Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
334 questions in this bank
Free access · progress saved on this device
Which event is user interaction?
Answer: D
D. opening a malicious file is not necessarily an event that involves user interaction. The most common event that involves user interaction is opening a file or clicking on a link, which can lead to unintended consequences such as executing malicious code. However, in the options given, none of them directly relate to user interaction.
Source: Adapted from community discussion — drdecker100
An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?
Answer: C
In a security operations center (SOC) environment, one method that could be used to identify a session from a group of logs is the use of a 5-tuple. A 5-tuple consists of five pieces of information that can be used to identify a specific network session: the source IP address, source port, destination IP address, destination port, and protocol. By using this information, an analyst can identify a specific session from a group of logs and track its progress through the system. Other methods that could be used to identify a session from a group of logs include the use of sequence numbers, timestamps, or IP identifiers.
Source: Adapted from community discussion — Proctored_Expert
Which system monitors local system operation and local network access for violations of a security policy?
Answer: A
i think that "A.host-based intrusion detection". HIDS is capable of monitoring the internals of a computing system as well as the network packets on its network interfaces. Host-based firewall is a piece of software running on a single Host that can restrict incoming and outgoing Network activity for that host only.
Source: Adapted from community discussion — Torvalds
An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?
Answer: C
C. is correct answer The computer has a HIDS installed on it. HIDS ==> Detects only attacks and don't take action or mitigation.
Source: Adapted from community discussion — Eng_ahmedyoussef
Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?
Answer: C
Obviously is "C" "EX" = exfiltration And there are three. Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration
Source: Adapted from community discussion — anonymous1966
What is a difference between tampered and untampered disk images?
Answer: D
"D" is correct. The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic investigation to determine who and what caused the attack. Additionally, you want to ensure the data that was captured is not tampered with or modified during the creation of a disk image process. Ref: Cisco Certified CyberOps Associate 200-201 Certification Guide By Glen D. Singh
Source: Adapted from community discussion — anonymous1966
What is a sandbox interprocess communication service?
Answer: C
C is correct IPC is a collection of programming interfaces that allows the coordination of activities among different program processes that can run concurrently in an operating system. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide by Omar Santos
Source: Adapted from community discussion — Pwned
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication. Which obfuscation technique is the attacker using?
Answer: B
During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?
Answer: C
During the forensic process, data that is related to a specific event is typically labeled and recorded to preserve its integrity during the "collection" phase. This phase involves the gathering and preservation of potential evidence, ensuring that it is properly documented, secured, and maintained to maintain its evidentiary value for later analysis and reporting.
Source: Adapted from community discussion — AhmedAbdalla
Which step in the incident response process researches an attacking host through logs in a SIEM?
Answer: A
The incident response process typically includes the following phases: preparation, detection and analysis, containment, eradication, and recovery. The detection and analysis phase is focused on identifying and assessing the scope and severity of the incident, and this includes analyzing logs and other data to identify the source and nature of the attack.
Source: Adapted from community discussion — drdecker100
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 1. 334 questions available.
Version 1.0.0. How we source questions