200-201 Dumps - Kickstart your Career with Real Updated Questions
Earn Quick And Easy Success With 200-201 Dumps
Cisco 200-201 exam is an important certification for individuals looking to establish themselves in the field of cybersecurity operations. 200-201 exam is designed to test the fundamental knowledge and skills required to identify and respond to security incidents in a network environment. 200-201 exam is intended for those who are new to cybersecurity operations or those who are seeking to expand their knowledge and skills in this field.
NEW QUESTION # 45
Which utility blocks a host portscan?
- A. antimalware
- B. HIDS
- C. host-based firewall
- D. sandboxing
Answer: C
NEW QUESTION # 46
DRAG DROP
Drag and drop the technology on the left onto the data type the technology provides on the right.
Select and Place:
Answer:
Explanation:
NEW QUESTION # 47 
Refer to the exhibit Drag and drop the element names from the left onto the corresponding pieces of the PCAP file on the right.
Answer:
Explanation:
NEW QUESTION # 48
An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.
Which testing method did the intruder use?
- A. social engineering
- B. tailgating
- C. piggybacking
- D. eavesdropping
Answer: A
NEW QUESTION # 49
Which signature impacts network traffic by causing legitimate traffic to be blocked?
- A. true positive
- B. false negative
- C. true negative
- D. false positive
Answer: D
Explanation:
Section: Network Intrusion Analysis
NEW QUESTION # 50
Refer to the exhibit.
An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email.
What is the state of this file?
- A. The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.
- B. The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.
- C. The file has an embedded executable and was matched by PEiD threat signatures for further analysis.
- D. The file has an embedded non-Windows executable but no suspicious features are identified.
Answer: A
NEW QUESTION # 51
Refer to the exhibit.
What is occurring in this network?
- A. MAC address table overflow
- B. ARP cache poisoning
- C. MAC flooding attack
- D. DNS cache poisoning
Answer: B
NEW QUESTION # 52
Refer to the exhibit.
Which stakeholders must be involved when a company workstation is compromised?
- A. Employee 1 Employee 2, Employee 3, Employee 4, Employee 5, Employee 7
- B. Employee 4, Employee 6, Employee 7
- C. Employee 2, Employee 3, Employee 4, Employee 5
- D. Employee 1, Employee 2, Employee 4, Employee 5
Answer: C
NEW QUESTION # 53
Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?
- A. ip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16
- B. src=10.11.0.0/16 and dst=10.11.0.0/16
- C. ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16
- D. src==10.11.0.0/16 and dst==10.11.0.0/16
Answer: C
NEW QUESTION # 54
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
Answer:
Explanation:
NEW QUESTION # 55
An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?
- A. all firewall alerts and resulting mitigations
- B. tagged protocols being used on the network
- C. all information and data within the datagram
- D. tagged ports being used on the network
Answer: D
NEW QUESTION # 56
What is a difference between inline traffic interrogation and traffic mirroring?
- A. Traffic mirroring inspects live traffic for analysis and mitigation
- B. Traffic mirroring passes live traffic to a tool for blocking
- C. Inline traffic copies packets for analysis and security
- D. Inline inspection acts on the original traffic data flow
Answer: B
NEW QUESTION # 57
Refer to the exhibit.
Which type of log is displayed?
- A. IDS
- B. sys
- C. NetFlow
- D. proxy
Answer: B
NEW QUESTION # 58
Which attack method is being used when an attacker tries to compromise a network with an authentication system that uses only 4-digit numeric passwords and no username?
- A. cross-site scripting
- B. replay
- C. dictionary
- D. SQL injection
Answer: C
NEW QUESTION # 59
What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)
- A. Untampered images are used in the security investigation process
- B. Tampered images are used in the security investigation process
- C. The image is untampered if the stored hash and the computed hash match
- D. The image is tampered if the stored hash and the computed hash match
- E. Tampered images are used in the incident recovery process
Answer: B,C
NEW QUESTION # 60
An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist Further analysis shows that the threat actor connected an externa USB device to bypass security restrictions and steal data The engineer could not find an external USB device Which piece of information must an engineer use for attribution in an investigation?
- A. receptionist and the actions performed
- B. stolen data and its criticality assessment
- C. list of security restrictions and privileges boundaries bypassed
- D. external USB device
Answer: C
NEW QUESTION # 61
Refer to the exhibit.
An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email.
What is the state of this file?
- A. The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.
- B. The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.
- C. The file has an embedded executable and was matched by PEiD threat signatures for further analysis.
- D. The file has an embedded non-Windows executable but no suspicious features are identified.
Answer: A
NEW QUESTION # 62
What does an attacker use to determine which network ports are listening on a potential target device?
- A. ping sweep
- B. man-in-the-middle
- C. SQL injection
- D. port scanning
Answer: D
NEW QUESTION # 63
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
Answer:
Explanation:
Explanation
Delivery: This step involves transmitting the weapon to the target.
Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities.
Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.
NEW QUESTION # 64
What is a benefit of agent-based protection when compared to agentless protection?
- A. It collects and detects all traffic locally
- B. It manages numerous devices simultaneously
- C. It lowers maintenance costs
- D. It provides a centralized platform
Answer: D
Explanation:
Section: Security Concepts
NEW QUESTION # 65
Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?
- A. ClientStart, ClientKeyExchange, cipher-suites it supports, and suggested compression methods
- B. ClientHello, TLS versions it supports, cipher-suites it supports, and suggested compression methods
- C. ClientStart, TLS versions it supports, cipher-suites it supports, and suggested compression methods
- D. ClientHello, ClientKeyExchange, cipher-suites it supports, and suggested compression methods
Answer: B
NEW QUESTION # 66
According to CVSS, what is a description of the attack vector score?
- A. It depends on how far away the attacker is located and the vulnerable component
- B. The metric score will be larger when a remote attack is more likely.
- C. The metric score will be larger when it is easier to physically touch or manipulate the vulnerable component
- D. It depends on how many physical and logical manipulations are possible on a vulnerable component
Answer: B
NEW QUESTION # 67
What is an attack surface as compared to a vulnerability?
- A. the sum of all paths for data into and out of the environment
- B. an exploitable weakness in a system or its design
- C. any potential danger to an asset
- D. the individuals who perform an attack
Answer: B
Explanation:
An attack surface is the total sum of vulnerabilities that can be exploited to carry out a security attack. Attack surfaces can be physical or digital. The term attack surface is often confused with the term attack vector, but they are not the same thing. The surface is what is being attacked; the vector is the means by which an intruder gains access.
NEW QUESTION # 68
Refer to the exhibit.
Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.
Answer:
Explanation:
NEW QUESTION # 69
......
Cisco 200-201 exam is a vendor-specific exam that is focused on Cisco's cybersecurity operations fundamentals. 200-201 exam covers a wide range of topics, including network security concepts, network security technologies, security monitoring, and threat analysis. 200-201 exam is intended for individuals who are looking to gain a basic understanding of cybersecurity operations in a Cisco environment.
Free 200-201 pdf Files With Updated and Accurate Dumps Training: https://examtests.passcollection.com/200-201-valid-vce-dumps.html
