Question 161 · 334 in bank
What should an engineer use to aid the trusted exchange of public keys between user tom0426871442 and dan1968754032?
Show answer
Answer: D
200-201AssociateCiscoAll questions freePage 17 of 34
200-201 practice questions 161–170
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
Official study references
334 questions in this bank
Free access · progress saved on this device
Question 162 · 334 in bank
Which tool gives the ability to see session data in real time?
Show answer
Answer: C
Explanation
The tool that gives the ability to see session data in real-time is trafshow. trafshow is a network traffic monitoring tool that allows users to view network traffic in real-time. It provides a live display of network traffic by protocol, source and destination IP addresses, port numbers, and other information. This tool can be used to monitor network traffic for troubleshooting purposes or to identify network security threats. tcpdstat is a tool for collecting and analyzing TCP/IP statistics. It collects data on TCP/IP packet traffic, connection usage, and errors, and can be used for network analysis and troubleshooting. trafdump is a packet sniffer that captures and logs network traffic for later analysis. It captures packets and saves them to a file for offline analysis. tcptrace is a tool for analyzing and graphing TCP/IP packet trace files. It can be used to visualize TCP/IP connections and to analyze network performance and behavior.
Source: Adapted from community discussion — mozaki
Question 163 · 334 in bank
Refer to the exhibit. An engineer needs to identify certificate information on server1234567890. What does the exhibit indicate?
Show answer
Answer: A
Question 164 · 334 in bank
Which of these describes volatile evidence?
Show answer
Answer: B
Explanation
Caches and Registers - Data in memory is the most volatile. This includes data in central processor unit (CPU) registers, caches, and system random access memory (RAM). - The data in cache and CPU registers is the most volatile, mostly because the storage space is so small. https://blogs.getcertifiedgetahead.com/cfr-and-order-of-volatility/#:~:text=Caches%20and%20Registers,storage%20space%20is%20so%20small.
Source: Adapted from community discussion — SecurityGuy
Question 165 · 334 in bank
What is a purpose of a vulnerability management framework?
Show answer
Answer: A
Explanation
"Vulnerability management is the "cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating" software vulnerabilities.[1] Vulnerability management is integral to computer security and network security, and must not be confused with Vulnerability assessment" source: https://en.wikipedia.org/wiki/Vulnerability_management So A is the correct answer
Source: Adapted from community discussion — Leo_Visser
Question 166 · 334 in bank
Which security model assumes an attacker within and outside of the network and enforces strict verification before connecting to any system or resource within the organization?
Show answer
Answer: C
Explanation
Zero Trust It is a security framework requiring all users, whether in or outside the organization’s network, to be authenticated, authorized, and continuously validated for security configuration and posture before being granted or keeping access to applications and data. https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/
Source: Adapted from community discussion — SecurityGuy
Question 167 · 334 in bank
Why is HTTPS traffic difficult to screen?
Show answer
Answer: D
Question 168 · 334 in bank
A user received a targeted spear-phishing email and identified it as suspicious before opening the content. To which category of the Cyber Kill Chain model does to this type of event belong?
Show answer
Answer: D
Question 169 · 334 in bank
Refer to the exhibit. An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?
Show answer
Answer: D
Explanation
vmdetect and anti_debug. Sandbox is usually done via VMs or isolated environment, these types of malware doesn't run when it detects those conditions.
Source: Adapted from community discussion — SecurityGuy
Question 170 · 334 in bank
Select 2What are two differences between tampered disk images and untampered disk images? (Choose two.)
Show answer
Answer: CE
Explanation
Same question with Q106. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide by Omar Santos P570 - You do not use Tampered images in an investigation. They would be useless in Court. We preserve the evidence. - Evidence in cybersecurity investigations that go to court is used to prove (or disprove) facts that are in dispute, as well as to prove the credibility of disputed facts (in particular, circumstantial evidence or indirect evidence). - Digital forensics evidence provides implications and extrapolations that may assist in proving some key fact of the case. - Such evidence helps legal teams and the court develop reliable hypotheses or theories as to the committer of the crime (threat actor). - The reliability of the evidence is vital to supporting or refuting any hypothesis put forward, including the attribution of threat actors.
Source: Adapted from community discussion — SecurityGuy
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 161. 334 questions available.
About this question bank
Version 1.0.0. How we source questions