200-201 practice questions 101–110

1. Question 101 · 334 in bank

   

   Refer to the exhibit. What must be interpreted from this packet capture?

   • AIP address 192.168.88.12 is communicating with 192.168.88.149 with a source port 49098 to destination port 80 using TCP protocol.
   • BIP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.
   • CIP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 80 to destination port 49098 using TCP protocol.
   • DIP address 192.168.88.12 is communicating with 192.168.88.149 with a source port 74 to destination port 49098 using TCP protocol.

   Show answer

   Answer: A

   Next question

2. Question 102 · 334 in bank

   

   Refer to the exhibit. A company employee is connecting to mail.google.com from an endpoint device. The website is loaded but with an error. What is occurring?

   • Aman-in-the-middle attack
   • BCertificate is not in trusted roots.
   • CDNS hijacking attack.
   • DEndpoint local time is invalid.

   Show answer

   Answer: B

   Explanation

   Even if the individual certificate is installed, the system cannot validate the certificates legitimacy if the issuer is not a root/trusted CA. It must be added/imported to Trusted Root Certificates Authorities so the Issuer (mail.google.com) will become a root trusted CA and every individual cert signed by this CA will become valid.

   Source: Adapted from community discussion — Mack279

   Next question

3. Question 103 · 334 in bank

   What is the difference between the ACK flag and the RST flag?

   • AThe RST flag approves the connection, and the ACK flag indicates that a packet needs to be resent.
   • BThe ACK flag marks the connection as reliable, and the RST flag indicates the failure within TCP Handshake.
   • CThe RST flag approves the connection, and the ACK flag terminates spontaneous connections.
   • DThe ACK flag confirms the received segment, and the RST flag terminates the connection.

   Show answer

   Answer: D

   Next question

4. Question 104 · 334 in bank

   An automotive company provides new types of engines and special brakes for rally sports cars. The company has a database of inventions and patents for their engines and technical information. Customers can acces the database through the company's website after they register and identify themselves. Which type of protected data is accessed by customers?

   • AIP data
   • BPII data
   • CPSI data
   • DPHI data

   Show answer

   Answer: A

   Explanation

   A. IP data (Intellectual Property data). The database containing the inventions, patents, and technical information of the engines is likely to be classified as intellectual property. Intellectual property refers to creations of the mind, such as inventions, designs, or processes, that are protected by various legal mechanisms, including patents, copyrights, and trademarks. These protections give exclusive rights to the creators or owners of the intellectual property. In this case, the customers accessing the database are accessing the company's intellectual property, which includes information related to their engines and technical details. The company provides access to this data to registered customers, allowing them to utilize the information for their needs, such as understanding the technology or exploring innovative ideas within the scope of the company's offerings. Therefore, the correct answer is A. IP data (Intellectual Property data).

   Source: Adapted from community discussion — Topsecret

   Next question

5. Question 105 · 334 in bank

   What is the difference between vulnerability and risk?

   • AA vulnerability represents a flaw in a security that can be exploited, and the risk is the potential damage it might cause.
   • BA risk is potential threat that adversaries use to infiltrate the network, and a vulnerability is an exploit.
   • CA risk is a potential threat that an exploit applies to, and a vulnerability represents the threat itself.
   • DA vulnerability is a sum of possible malicious entry points, and a risk represents the possibility of the unauthorized entry itself.

   Show answer

   Answer: A

   Next question

6. Question 106 · 334 in bank

   The security team has detected an ongoing spam campaign targeting the organization. The team's approach is to push back the cyber kill chain and mitigate ongoing incidents. At which phase of the cyber kill chain should the security team mitigate this type of attack?

