200-201 practice questions 141–150

1. Question 141 · 334 in bank

   Which information must an organization use to understand the threats currently targeting the organization?

   • Avendor suggestions
   • Bthreat intelligence
   • Crisk scores
   • Dvulnerability exposure

   Show answer

   Answer: B

   Next question

2. Question 142 · 334 in bank

   An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, `File: Clean.` Which regex must the analyst import?

   • AFile: Clean (.*)
   • B^Parent File: Clean$
   • CFile: Clean
   • D^File: Clean$

   Show answer

   Answer: C

   Explanation

   C is the only possible answer because it can extract/parse both the words even if they are between other characters (as we can commonly find in a log file) D is wrong because it only matches if the log fields are separated by a "line feed" or "carriage return" (\n or \r in regex), which is quite rare to find in common logs

   Source: Adapted from community discussion — Max_DeJaV

   References

   • Cisco documentation

   Next question

3. Question 143 · 334 in bank

   Which technology prevents end-device to end-device IP traceability?

   • Aencryption
   • Btunneling
   • Cload balancing
   • DNAT/PAT

   Show answer

   Answer: D

   Explanation

   NAT can help to improve security by hiding the private IP addresses of devices on a private network from the internet. https://www.geeksforgeeks.org/difference-between-network-address-translation-nat-and-port-address-translation-pat/

   Source: Adapted from community discussion — SecurityGuy

   Next question

4. Question 144 · 334 in bank

   Which attack method intercepts traffic on a switched network?

   • Adenial of service
   • BARP cache poisoning
   • CDHCP snooping
   • Dcommand and control

   Show answer

   Answer: B

   Explanation

   Correct answer: B. ARP cache poisoning DHCP snooping is a counter measure against attack. wiki: In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

   Source: Adapted from community discussion — skysoft

   References

   • Cisco documentation

   Next question

5. Question 145 · 334 in bank

   What is the difference between inline traffic interrogation and traffic mirroring?

   • AInline replicates the traffic to preserve integrity rather than modifying packets before sending them to other analysis tools.
   • BTraffic mirroring results in faster traffic analysis and inline is considerably slower due to latency.
   • CInline interrogation is less complex as traffic mirroring applies additional tags to data.
   • DTraffic mirroring copies the traffic rather than forwarding it directly to the analysis tools.

   Show answer

   Answer: D

   Explanation

   Inline inspection - Inline traffic interrogation is a technique in which traffic flows through a device that inspects the traffic and makes decisions about how to handle it. The inspection takes place in real-time and in-line with the traffic flow. Traffic mirroring - Traffic mirroring, also known as port mirroring or SPAN (Switched Port Analyzer), is a technique for forwarding a copy of network traffic to a monitoring device. The copy of the traffic is sent to a separate tool for analysis, security or other purposes.

   Source: Adapted from community discussion — SecurityGuy

   Next question

6. Question 146 · 334 in bank

   What is an advantage of symmetric over asymmetric encryption?

   • AIt is a faster encryption mechanism for sessions.
   • BA one-time encryption key is generated for data transmission.
   • CA key is generated on demand according to data type.
   • DIt is suited for transmitting large amounts of data.

   Show answer

   Answer: A

   Next question

7. Question 147 · 334 in bank

   

   Refer to the exhibit. During the analysis of a suspicious scanning activity incident, an analyst discovered multiple local TCP connection events. Which technology provided these logs?

   • Aantivirus
   • BIDS/IPS
   • Cfirewall
   • Dproxy

   Show answer

   Answer: C

   Next question

8. Question 148 · 334 in bank

   An organization is cooperating with several third-party companies. Data exchange is on an unsecured channel using port 80. Internal employees use the FTP service to upload and download sensitive data. An engineer must ensure confidentiality while preserving the integrity of the communication. Which technology must the engineer implement in this scenario?

   • ARADIUS server
   • Bweb application firewall
   • CX.509 certificates
   • DCA server

   Show answer

   Answer: C

   Explanation

   X.509 certificates It is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate. https://www.techtarget.com/searchsecurity/definition/X509-certificate

   Source: Adapted from community discussion — SecurityGuy

   Next question

9. Question 149 · 334 in bank

   What describes the impact of false-positive alerts compared to false-negative alerts?

   • AA false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened. A false positive is when an XSS attack happens and no alert is raised.
   • BA false positive is an event altering for an SQL injection attack. An engineer investigates the alert and discovers that an attack attempt was blocked by IPS. A false negative is when the attack gets detected but succeeds and results in a breach.
   • CA false positive is an event altering for a brute-force attack. An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times. A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.
   • DA false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system. A false positive is when no alert and no attack is occurring.

   Show answer

   Answer: C

   Next question

10. Question 150 · 334 in bank

    Which vulnerability type is used to read, write, or erase information from a database?

    • Across-site request forgery
    • BSQL injection
    • Ccross-site scripting
    • Dbuffer overflow

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 141. 334 questions available.