200-201 practice questions 111–120

1. Question 111 · 334 in bank

   DRAG DROP - Drag and drop the security concept on the left onto the example of that concept on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   network is compromised => Exploit lack of an access list => Vulnerability configuration review => Risk Assessment leakage of condidential information => Threat

   Source: Adapted from community discussion — nataldogomes

   

   Next question

2. Question 112 · 334 in bank

   How does statistical detection differ from rule-based detection?

   • AStatistical detection involves the evaluation of events, and rule-based detection requires an evaluated set of events to function.
   • BRule-based detection involves the evaluation of events, and statistical detection requires an evaluated set of events to function.
   • CStatistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules.
   • DRule-based detection defines legitimate data over a period of time, and statistical detection works on a predefined set of rules.

   Show answer

   Answer: C

   Next question

3. Question 113 · 334 in bank

   Which type of access control depends on the job function of the user?

   • Arole-based access control
   • Brule-based access control
   • Cnondiscretionary access control
   • Ddiscretionary access control

   Show answer

   Answer: A

   Next question

4. Question 114 · 334 in bank

   What is a collection of compromised machines that attackers use to carry out a DDoS attack?

   • Asubnet
   • BVLAN
   • Ccommand and control
   • Dbotnet

   Show answer

   Answer: D

   Explanation

   Botnet - It is a collection of internet-connected devices, which may include personal computers (PCs), servers, mobile devices and internet of things (IoT) devices, that are infected and controlled by a common type of malware, often unbeknownst to their owner. - Infected devices are controlled remotely by threat actors, often cybercriminals, and are used for specific functions, yet the malicious operations stay hidden from the user. - Botnets are commonly used to send spam emails, engage in click fraud campaigns and generate malicious traffic for distributed denial-of-service (DDoS) attacks. https://www.techtarget.com/searchsecurity/definition/botnet

   Source: Adapted from community discussion — SecurityGuy

   Next question

5. Question 115 · 334 in bank

   What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?

   • ASPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.
   • BTAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools.
   • CTAPS interrogation is more complex because traffic mirroring applies additional tags to data, and SPAN does not alter integrity and provides full visibility within full-duplex networks.
   • DSPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.

   Show answer

   Answer: A

   Explanation

   A is the correct answer SPAN ports ==> filter out physical layer errors, making some types of analyses more difficult, TAPS ==> receives all packets, including physical errors. Reference: https://insights.profitap.com/tap-vs-span

   Source: Adapted from community discussion — Eng_ahmedyoussef

   Next question

6. Question 116 · 334 in bank

   A security engineer notices confidential data being exfiltrated to a domain `Ransome4144-mware73-978` address that is attributed to a known advanced persistent threat group. The engineer discovers that the activity is part of a real attack and not a network misconfiguration. Which category does this event fall under as defined in the Cyber Kill Chain?

   • Areconnaissance
   • Bdelivery
   • Caction on objectives
   • Dweaponization

   Show answer

   Answer: C

   Explanation

   n this scenario, the attacker has already gained access to the victim's network and is exfiltrating confidential data to a known domain attributed to an advanced persistent threat group. Therefore, the attack has progressed beyond the initial stages of reconnaissance, weaponization, delivery, and exploitation. The attacker has already achieved their objective, which is to exfiltrate sensitive data.

   Source: Adapted from community discussion — drdecker100

   Next question

7. Question 117 · 334 in bank

   Which of these describes SOC metrics in relation to security incidents?

   • Aprobability of outage caused by the incident
   • Bprobability of compromise and impact caused by the incident
   • Ctime it takes to assess the risks of the incident
   • Dtime it takes to detect the incident

   Show answer

   Answer: D

   Explanation

   Time it takes to detect the incident SOC (Security Operations Center) metrics often include measurements related to the time it takes to detect security incidents. This metric, often referred to as "Time to Detect" or "Time to Detection," reflects the efficiency of an organization's security monitoring and incident detection capabilities. It measures the amount of time that elapses from the initiation of a security incident until it is detected by the security team. Reducing the time to detect is important for minimizing the potential impact of security incidents

   Source: Adapted from community discussion — AhmedAbdalla

   Next question

8. Question 118 · 334 in bank

   What is a benefit of using asymmetric cryptography?

   • Aencrypts data with one key
   • Bdecrypts data with one key
   • Csecure data transfer
   • Dfast data transfer

   Show answer

   Answer: C

   Next question

9. Question 119 · 334 in bank

   What is obtained using NetFlow?

   • Afull packet capture
   • Bsession data
   • Capplication logs
   • Dnetwork downtime report

   Show answer

   Answer: B

   Next question

10. Question 120 · 334 in bank

    Select 2

    What are the two differences between stateful and deep packet inspection? (Choose two.)

    • ADeep packet inspection is capable of TCP state monitoring only, and stateful inspection can inspect TCP and UDP.
    • BStateful inspection is capable of packet data inspections, and deep packet inspection is not.
    • CDeep packet inspection is capable of malware blocking, and stateful inspection is not.
    • DStateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports.
    • EDeep packet inspection operates on Layer 3 and 4, and stateful inspection operates on Layer 3 of the OSI model.

    Show answer

    Answer: AC

    Explanation

    The correct answers are D and E. Stateful inspection firewall checks the state of the traffic (e.g. TCP state tracking) to allow or deny traffic. It tracks the state of connections and only allows traffic that is part of an established connection. This type of firewall is considered less resource-intensive compared to deep packet inspection because it only examines a limited set of fields in the packets. Deep packet inspection (DPI) firewall examines the payload of the packets beyond the header information. DPI can analyze the content of the traffic and block traffic based on characteristics like malware, URLs, or content type. DPI operates on layer 7 of the OSI model, whereas stateful inspection operates on layer 3. Therefore, D is correct because stateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports. E is correct because deep packet inspection operates on Layer 3 and 4, and stateful inspection operates on Layer 3 of the OSI model.

    Source: Adapted from community discussion — alhamry

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 111. 334 questions available.