Question 231 · 334 in bank
What is the impact of false negative alerts when compared to true negative alerts?
Show answer
Answer: A
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
334 questions in this bank
Free access · progress saved on this device
What is the impact of false negative alerts when compared to true negative alerts?
Answer: A
A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?
Answer: C
"C" is correct. Threat actors are the individuals (or a group of individuals) who perform an attack or are responsible for a security incident that impacts or has the potential of impacting an organization or individual. There are several types of threat actors: Script kiddies, Organized crime groups, State sponsors and governments, Hacktivists, Terrorist groups. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide By Omar Santos
Source: Adapted from community discussion — anonymous1966
What matches the regular expression r(ege)+x?
Answer: A
What is the relationship between a vulnerability and a threat?
Answer: A
A vulnerability refers to a known weakness of an asset (resource) that can be exploited by one or more attackers. A threat refers to a new or newly discovered incident that has the potential to harm a system or your company overall. So a threat exploits a vulnerability so A is right
Source: Adapted from community discussion — Leo_Visser
An analyst performs traffic analysis to detect suspicious activity and identifies the multiple UDP connections through the same port. Which technology makes this behavior feasible?
Answer: D
The correct answer is: D. NAT Explanation: NAT allows multiple devices on a private network to access the internet using a single public IP address. It achieves this by translating the private IP addresses into the public IP and using port numbers to distinguish between connections. This behavior makes it feasible for multiple UDP connections through the same port because NAT tracks the connections based on the combination of source IP, source port, destination IP, and destination port.
Source: Adapted from community discussion — mgo28404
Which of these is a defense-in-depth strategy principle?
Answer: B
What is the impact of encryption on data visibility?
Answer: C
C is correct. A. TLS 1.3 traffic cannot be decrypted and monitored. This is incorrect. While TLS 1.3 introduces new security features, it can still be decrypted and monitored with the appropriate tools and techniques.
Source: Adapted from community discussion — imbatnom
What is the principle of defense-in-depth?
Answer: B
B is correct. By the book: If you are a cybersecurity expert, or even an amateur, you probably already know that when you deploy a firewall or an intrusion prevention system or install antivirus or advanced malware protection on your machine, you cannot assume you are now safe and secure. A layered and cross-boundary “defense-in-depth” strategy is what is needed to protect your network and corporate assets. One of the primary benefits of a defense-in-depth strategy is that even if a single control (such as a firewall or IPS) fails, other controls can still protect your environment and assets.
Source: Adapted from community discussion — anonymous1966
Which two protocols are used for DDoS amplification attacks? (Choose two.)
Answer: BE
Two protocols commonly used for DDoS (Distributed Denial of Service) amplification attacks are: DNS (Domain Name System): DNS amplification attacks exploit the large response sizes that can be generated by DNS queries. Attackers spoof the source IP address of the DNS query to make it appear as if it originated from the victim's IP address. The DNS servers then send their responses, which can be significantly larger than the original query, to the victim's IP address, flooding it with unwanted traffic. NTP (Network Time Protocol): NTP amplification attacks exploit the Monlist feature in older versions of NTP servers. Attackers send a specially crafted request to an NTP server, asking for a list of the last clients that connected to it (Monlist). The response generated by the NTP server can be much larger than the request, allowing attackers to amplify their attack traffic. This method is similar to DNS amplification but involves NTP servers instead.
Source: Adapted from community discussion — 2StepsFromHell
An engineer must create a SIEM rule to test events and traffic for spikes and changes that occur in regular patterns to detect irregularities. Which rules achieve the desired results?
Answer: A
The correct answer is: A. Anomaly Why ? : Anomaly detection rules are designed to identify deviations from established baselines or normal behavior patterns. These rules are highly effective for detecting spikes, changes, and irregularities in event and traffic patterns. Anomaly detection works by: Comparing current data to historical baselines. Identifying unusual activity, such as traffic spikes, failed login attempts, or data exfiltration attempts.
Source: Adapted from community discussion — mgo28404
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 231. 334 questions available.
Version 1.0.0. How we source questions