200-201 practice questions 201–210

1. Question 201 · 334 in bank

   Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

   • Aintegrity
   • Bconfidentiality
   • Cavailability
   • Dscope

   Show answer

   Answer: A

   Explanation

   Correct answer is A "2.3.2. Integrity (I) This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. The Base Score is greatest when the consequence to the impacted component is highest." source: https://www.first.org/cvss/specification-document

   Source: Adapted from community discussion — Leo_Visser

   Next question

2. Question 202 · 334 in bank

   A cyberattacker notices a security flaw in a software that a company is using. They decide to tailor a specific worm to exploit this flaw and extract saved passwords from the software. To which category of the Cyber Kill Chain model does this event belong?

   • Aweaponization
   • Breconnaissance
   • Cdelivery
   • Dexploitation

   Show answer

   Answer: A

   Explanation

   The attacker is tailoring a specific worm to exploit a security flaw and extract saved passwords from the software. I think it should be Weaponization

   Source: Adapted from community discussion — fisher004

   Next question

3. Question 203 · 334 in bank

   A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?

   • Areconnaissance
   • Baction on objectives
   • Cinstallation
   • Dexploitation

   Show answer

   Answer: D

   Explanation

   The correct answer should be Delivery. But, in this case, I would choose "C" - instalation. Here are the steps of the Kill Chain Model: Reconnaissance --> Weaponization --> Delivery --> Exploitation --> Installation --> Command and control (C2 or CnC) --> Actions on objectives 1) Reconnaissance: research on a target, search vulnerabilities. Ex: nmap 2) Weaponization: develop and test how the attack will be executed. Buld the "weapon". Ex: a file trojan. 3) Delivery: deliver the weapon against target. Ex: phishing 4) Exploitation: launch the weapon against a vulnerability. Ex: user open a trojan file. 5) Installation: instalation of the weapon in the target: Ex: a backdoor server 6) Command and control (C2 or CnC): the attacker accesses the breached system. Ex: orchestration of zumbi hosts 7) Actions on objectives: launching the attack. Ex: stole credit card number/password. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide By Omar Santos

   Source: Adapted from community discussion — anonymous1966

   Next question

4. Question 204 · 334 in bank

   Select 2

   

   Refer to the exhibit. An attacker gained initial access to the company’s network and ran an Nmap scan to advance with the lateral movement technique and to search the sensitive data. Which two elements can an attacker identify from the scan? (Choose two.)

   • Aworkload and the configuration details
   • Bfunctionality and purpose of the server
   • Cnumber of users and requests that the server is handling
   • Drunning services
   • Euser accounts and SID

   Show answer

   Answer: BD

   Next question

5. Question 205 · 334 in bank

   

   Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?

   • AFrames No. 20064 and 20066
   • BFrame No. 20064
   • CFrame No. 20086
   • DAll Frames from No. 20061 to 20064

   Show answer

   Answer: D

   Explanation

   D. All Frames from No. 20061 to 20064 Here's why: Frame 20061: This frame shows the beginning of a TCP reassembled PDU (Packet Data Unit) with a length of 60512 bytes. This suggests that a file transfer is starting. Frame 20062: This frame continues the reassembled PDU, indicating that the file transfer is ongoing. Frame 20063: This frame shows the end of the reassembled PDU with a "TCP segment of a reassembled PDU" label, confirming that the file transfer is complete. Frame 20064: This frame shows a 75-byte payload identified as "Protected Payload (KPO), DCID-094e3bea2bcfbcce". This suggests that the extracted file might be encrypted or obfuscated in some way. Frames 20065 and 20066 show subsequent traffic related to HTTP and QUIC protocols, but not directly related to the file transfer initiated in frame 20061. Therefore, all frames from 20061 to 20064, including the reassembled PDU and the protected payload, are likely to contain the extractable file.

   Source: Adapted from community discussion — sheyshey

   Next question

6. Question 206 · 334 in bank

   

   Refer to the exhibit. What does this Cuckoo sandbox report indicate?

   • AThe file is ransomware.
   • BThe file is spyware.
   • CThe file will open unsecure ports when executed.
   • DThe file will open a command interpreter when executed.

   Show answer

   Answer: D

   Explanation

   opening a shell/terminal for the user /or/ opening a reverse shell for the attacker? answer is a little misleading, my best guess

   Source: Adapted from community discussion — anon_learns_cisco

   Next question

7. Question 207 · 334 in bank

   What is a comparison between rule-based and statistical detection?

   • AStatistical is based on measured data while rule-based uses the evaluated probability approach.
   • BStatistical uses the probability approach while rule-based is based on measured data.
   • CRule-based is based on assumptions and statistical uses data known beforehand.
   • DRule-based uses data known beforehand and statistical is based on assumptions.

   Show answer

   Answer: D

   Next question

8. Question 208 · 334 in bank

   Select 2

   What are the two differences between vulnerability and exploit? (Choose two.)

   • AVulnerabilities can be found in hardware and software, and exploits can be used only for software-based vulnerabilities.
   • BZero-day exploit can be used to take advantage of a vulnerability until the vulnerable software or hardware is patched.
   • CKnown vulnerabilities are assigned special CVE numbers, and exploits are using process to take advantage of vulnerabilities.
   • DZero-day exploit can be used for taking advantage of a known vulnerability, and cyber-attack can be performed on company assets.
   • EVulnerabilities are usually populated in the dark web, and exploit tools and methods can be found in the public web.

   Show answer

   Answer: BC

   Explanation

   The correct answer is B and C. Remember CVE numbers are assigned to known vulnerabilities. Zero-day exploits are able to take advantage of a vulnerability until the vulnerable software or hardware is patched.

   Source: Adapted from community discussion — GreyDagger

   Next question

9. Question 209 · 334 in bank

   What specific type of analysis is assigning values to the scenario to see expected outcomes?

   • Adeterministic
   • Bexploratory
   • Cprobabilistic
   • Ddescriptive

   Show answer

   Answer: A

   Explanation

   "In deterministic models, the output of the model is fully determined by the parameter values and the initial values, whereas probabilistic (or stochastic) models incorporate randomness in their approach. Consequently, the same set of parameter values and initial conditions will lead to a group of different outputs. " https://www.preventionweb.net/disaster-risk/concepts/deterministic-probabilistic/ So A seems to be correct

   Source: Adapted from community discussion — Leo_Visser

   Next question

10. Question 210 · 334 in bank

    

    Refer to the exhibit. A network engineer is analyzing a network activity within captured traffic. An engineer notices suspicious behavior, a type of ICMP that Wireshark does not recognize. What is occurring?

    • AThese are failed communication attempts because ICMP communication is administratively prohibited.
    • BThese are responses from destination because the destination network is unreachable for this type of service.
    • CWireshark cannot map the type of ICMP requests because they are not legitimate ICMP echo requests.
    • DWireshark cannot map the type due to fragmentation, and fragment ID was not set on the destination host.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 201. 334 questions available.