200-201 practice questions 181–190

1. Question 181 · 334 in bank

   What is the practice of giving an employee access to only the resources needed to accomplish their job?

   • Aprinciple of least privilege
   • Borganizational separation
   • Cseparation of duties
   • Dneed to know principle

   Show answer

   Answer: A

   Explanation

   ANS: A Least privilege focus on minimizing potential system damage, ensuring that each employee should have minimum resources to perform their task, e.g files, network, application. While, need to know focus on restricting access to sensitive information like personal data, sensitive data, classified document, and providing them with information they need to know to perform their tasks.

   Source: Adapted from community discussion — 036e554

   Next question

2. Question 182 · 334 in bank

   

   Refer to the exhibit. Which technology produced the log?

   • Aantivirus
   • BIPS/IDS
   • Cfirewall
   • Dproxy

   Show answer

   Answer: D

   Explanation

   D- Proxy According to Cisco: Web Proxy Information in Access Log Files: Access log files provides a descriptive record of all Web Proxy filtering and scanning activity. Access log file entries display a record of how the appliance handled each transaction. The following text is an example access log file entry for a single transaction: 1278096903.150 97 172.xx.xx.xx TCP_MISS/200 8187 GET http://my.site.com/ - DIRECT/my.site.com text/plain DEFAULT_CASE_11-PolicyGroupName-Identity- OutboundMalwareScanningPolicy-DataSecurityPolicy-ExternalDLPPolicy-RoutingPolicy <IW_comp,6.9,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-",""-",-,-,IW_comp,-,"-","-", "Unknown","Unknown","-","-",198.34,0,-,[Local],"-",37,"W32.CiscoTestVector",33,0, "WSA-INFECTED-FILE.pdf","fd5ef49d4213e05f448f11ed9c98253d85829614fba368a421d14e64c426da5e”.

   Source: Adapted from community discussion — RoBery

   Next question

3. Question 183 · 334 in bank

   A user received a malicious email attachment named "DS045-report1122345.exe" and executed it. In which step of the Cyber Kill Chain is this event?

   • Areconnaissance
   • Bdelivery
   • Cweaponization
   • Dinstallation

   Show answer

   Answer: D

   Next question

4. Question 184 · 334 in bank

   Which metric is used to capture the level of access needed to launch a successful attack?

   • Aprivileges required
   • Buser interaction
   • Cattack complexity
   • Dattack vector

   Show answer

   Answer: A

   Explanation

   i Think is "D. attack vector". Attack Vector ( AV) represents the level of access an attacker needs to have to exploit a vulnerability. It can assume four values: Network, Adjacent, Local and Physical. Source: Official cert Guide Cisco CyberOps Associate CBROPS 200-201 Chapter7: Introduction to Security Operations Management. Author: Omar Santos

   Source: Adapted from community discussion — Torvalds

   References

   • cisco.com documentation

   Next question

5. Question 185 · 334 in bank

   Select 2

   A SOC analyst detected connections to known C&C and port scanning activity to main HR database servers from one of the HR endpoints, via Cisco StealthWatch. What are the two next steps of the SOC team according to the NIST.SP800-61 incident handling process? (Choose two.)

   • AUpdate antivirus signature databases on affected endpoints to block connections to C&C.
   • BIsolate affected endpoints and take disk images for analysis.
   • CBlock connection to this C&C server on the perimeter next-generation firewall.
   • DProvide security awareness training to HR managers and employees
   • EDetect the attack vector and analyze C&C connections.

   Show answer

   Answer: BC

   Explanation

   Since the SOC has already been detected the established connection to C&C server, I think the next step would be isolating and connection blocking

   Source: Adapted from community discussion — e7ae798

   Next question

6. Question 186 · 334 in bank

   Select 2

   An organization that develops high-end technology is going through an internal audit. The organization uses two databases. The main database stores patent information and a secondary database stores employee names and contact information. A compliance team is asked to analyze the infrastructure and identify protected data. Which two types of protected data should be identified? (Choose two.)

   • APayment Card Industry (PCI)
   • BSarbanes-Oxley (SOX)
   • CIntellectual Property (IP)
   • DProtected Health Information (PHI)
   • EPersonally Identifiable Information (PII)

   Show answer

   Answer: CE

   Next question

7. Question 187 · 334 in bank

   DRAG DROP -

   

   Refer to the exhibit. Drag and drop the element names from the left onto the corresponding pieces of the PCAP file on the right.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

8. Question 188 · 334 in bank

   Which option describes indicators of attack?

   • Ablocked phishing attempt on a company
   • Bspam emails on an employee workstation
   • Cvirus detection by the AV software
   • Dmalware reinfection within a few minutes of removal

   Show answer

   Answer: B

   Next question

9. Question 189 · 334 in bank

   

   Refer to the exhibit. Where is the executable file?

   • Atags
   • Binfo
   • CMIME
   • Dname

   Show answer

   Answer: C

   Explanation

   D- MIME is a standard that specifies the types of files that can be sent via email or served on the web. It defines the format of the files but doesn't provide information about the location or specific executable file. If the question is "where is the executable file" and the options are limited to (tags, info, MIME, name), the most appropriate answer would likely be "name." The file name provides information about the actual name of the file, including its extension, which can indicate its type or format.

   Source: Adapted from community discussion — RoBery

   Next question

10. Question 190 · 334 in bank

    

    Refer to the exhibit. A company's user HTTP connection to a malicious site was blocked according to configured policy. What is the source technology used for this measure?

    • Anetwork application control
    • Bfirewall
    • CIPS
    • Dweb proxy

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 181. 334 questions available.