200-201 Actual Questions Answers Pass With Real 200-201 Exam Dumps
200-201 Dumps Prepare Your Exam With 260 Questions
The Cisco 200-201 exam is sometimes known as Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) and qualifies candidates for the Cisco Certified CyberOps Associate certificate. It is a cybersecurity exam that will prepare candidates for different security roles within a modern IT workspace.
Cisco 200-201 exam is an important certification exam for professionals who are interested in gaining knowledge and skills in cybersecurity operations. 200-201 exam covers a wide range of topics, including network security concepts, network security technologies, security monitoring, and threat analysis. By passing 200-201 exam, candidates can demonstrate their knowledge and skills in cybersecurity operations and become more valuable to their organizations.
NEW QUESTION # 124
Refer to the exhibit.
In which Linux log file is this output found?
- A. /var/log/dmesg
- B. /var/log/auth.log
- C. var/log/var.log
- D. /var/log/authorization.log
Answer: B
NEW QUESTION # 125
A security incident occurred with the potential of impacting business services. Who performs the attack?
- A. malware author
- B. bug bounty hunter
- C. threat actor
- D. direct competitor
Answer: A
NEW QUESTION # 126
Which attack method intercepts traffic on a switched network?
- A. DHCP snooping
- B. command and control
- C. denial of service
- D. ARP cache poisoning
Answer: D
Explanation:
An ARP-based MITM attack is achieved when an attacker poisons the ARP cache of two devices with the MAC address of the attacker's network interface card (NIC). Once the ARP caches have been successfully poisoned, each victim device sends all its packets to the attacker when communicating to the other device and puts the attacker in the middle of the communications path between the two victim devices. It allows an attacker to easily monitor all communication between victim devices. The intent is to intercept and view the information being passed between the two victim devices and potentially introduce sessions and traffic between the two victim devices
NEW QUESTION # 127
Which event artifact is used to identify HTTP GET requests for a specific file?
- A. HTTP status code
- B. URI
- C. TCP ACK
- D. destination IP address
Answer: B
NEW QUESTION # 128
An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?
- A. nmap -sL 192.168.1.0/24
- B. nmap -sV 192.168.1.0/24
- C. nmap --top-ports 192.168.1.0/24
- D. nmap -sP 192.168.1.0/24
Answer: A
NEW QUESTION # 129
What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?
- A. MAC is controlled by the discretion of the owner and DAC is controlled by an administrator
- B. MAC is the strictest of all levels of control and DAC is object-based access
- C. DAC is the strictest of all levels of control and MAC is object-based access
- D. DAC is controlled by the operating system and MAC is controlled by an administrator
Answer: B
Explanation:
Section: Security Concepts
NEW QUESTION # 130
Refer to the exhibit.
What does the output indicate about the server with the IP address 172.18.104.139?
- A. running processes of the server
- B. open ports of an email server
- C. open ports of a web server
- D. open port of an FTP server
Answer: B
NEW QUESTION # 131
An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?
- A. The threat actor used the teardrop technique to confuse and crash login services.
- B. The threat actor gained access to the system by known credentials.
- C. The threat actor used an unknown vulnerability of the operating system that went undetected.
- D. The threat actor used a dictionary-based password attack to obtain credentials.
Answer: A
NEW QUESTION # 132
Refer to the exhibit.
What should be interpreted from this packet capture?
- A. IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 50272 of IP address
192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6. - B. IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 50272 of IP address
192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6. - C. IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 80 of IP address
192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6. - D. IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 80 of IP address
192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6.7E503B693763E0113BE0CD2E4A16C9C4
Answer: B
NEW QUESTION # 133
What is a benefit of using asymmetric cryptography?
- A. encrypts data with one key
- B. secure data transfer
- C. fast data transfer
- D. decrypts data with one key
Answer: C
NEW QUESTION # 134
Drag and drop the security concept on the left onto the example of that concept on the right.
Answer:
Explanation:
NEW QUESTION # 135
What is the difference between a threat and a risk?
- A. Risk represents the known and identified loss or danger in the system
- B. Threat represents a state of being exposed to an attack or a compromise either physically or logically
- C. Risk represents the nonintentional interaction with uncertainty in the system
- D. Threat represents a potential danger that could take advantage of a weakness in a system
Answer: D
NEW QUESTION # 136
Which of these describes SOC metrics in relation to security incidents?
- A. time it takes to detect the incident
- B. time it takes to assess the risks of the incident
- C. probability of outage caused by the incident
- D. probability of compromise and impact caused by the incident
Answer: A
NEW QUESTION # 137
Refer to the exhibit.
Which type of log is displayed?
- A. NetFlow
- B. IDS
- C. sys
- D. proxy
Answer: A
NEW QUESTION # 138
Which regular expression matches "color" and "colour"?
- A. colo?ur
- B. colou?r
- C. col[08]+our
- D. col[09]+our
Answer: B
NEW QUESTION # 139
Refer to the exhibit.
What is the potential threat identified in this Stealthwatch dashboard?
- A. A host on the network is sending a DDoS attack to another inside host.
- B. A policy violation is active for host 10.10.101.24.
- C. There are two active data exfiltration alerts.
- D. A policy violation is active for host 10.201.3.149.
Answer: C
NEW QUESTION # 140
Drag and drop the access control models from the left onto the correct descriptions on the right.
Answer:
Explanation:
NEW QUESTION # 141
An analyst is investigating an incident in a SOC environment.
Which method is used to identify a session from a group of logs?
- A. sequence numbers
- B. timestamps
- C. IP identifier
- D. 5-tuple
Answer: D
Explanation:
Section: Security Concepts
NEW QUESTION # 142
An analyst discovers that a legitimate security alert has been dismissed.
Which signature caused this impact on network traffic?
- A. true negative
- B. false positive
- C. true positive
- D. false negative
Answer: D
Explanation:
Section: Network Intrusion Analysis
NEW QUESTION # 143
An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day, an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?
- A. Eradication
- B. Detection
- C. Analysis
- D. Recovery
Answer: B
NEW QUESTION # 144
Which tool gives the ability to see session data in real time?
- A. trafshow
- B. trafdump
- C. tcptrace
- D. tcpdstat
Answer: C
NEW QUESTION # 145
Drag and drop the technology on the left onto the data type the technology provides on the right.
Answer:
Explanation:
NEW QUESTION # 146
Drag and drop the uses on the left onto the type of security system on the right.
Answer:
Explanation:
NEW QUESTION # 147
Why is HTTPS traffic difficult to screen?
- A. The communication is encrypted and the data in transit is secured.
- B. Digital certificates secure the session, and the data is sent at random intervals.
- C. Traffic is tunneled to a specific destination and is inaccessible to others except for the receiver.
- D. HTTPS is used internally and screening traffic (or external parties is hard due to isolation.
Answer: A
NEW QUESTION # 148
Which tool provides a full packet capture from network traffic?
- A. Nagios
- B. Wireshark
- C. Hydra
- D. CAINE
Answer: B
NEW QUESTION # 149
......
New 200-201 Dumps - Real Cisco Exam Questions: https://www.practicematerial.com/200-201-exam-materials.html
Dependable 200-201 Exam Dumps to Become Cisco Certified: https://drive.google.com/open?id=17uBRkYwji_Xcn5ldcJl28ZBS_HNZDYE4
