
Lead Security Technician;
Cyber Security Engineer;
IT Technician.

You can also be able to negotiate for a good salary after getting certified. Currently, the professionals with this associate-level certification can earn an average annual salary of $100,000.

Cisco 200-201 exam, also known as Understanding Cisco Cybersecurity Operations Fundamentals, is a certification exam designed to evaluate an individual’s knowledge and skills in the field of cybersecurity operations. 200-201 exam is intended for candidates who are looking to start their career in cybersecurity or for those who are already working in the field and want to enhance their skills and knowledge.

Q104. What is an attack surface as compared to a vulnerability?

any potential danger to an asset

the sum of all paths for data into and out of the application

an exploitable weakness in a system or its design

the individuals who perform an attack

Q105. What is a difference between inline traffic interrogation and traffic mirroring?

Inline inspection acts on the original traffic data flow

Traffic mirroring passes live traffic to a tool for blocking

Traffic mirroring inspects live traffic for analysis and mitigation

Inline traffic copies packets for analysis and security

Inline traffic interrogation analyzes traffic in real time and has the ability to prevent certain traffic from being forwarded Traffic mirroring doesn’t pass the live traffic instead it copies traffic from one or more source ports and sends the copied traffic to one or more destinations for analysis by a network analyzer or other monitoring device

Q106. A user received a malicious attachment but did not run it.
Which category classifies the intrusion?

weaponization

reconnaissance

installation

delivery

Section: Security Concepts

Q107. Refer to the exhibit.

An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email.
What is the state of this file?

The file has an embedded executable and was matched by PEiD threat signatures for further analysis.

The file has an embedded non-Windows executable but no suspicious features are identified.

The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.

Q108. At a company party a guest asks questions about the company’s user account format and password complexity.
How is this type of conversation classified?

Phishing attack

Password Revelation Strategy

Piggybacking

Social Engineering

Q109. A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

file header type

file size

file name

file hash value

Q110. Refer to the exhibit.

Which type of log is displayed?

proxy

NetFlow

IDS

sys

Q111. A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders After further investigation, the analyst learns that customers claim that they cannot access company servers According to NIST SP800-61, in which phase of the incident response process is the analyst?

post-incident activity

detection and analysis

preparation

containment, eradication, and recovery

Q112. Refer to the exhibit.

Which kind of attack method is depicted in this string?

cross-site scripting

man-in-the-middle

SQL injection

denial of service

Q113. Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

Hypertext Transfer Protocol

SSL Certificate

Tunneling

VPN

Q114. What is the difference between an attack vector and attack surface?

An attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.

An attack vector identifies components that can be exploited; and an attack surface identifies the potential path an attack can take to penetrate the network.

An attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible with these vulnerabilities.

An attack vector identifies the potential outcomes of an attack; and an attack surface launches an attack using several methods against the identified vulnerabilities.

Section: Security Concepts

Q115. Drag and drop the uses on the left onto the type of security system on the right.

Q116. What is indicated by an increase in IPv4 traffic carrying protocol 41 ?

additional PPTP traffic due to Windows clients

unauthorized peer-to-peer traffic

deployment of a GRE network on top of an existing Layer 3 network

attempts to tunnel IPv6 traffic through an IPv4 network

Q117. The SOC team has confirmed a potential indicator of compromise on an endpoint. The team has narrowed the executable file’s type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling this event?

Isolate the infected endpoint from the network.

Perform forensics analysis on the infected endpoint.

Collect public information on the malware behavior.

Prioritize incident handling based on the impact.

Q118. What is the difference between a threat and a risk?

Threat represents a potential danger that could take advantage of a weakness in a system

Risk represents the known and identified loss or danger in the system

Risk represents the nonintentional interaction with uncertainty in the system

Threat represents a state of being exposed to an attack or a compromise either physically or logically

Q119. An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

The computer has a HIPS installed on it.

The computer has a NIPS installed on it.

The computer has a HIDS installed on it.

The computer has a NIDS installed on it.

Section: Host-Based Analysis

Q120. Refer to the exhibit.

What is the expected result when the “Allow subdissector to reassemble TCP streams” feature is enabled?

insert TCP subdissectors

extract a file from a packet capture

disable TCP streams

unfragment TCP

Q121. Drag and drop the security concept on the left onto the example of that concept on the right.

Q122. Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

CSIRT

PSIRT

public affairs

management

Section: Security Policies and Procedures

Q123. Refer to the exhibit.

What information is depicted?

IIS data

NetFlow data

network discovery event

IPS event data

Q124. An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?

Run “ps -d” to decrease the priority state of high load processes to avoid resource exhaustion.

Run “ps -u” to find out who executed additional processes that caused a high load on a server.

Run “ps -ef” to understand which processes are taking a high amount of resources.

Run “ps -m” to capture the existing state of daemons and map required processes to find the gap.

Q125. Refer to the exhibit.

What is occurring in this network?

ARP cache poisoning

DNS cache poisoning

MAC address table overflow

MAC flooding attack

Q126. Drag and drop the security concept on the left onto the example of that concept on the right.

Q127. Which data type is necessary to get information about source/destination ports?

statistical data

session data

connectivity data

alert data

Explanation
Session data provides information about the five tuples; source IP address/port number, destination IP address/port number and the protocol What is Connectivity Data? According to IBM – Connectivity data defines how entities are connected in the network. It includes connections between different devices, and VLAN-related connections within the same device https://www.ibm.com/docs/en/networkmanager/4.2.0?topic=relationships-connectivity-data

Q128. An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?

sequence numbers

IP identifier

5-tuple

timestamps

Loading …

Cisco 200-201 exam is a vendor-specific exam that is focused on Cisco’s cybersecurity operations fundamentals. 200-201 exam covers a wide range of topics, including network security concepts, network security technologies, security monitoring, and threat analysis. 200-201 exam is intended for individuals who are looking to gain a basic understanding of cybersecurity operations in a Cisco environment.

Cisco 200-201 Actual Questions and Braindumps: https://www.surepassexams.com/200-201-exam-bootcamp.html

Career Path with Cisco 200-201 Exam

Leave a Reply Cancel reply