200-201 practice questions 11–20

1. Question 11 · 334 in bank

   A malicious file has been identified in a sandbox analysis tool. Which piece of information is needed to search for additional downloads of this file by other hosts?

   • Afile type
   • Bfile size
   • Cfile name
   • Dfile hash value

   Show answer

   Answer: D

   Explanation

   A file hash value is a unique digital signature that is calculated based on the contents of a file. Even a small change to the contents of the file will result in a different hash value. By comparing the hash value of a file that is known to be malicious with the hash values of other files on other hosts, it is possible to identify other instances of the same malicious file, even if the file has a different name, size, or type.

   Source: Adapted from community discussion — drdecker100

   Next question

2. Question 12 · 334 in bank

   What is a difference between SOAR and SIEM?

   • ASOAR platforms are used for threat and vulnerability management, but SIEM applications are not
   • BSIEM applications are used for threat and vulnerability management, but SOAR platforms are not
   • CSOAR receives information from a single platform and delivers it to a SIEM
   • DSIEM receives information from a single platform and delivers it to a SOAR

   Show answer

   Answer: A

   Explanation

   Platforms based on SIEM (security information and event management) technology offer visibility and meaningful insights by collecting, aggregating, and analyzing information from different sources. An upcoming platform in the security industry is based on SOAR (security orchestration, automation, and response) technology. SOAR platforms are similar to SIEMs in that they aggregate, correlate, and analyze alerts. However, SOAR technology goes a step further by integrating threat intelligence and automating incident investigation and response workflows based on playbooks developed by the security team. Source: https://www.cisco.com/c/en/us/products/security/what-is-a-security-platform.html#~types-of-security-platforms So answer A is correct

   Source: Adapted from community discussion — Leo_Visser

   References

   • Cisco documentation

   Next question

3. Question 13 · 334 in bank

   

   Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

   • AHost 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.
   • BHost 152.46.6.91 is being identified as a watchlist country for data transfer.
   • CTraffic to 152.46.6.149 is being denied by an Advanced Network Control policy.
   • DHost 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.

   Show answer

   Answer: D

   Explanation

   The question is very simple. "D" is correct. Subject = 10.201.3.149 Peer = 152.46.6.91 1st search: Subject --- 6.42 MB --> Peer Peer --- 132.53 MB --> Subject 2nd search: Subject --- 4.13 MB --> Peer Peer --- 96.26 MB --> Subject 132.53/6.42 = 20.64 96.26/4.13 = 22.34

   Source: Adapted from community discussion — anonymous1966

   Next question

4. Question 14 · 334 in bank

   

   Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

   • AA policy violation is active for host 10.10.101.24.
   • BA host on the network is sending a DDoS attack to another inside host.
   • CThere are two active data exfiltration alerts.
   • DA policy violation is active for host 10.201.3.149.

   Show answer

   Answer: C

   Explanation

   Look at the middle column, data exfiltration is highlighted (in bold) and the graph displays 2 event counts. Of all the choices its the only one that makes sense.

   Source: Adapted from community discussion — AndyBrian

   Next question

5. Question 15 · 334 in bank

   Which security technology allows only a set of pre-approved applications to run on a system?

   • Aapplication-level blacklisting
   • Bhost-based IPS
   • Capplication-level whitelisting
   • Dantivirus

   Show answer

   Answer: C

   Explanation

   Application-level whitelisting is a security practice where only a predefined list of approved applications or processes are allowed to execute on a system. Any other application or process not on the whitelist is blocked or denied from running. This approach provides strong control over the software that can run on a system, enhancing security by preventing the execution of unauthorized or potentially malicious software

   Source: Adapted from community discussion — AhmedAbdalla

   Next question

6. Question 16 · 334 in bank

   An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?

   • Adata from a CD copied using Mac-based system
   • Bdata from a CD copied using Linux system
   • Cdata from a DVD copied using Windows system
   • Ddata from a CD copied using Windows

   Show answer

   Answer: D

   Explanation

   CDfs is a virtual file system for Unix-like operating systems; it provides access to data and audio tracks on Compact Discs. When the CDfs driver mounts a Compact Disc, it represents each track as a file. This is consistent with the Unix convention "everything is a file". Source: https://en.wikipedia.org/wiki/CDfs

   Source: Adapted from community discussion — anonymous1966

   Next question

7. Question 17 · 334 in bank

   Which piece of information is needed for attribution in an investigation?

   • Aproxy logs showing the source RFC 1918 IP addresses
   • BRDP allowed from the Internet
   • Cknown threat actor behavior
   • D802.1x RADIUS authentication pass arid fail logs

   Show answer

   Answer: C

   Explanation

   Attribution - The action of regarding something as being caused by a person or thing; identifies a source or cause of something. - Synonym: Attribute, Characteristic, Feature, Trait, Quality

   Source: Adapted from community discussion — SecurityGuy

   Next question

8. Question 18 · 334 in bank

   What does cyber attribution identify in an investigation?

   • Acause of an attack
   • Bexploit of an attack
   • Cvulnerabilities exploited
   • Dthreat actors of an attack

   Show answer

   Answer: D

   Explanation

   Cyber attribution in an investigation is the process of identifying the threat actors who are responsible for an attack. Cyber attribution involves collecting and analyzing various types of data, including network logs, malware samples, social media activity, and other intelligence sources, to identify the individuals, groups, or nations responsible for the attack. The process of cyber attribution can help identify the motives, methods, and capabilities of the attackers, which can be useful in preventing future attacks and in pursuing legal action against the perpetrators.

   Source: Adapted from community discussion — drdecker100

   Next question

9. Question 19 · 334 in bank

   A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor. Which type of evidence is this?

   • Abest evidence
   • Bprima facie evidence
   • Cindirect evidence
   • Dphysical evidence

   Show answer

   Answer: C

   Explanation

   Prima Facie Evidence - Sometimes called presumptive evidence, uses other types of evidence gathered from a crime scene to make a plausible or reasonable assumption. Indirect or Circumstantial Evidence - It describes information that doesn't directly connect a defendant to a crime but rather implies a connection exists. (Eyewitness, Witness, Fingerprint) Physical Evidence or Real Evidence - It is a material object with a connection to the defendant's potential role in a crime. Two Types of Physical Evidence: - Individual Physical Evidence - involves pieces that are unique to a person, such as DNA or fingerprints. - Class Physical Evidence - Relates to a certain segment of the population, which may help professionals narrow down a list of suspects. Examples of class physical evidence include blood type, tire tread and weapon manufacturers. https://www.indeed.com/career-advice/career-development/different-types-of-evidence

   Source: Adapted from community discussion — SecurityGuy

   Next question

10. Question 20 · 334 in bank

    DRAG DROP - Drag and drop the type of evidence from the left onto the description of that evidence on the right. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    I'm pretty sure it should be: -C2 Log = Best -Firewall Log = Corroborative -Netflow = Indirect The C2 log seems to be direct evidence of a crime, while the firewall log seems to be corroborating that 'something' is happening, while the netflow spike is only circumstantial (could be indicative of something else happening, could not be).

    Source: Adapted from community discussion — Mevijil

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 11. 334 questions available.