Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
334 questions in this bank
Free access · progress saved on this device
Why is encryption challenging to security monitoring?
Answer: B
B is the correct answer "On the other hand, those same mechanisms can be used by threat actors as a method of evasion and obfuscation. " https://www.ciscopress.com/articles/article.asp?p=3100055&seqNum=2
Source: Adapted from community discussion — Leo_Visser
What is session data used for in network security?
Answer: D
Which evasion method involves performing actions slower than normal to prevent detection?
Answer: A
After a large influx of network traffic to externally facing devices, a security engineer begins investigating what appears to be a denial of service attack. When the packet capture data is reviewed, the engineer notices that the traffic is a single SYN packet to each port. Which type of attack is occurring?
Answer: B
What is the dataflow set in the NetFlow flow-record format?
Answer: D
Data FlowSet-a data FlowSet is a collection of one or more data records that have been grouped together in an export packet. Data record-A data record provides information about an IP flow that exists on the device that produced an export packet.
Source: Adapted from community discussion — c79ecd3
According to CVSS, what is attack complexity?
Answer: B
By the book: Attack Complexity (AC) measures the difficulty of exploitation, with Low (L) requiring no special conditions and High (H) needing specific preconditions. This metric indicates conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Answer B is correct.
Source: Adapted from community discussion — ImGonnaPassIt
An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?
Answer: B
the question says "The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts." which means that a successful login with known credentials would have been ignored as valid system usage, and not dinspected as malicious. I believe the Given answer of _"KNOWN CREDENTIALS" is the correct answer
Source: Adapted from community discussion — jb372
What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)
Answer: DE
Refer to exhibit. An engineer is investigating an intrusion and is analyzing the pcap file. Which two key elements must an engineer consider? (Choose two.)
Answer: AB
Refer to the exhibit. Which attack is being attempted against a web application?
Answer: A
The presence of /bin/sh -c id indicates that the attacker is attempting to execute the id command, which is commonly used to obtain information about the current user and the groups they belong to on the system. This is a clear indicator of a command injection attempt. Therefore, the correct answer is option A: command injection.
Source: Adapted from community discussion — KevinCondor
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 221. 334 questions available.
Version 1.0.0. How we source questions