   • Ainstallation
   • Breconnaissance
   • Cactions
   • Ddelivery

   Show answer

   Answer: D

   Explanation

   D. delivery. The cyber kill chain is a framework that describes the stages of a typical cyber attack. These stages include reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions/objectives. In the context of a spam campaign, the delivery phase is where the malicious emails are sent to the target recipients. This phase involves the actual transmission or delivery of the spam emails to the victims' email accounts. It is during this phase that the security team should focus on mitigating the attack by implementing measures to detect and block the malicious emails, such as filtering or blocking techniques, spam detection mechanisms, and email security controls. By addressing the attack at the delivery phase, the security team aims to prevent the spam emails from reaching the intended recipients, thereby reducing the potential impact and mitigating the ongoing incidents related to the spam campaign. Therefore, the correct answer is D. delivery.

   Source: Adapted from community discussion — Topsecret

   Next question

7. Question 107 · 334 in bank

   What describes the concept of data consistently and readily being accessible for legitimate users?

   • Aaccessibility
   • Bavailability
   • Cintegrity
   • Dconfidentiality

   Show answer

   Answer: B

   Explanation

   Reference: https://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA

   Next question

8. Question 108 · 334 in bank

   How does an attack surface differ from an attack vector?

   • AAn attack vector recognizes the potential outcomes of an attack, and the attack surface is choosing a method of an attack.
   • BAn attack vector matches components that can be exploited, and an attack surface classifies the potential path for exploitation.
   • CAn attack surface mitigates external vulnerabilities, and an attack vector identifies mitigation techniques and possible workarounds.
   • DAn attack surface identifies vulnerable parts for an attack, and an attack vector specifies which attacks are feasible to those parts.

   Show answer

   Answer: D

   Explanation

   Attack Vector, Attack Surface and Threat Vector Vector - It is a quantity having direction as well as magnitude Attack Vector - is a “method” of gaining unauthorized access to a network or computer system. It takes many forms such as malware, ransomware, compromised credentials, phishing, web pages, pop-ups etc; basically any method that intends to compromise a system. Attack Surface - is the total number of attack vectors an attacker can use to manipulate or compromise a network or system. Can also be defined as the total number of possible methods to attack a network or system. Threat Vector - can be used interchangeably with attack vector and generally describes the potential ways a hacker can gain access to data or other confidential information. https://www.upguard.com/blog/attack-vector#:~:text=minimize%20cybersecurity%20risk.-,What%20is%20the%20Difference%20Between%20an%20Attack%20Vector%2C%20Attack%20Surface,computer%20system%20or%20extract%20data.

   Source: Adapted from community discussion — SecurityGuy

   Next question

9. Question 109 · 334 in bank

   What describes the defense-in-depth principle?

   • Adefining precise guidelines for new workstation installations
   • Bimplementing alerts for unexpected asset malfunctions
   • Ccategorizing critical assets within the organization
   • Disolating guest Wi-Fi from the local network

   Show answer

   Answer: D

   Explanation

   Think "D". The defense-in-depth principle refers to the practice of using multiple layers of security controls to protect a system or an organization's assets. This approach involves implementing a series of security measures that complement each other to provide multiple lines of defense against potential attacks. Isolating guest Wi-Fi from the local network is an example of implementing defense-in-depth. It creates an additional layer of protection to prevent unauthorized access to the local network, making it harder for an attacker to gain access to critical assets.

   Source: Adapted from community discussion — drdecker100

   Next question

10. Question 110 · 334 in bank

    Which security principle requires more than one person is required to perform a critical task?

    • Aleast privilege
    • Bneed to know
    • Cseparation of duties
    • Ddue diligence

    Show answer

    Answer: C

    Explanation

    ere's why the other options are not the correct answer to the question: A. Least privilege refers to the practice of limiting access to the minimum permissions necessary to perform a specific task. It helps to reduce the risk of unauthorized access or damage to critical systems and data. B. Need to know refers to the principle that individuals should only have access to information that is necessary for them to perform their job duties. This helps to prevent the spread of sensitive information to those who don't need to know it. D. Due diligence refers to the level of care and caution that is expected of individuals and organizations in order to protect themselves and others. It encompasses many different security principles and practices, including separation of duties. So, while each of these principles is important for maintaining security, they are not directly related to the specific requirement of having more than one person perform a critical task.

    Source: Adapted from community discussion — drdecker100

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 101. 334 questions available.