[2022] Pass 200-201 Exam - Real Questions & Answers [Q23-Q47]

4.3/5 - (3 votes)

[2022] Pass 200-201 Exam – Real Questions and Answers

200-201 Exam Questions Get Updated [2022] with Correct Answers

NO.23 Which category relates to improper use or disclosure of PII data?

legal

compliance

regulated

contractual

Section: Security Policies and Procedures

NO.24 Refer to the exhibit.

A company employee is connecting to mail google.com from an endpoint device. The website is loaded but with an error. What is occurring?

DNS hijacking attack

Endpoint local time is invalid.

Certificate is not in trusted roots.

man-m-the-middle attack

NO.25 Why is encryption challenging to security monitoring?

Encryption analysis is used by attackers to monitor VPN tunnels.

Encryption is used by threat actors as a method of evasion and obfuscation.

Encryption introduces additional processing requirements by the CPU.

Encryption introduces larger packet sizes to analyze and store.

NO.26 What do the Security Intelligence Events within the FMC allow an administrator to do?

See if a host is connecting to a known-bad domain.

Check for host-to-server traffic within your network.

View any malicious files that a host has downloaded.

Verify host-to-host traffic within your network.

NO.27 A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

NO.28 What are the two differences between stateful and deep packet inspection? (Choose two )

Stateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports

Deep packet inspection is capable of malware blocking, and stateful inspection is not

Deep packet inspection operates on Layer 3 and 4. and stateful inspection operates on Layer 3 of the OSI model

Deep packet inspection is capable of TCP state monitoring only, and stateful inspection can inspect TCP and UDP.

Stateful inspection is capable of packet data inspections, and deep packet inspection is not

NO.29 Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are two active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

NO.30 An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication.

Which obfuscation technique is the attacker using?

Base64 encoding

transport layer security encryption

SHA-256 hashing

ROT13 encryption

NO.31 Which process is used when IPS events are removed to improve data integrity?

data availability

data normalization

data signature

data protection

Section: Security Concepts

NO.32 When an event is investigated, which type of data provides the investigate capability to determine if data exfiltration has occurred?

full packet capture

NetFlow data

session data

firewall logs

NO.33 Which two elements are used for profiling a network? (Choose two.)

session duration

total throughput

running processes

listening ports

OS fingerprint

NO.34 What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

least privilege

need to know

integrity validation

due diligence

Section: Security Concepts

NO.35 Drag and drop the security concept on the left onto the example of that concept on the right.

NO.36 Syslog collecting software is installed on the server For the log containment, a disk with FAT type partition is used An engineer determined that log files are being corrupted when the 4 GB tile size is exceeded. Which action resolves the issue?

Add space to the existing partition and lower the retention penod.

Use FAT32 to exceed the limit of 4 GB.

Use the Ext4 partition because it can hold files up to 16 TB.

Use NTFS partition for log file containment

NO.37 An engineer is addressing a connectivity issue between two servers where the remote server is unable to establish a successful session. Initial checks show that the remote server is not receiving an SYN-ACK while establishing a session by sending the first SYN. What is causing this issue?

incorrect TCP handshake

incorrect UDP handshake

incorrect OSI configuration

incorrect snaplen configuration

NO.38 Drag and drop the elements from the left into the correct order for incident handling on the right.

NO.39 A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

NO.40 Which type of evidence supports a theory or an assumption that results from initial evidence?

probabilistic

indirect

best

corroborative

Section: Security Policies and Procedures

NO.41 An analyst is investigating an incident in a SOC environment.
Which method is used to identify a session from a group of logs?

sequence numbers

IP identifier

5-tuple

timestamps

Section: Security Concepts

NO.42

Refer to the exhibit. What should be interpreted from this packet capture?

IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 80 of IP address
192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6.

IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 50272 of IP address
192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6.

IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 80 of IP address
192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6.

IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 50272 of IP address
192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6.

Section: Security Monitoring

NO.43 At which layer is deep packet inspection investigated on a firewall?

internet

transport

application

data link

NO.44 What is a benefit of using asymmetric cryptography?

decrypts data with one key

fast data transfer

secure data transfer

encrypts data with one key

NO.45 Refer to the exhibit.

What should be interpreted from this packet capture?

81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.

192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.

192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.

81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.

NO.46 While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible?

encapsulation

TOR

tunneling

NAT

NO.47 Which two elements are used for profiling a network? (Choose two.)

total throughout

session duration

running processes

OS fingerprint

listening ports

Loading …

Cisco CyberOps Job & Salary

Once you attain your CyberOps Associate certificate, you will be able to opt for the position of an associate-level cybersecurity analyst. Throughout the USA, the Cisco CyberOps Associate certification holders earn an average salary of $67,000 per year as stated by Nasroo.com. However, after gaining a few years of experience in the field, the average income can shoot to about $100,000 annually for those who work in the financial, defense, and aerospace industries as also claimed by the Nasroo platform. Aside from experience, the company you choose to work with and the complexity of the tasks may also influence your income potential. At the first glance, individuals who work for top-ranked organizations tend to earn more than their colleagues with the same skills.

Practice 200-201 Questions With Certification guide Q&A from Training Expert PassTestking: https://www.passtestking.com/Cisco/200-201-practice-exam-dumps.html

Categories:200-201Cisco