200-201 practice questions 91–100

1. Question 91 · 334 in bank

   A developer is working on a project using a Linux tool that enables writing processes to obtain these required results: ✑ If the process is unsuccessful, a negative value is returned. ✑ If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process. Which component results from this operation?

   • Aparent directory name of a file pathname
   • Bprocess spawn scheduled
   • Cmacros for managing CPU sets
   • Dnew process created by parent process

   Show answer

   Answer: D

   Explanation

   The Linux tool described in the question is most likely the fork() system call, which creates a new process by duplicating the calling process. When fork() is called, it returns a process ID (PID) to the parent process and a value of 0 to the child process. If an error occurs during the fork() call, a negative value is returned. Therefore, the operation described in the question results in a new process being created by the parent process, and the process ID being sent to the parent process. This is what the fork() system call does in Linux.

   Source: Adapted from community discussion — drdecker100

   Next question

2. Question 92 · 334 in bank

   An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide?

   • ARecover from the threat.
   • BAnalyze the threat.
   • CIdentify lessons learned from the threat.
   • DReduce the probability of similar threats.

   Show answer

   Answer: A

   Explanation

   A. Recover from the threat. B. Analyze the threat. C. Identify lessons learned from the threat. D. Reduce the probability of similar threats. I have just read 800-61r2 and in my opinion the detection and analysis phase is over because the breach has been detected and the threat actor and vector identified. Also, the containment is complete because th engineer removed access, however in the same phase we have "recovery" which has not yet been completed. C & D are both done in the "Post Incident Activity" phase, but as we have not yet recovered from the breach, these cannot be the correct answer. Just my opinion.

   Source: Adapted from community discussion — Entivo

   References

   • nist.gov documentation

   Next question

3. Question 93 · 334 in bank

   DRAG DROP - Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

4. Question 94 · 334 in bank

   A user received an email attachment named `Hr402-report3662-empl621.exe` but did not run it. Which category of the cyber kill chain should be assigned to this type of event?

   • Adelivery
   • Breconnaissance
   • Cweaponization
   • Dinstallation

   Show answer

   Answer: A

   Explanation

   Reference: https://packitforwarding.com/index.php/2019/08/29/ccna-cyberops-secops-objective-5-1-cyber-kill-chain/

   Next question

5. Question 95 · 334 in bank

   An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?

   • AAnalysis
   • BEradication
   • CDetection
   • DRecovery

   Show answer

   Answer: A

   Explanation

   Incident detection and analysis would be easy if every precursor or indicator were guaranteed to be accurate; unfortunately, this is not the case. For example, user-provided indicators such as a complaint of a server being unavailable are often incorrect. Intrusion detection systems may produce false positives—incorrect indicators. These examples demonstrate what makes incident detection and analysis so difficult: each indicator ideally should be evaluated to determine if it is legitimate. Making matters worse, the total number of indicators may be thousands or millions a day. Finding the real security incidents that occurred out of all the indicators can be a daunting task. from guide it says this and then, there's the sentence: ==On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. == for me it's A because it's already detected.

   Source: Adapted from community discussion — ivlis_27

   References

   • nist.gov documentation

   Next question

6. Question 96 · 334 in bank

   The SOC team has confirmed a potential indicator of compromise on an endpoint. The team has narrowed the executable file's type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling this event?

   • APerform forensics analysis on the infected endpoint
   • BIsolate the infected endpoint from the network
   • CPrioritize incident handling based on the impact
   • DCollect public information on the malware behavior

   Show answer

   Answer: B

   Explanation

   Isolating the PC may cause damage to the PC. It could set off another attack which encrypts the host. You should 1st analyze the malware I believe, but not with these questions I can't say for sure

   Source: Adapted from community discussion — trigger4848

   Next question

7. Question 97 · 334 in bank

   What is an incident response plan?

   • Aan organizational approach to events that could lead to asset loss or disruption of operations
   • Ban organizational approach to security management to ensure a service lifecycle and continuous improvements
   • Can organizational approach to disaster recovery and timely restoration of operational services
   • Dan organizational approach to system backup and data archiving aligned to regulations

   Show answer

   Answer: A

   Explanation

   Reference: https://www.cisco.com/c/en/us/products/security/incident-response-plan.html

   Source: Adapted from community discussion — surforlife

   Next question

8. Question 98 · 334 in bank

   Select 2

   What are two categories of DDoS attacks? (Choose two.)

   • Adirect
   • Breflected
   • Csplit brain
   • Dscanning
   • Ephishing

   Show answer

   Answer: AB

   Explanation

   Reflected DDoS Attacks: In this type of attack, the attacker spoofs the victim's IP address and sends requests to multiple servers that have vulnerable open ports. These servers respond to the victim's IP address with a large amount of traffic, overwhelming the victim's network and causing it to go offline. Direct DDoS Attacks: In this type of attack, the attacker directly targets the victim's network with a flood of traffic from a botnet, which is a group of compromised devices. This flood of traffic overwhelms the victim's network and causes it to go offline.

   Source: Adapted from community discussion — drdecker100

   Next question

9. Question 99 · 334 in bank

   What is the impact of encryption?

   • AData is unaltered and its integrity is preserved.
   • BData is accessible and available to permitted individuals.
   • CConfidentiality of the data is kept secure and permissions are validated.
   • DData is secure and unreadable without decrypting it.

   Show answer

   Answer: D

   Explanation

   D. Data is secure and unreadable without decrypting it. What I don't like about answer C is "permissions are validated" - this indicates, that we have some 3rd party software. appl. that is validating the access - this is not true, either the recipient of the encrypted message has a key to decrypt it, or he does not. No one is "validating" the access. I am going with D

   Source: Adapted from community discussion — toirdem

   Next question

10. Question 100 · 334 in bank

    Select 2

    

    Refer to the exhibit. Which two elements in the table are parts of the 5-tuple? (Choose two.)

    • AFirst Packet
    • BInitiator User
    • CIngress Security Zone
    • DSource Port
    • EInitiator IP

    Show answer

    Answer: DE

    Explanation

    5-Tuple: The tuple (source IP address, source port, destination IP address, destination port, transport protocol). source: https://www.ietf.org/rfc/rfc6146.txt So D, E are right answer

    Source: Adapted from community discussion — Leo_Visser

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 91. 334 questions available.