200-201 practice questions 171–180

1. Question 171 · 334 in bank

   What is the difference between indicator of attack (IoA) and indicators of compromise (IoC)?

   • AIoA refers to the individual responsible for the security breach, and IoC refers to the resulting loss.
   • BIoA is the evidence that a security breach has occurred, and IoC allows organizations to act before the vulnerability can be exploited.
   • CIoC refers to the individual responsible for the security breach, and IoA refers to the resulting loss.
   • DIoC is the evidence that a security breach has occurred, and IoA allows organizations to act before the vulnerability can be exploited.

   Show answer

   Answer: D

   Explanation

   the answer is D This is correct because an Indicator of Compromise (IoC) is a sign that a system or network has already been compromised, and is used to determine if an attack has already occurred and to identify the scope of the compromise. An Indicator of Attack (IoA), on the other hand, is a signal or pattern that suggests an attack is currently underway or about to occur, and is used to detect and respond to an attack in progress.

   Source: Adapted from community discussion — mozaki

   Next question

2. Question 172 · 334 in bank

   What is the functionality of an IDS?

   • Aforensic tool used to perform an in-depth analysis and debugging
   • Bsoftware or device which monitors and identifies malicious network activity
   • Cdevice or software that detects and blocks suspicious files
   • Dendpoint protection software that prevents viruses and malware

   Show answer

   Answer: B

   Next question

3. Question 173 · 334 in bank

   What is a description of "phishing" as a social engineering attack?

   • AFake Social Security Administration personnel contact random individuals, inform them that there has been a computer problem on their end, and ask that those individuals confirm their Social Security Number, all for the purpose of committing identity theft.
   • BA hacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link.
   • CThe attacker focuses on creating a good pretext, or a fabricated scenario, that is used to try and steal victims' personal information.
   • DSomeone without the proper authentication follows an authenticated employee into a restricted area. The attacker might impersonate a delivery driver and wait outside a building to get things started.

   Show answer

   Answer: B

   Explanation

   This answer accurately describes the basic principle of a phishing attack as a social engineering attack. Phishing attacks typically involve the attacker posing as a trustworthy entity, such as a bank, government agency, or well-known company, to trick the victim into revealing sensitive information, such as login credentials, financial information, or personal details. The attacker achieves this by sending an email or message with a link that appears to be legitimate, but in fact leads to a fake website designed to steal the victim's information. In this way, phishing attacks can be used to steal sensitive information and commit fraud or identity theft.

   Source: Adapted from community discussion — drdecker100

   References

   • nist.gov documentation

   Next question

4. Question 174 · 334 in bank

   Select 2

   According to the NIST SP 800-86, which two types of data are considered volatile? (Choose two.)

   • Atemporary files
   • Blogin sessions
   • Cswap files
   • Ddump files
   • Efree space

   Show answer

   Answer: BE

   Explanation

   That might be true but the question asks what the "NIST SP 800-86" is reffering to. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf Search for '5.1.2 Volatile Data' the right answers would be: Slack Space Free Space Network Configuration Network Connections Running Processes Open Files Login Sessions Operating System Time

   Source: Adapted from community discussion — weganos

   References

   • nist.gov documentation
   • nist.gov documentation

   Next question

5. Question 175 · 334 in bank

   A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this situation?

   • Athe intellectual property that was stolen
   • Bthe defense contractor who stored the intellectual property
   • Cthe method used to conduct the attack
   • Dthe foreign government that conducted the attack

   Show answer

   Answer: D

   Explanation

   I think is C. the method used to conduct the attack The entity that takes advantage of the vulnerability is known as the malicious actor, and the path used by this actor to perform the attack is known as the threat agent or threat vector. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter1: Cybersecurity Fundamentals Author: Omar Santos

   Source: Adapted from community discussion — jlmadvig

   References

   • nist.gov documentation

   Next question

6. Question 176 · 334 in bank

   Which technique describes altering the data content and avoiding identification?

   • Adata modification, such as hashing
   • Bcatching clear text data transfer
   • Cdata in transit hijacking
   • Dobfuscation, such as tunneling

   Show answer

   Answer: D

   Explanation

   Tunneling is the process by which VPN packets reach their intended destination, which is typically a private network. Many VPNs use the IPsec protocol suite. IPsec is a group of protocols that run directly on top of IP at the network layer.

   Source: Adapted from community discussion — SecurityGuy

   Next question

7. Question 177 · 334 in bank

   

   Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?

   • AMD5 of the file was not identified as malicious.
   • BWin32.polip.a.exe is an executable file and should be flagged as malicious.
   • CThe file is clean and does not represent a risk.
   • DCuckoo cleaned the malicious file and prepared it for usage.

   Show answer

   Answer: B

   Explanation

   B. Win32.polip.a.exe is an executable file and should be flagged as malicious. The Cuckoo report provides information on the behavior of the file submitted for analysis, and the fact that it was identified as Win32.polip.a.exe indicates that it is an executable file and may pose a risk. The description of the file as "malicious" suggests that it may contain malicious code or perform unwanted actions. It is important to note that just because a file has a specific name or label, it does not necessarily mean it is definitely malicious. Further analysis and investigation would be necessary to fully assess the risk posed by the file. However, based on the information provided in the report, it is reasonable to flag the file as malicious and take appropriate action to protect the system and data.

   Source: Adapted from community discussion — drdecker100

   Next question

8. Question 178 · 334 in bank

   Which CVSS metric group identifies other components that are affected by a successful security attack?

   • Ascope
   • Bprivileges required
   • Cintegrity
   • Dattack vendor

   Show answer

   Answer: A

   Explanation

   A. scope is the CVSS metric group that identifies other components that are affected by a successful security attack. The CVSS (Common Vulnerability Scoring System) is a standardized method for evaluating and scoring the severity of security vulnerabilities in software and systems. The scope metric group is used to determine the extent to which other resources or systems may be impacted by a successful attack. If the attack only affects the targeted system, it has a limited scope, while if it affects other systems, it has a wider scope. B. privileges required identifies the level of access or privileges that an attacker must have in order to execute an attack. C. integrity refers to the impact that a successful attack could have on the integrity of the targeted data or system. D. attack vendor is not a metric group in CVSS.

   Source: Adapted from community discussion — drdecker100

   Next question

9. Question 179 · 334 in bank

   An engineer is working on a ticket for an incident from the incident management team. A week ago, an external web application was targeted by a DDoS attack. Server resources were exhausted and after two hours, it crashed. An engineer was able to identify the attacker and technique used. Three hours after the attack, the server was restored and the engineer recommended implementing mitigation by Blackhole filtering and transferred the incident ticket back to the IR team. According to NIST.SP800-61, at which phase of the incident response did the engineer finish work?

   • Apost-incident activity
   • Bpreparation
   • Cdetection and analysis
   • Dcontainment, eradication, and recovery

   Show answer

   Answer: D

   Next question

10. Question 180 · 334 in bank

    An information security analyst inspects the .pcap file and observes encrypted unusual SSH traffic flow over nonstandard ports Which technology makes this behavior feasible?+

    • ANAT
    • Btunneling
    • CP2P
    • DTOR

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 171. 334 questions available.