200-201 practice questions 241–250

1. Question 241 · 334 in bank

   

   Refer to the exhibit. What is occurring in this network traffic?

   • Alegitimate network traffic
   • Bflood of SYN-ACK packets
   • CICMP flood
   • Dflood of SYN packets

   Show answer

   Answer: D

   Next question

2. Question 242 · 334 in bank

   An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time. Which technology makes this behavior feasible?

   • Aaccess control list
   • BNAT
   • Cencryption
   • Dtunneling

   Show answer

   Answer: D

   Explanation

   In the context of detecting data exfiltration, tunnels can be used to encapsulate and hide network traffic within another protocol, such as DNS. This allows attackers to transfer data out of a network without being easily detected, as DNS traffic is common and often not closely inspected for performance reasons. The high number of DNS requests in a short period of time could be indicative of an attempt at covert data exfiltration using DNS tunnels, where data is hidden within DNS traffic to avoid detection.

   Source: Adapted from community discussion — KevinCondor

   Next question

3. Question 243 · 334 in bank

   DRAG DROP - Drag and drop the uses on the left onto the type of security system on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

4. Question 244 · 334 in bank

   A forensic investigator is analyzing a recent breach case. An external USB drive was discovered to be connected and transmitting the data outside of the organization, and the owner of the USB drive could not be identified. Video surveillance shows six people during a two-month period had close contact with the affected asset. How must this type of evidence be categorized?

   • Abest evidence
   • Bindirect evidence
   • Cdirect evidence
   • Dcorroborative evidence

   Show answer

   Answer: D

   Next question

5. Question 245 · 334 in bank

   

   Refer to the exhibit. An engineer received a ticket to analyze unusual network traffic. What is occurring?

   • Adata exfiltration
   • Bregular network traffic; no suspicious activity
   • Cdenial-of-service attack
   • Dcookie poisoning

   Show answer

   Answer: C

   Explanation

   Answer should be C considering that its the same Source and Destination IP's along with the ICMP protocol being continuously used.

   Source: Adapted from community discussion — cecb9b9

   Next question

6. Question 246 · 334 in bank

   What is a benefit of agent-based protection when compared to agentless protection?

   • AIt lowers maintenance costs
   • BIt provides a centralized platform
   • CIt collects and detects all traffic locally
   • DIt manages numerous devices simultaneously

   Show answer

   Answer: C

   Explanation

   Answer is C. Host-based antivirus protection is also known as agent-based. Agent-based antivirus runs on every protected machine. Agentless antivirus protection performs scans on hosts from a centralized system. Agentless systems have become popular for virtualized environments in which multiple OS instances are running on a host simultaneously. Agent-based antivirus running in each virtualized system can be a serious drain on system resources. Agentless antivirus for virtual hosts involves the use of a special security virtual appliance that performs optimized scanning tasks on the virtual hosts. An example of this is VMware’s vShield.

   Source: Adapted from community discussion — skysoft

   Next question

7. Question 247 · 334 in bank

   What is the difference between the rule-based detection when compared to behavioral detection?

   • ARule-Based detection is searching for patterns linked to specific types of attacks, while behavioral is identifying per signature.
   • BRule-Based systems have established patterns that do not change with new data, while behavioral changes.
   • CBehavioral systems are predefined patterns from hundreds of users, while Rule-Based only flags potentially abnormal patterns using signatures.
   • DBehavioral systems find sequences that match a particular attack signature, while Rule-Based identifies potential attacks.

   Show answer

   Answer: B

   Explanation

   Isn't the correct answer B, it says it has a predefined collection of paterns which it uses to detect the attack but as far as I know the Behavioral Detection keeps analysing the network and changes the baseline accordingly. Here (https://www.cisco.com/c/en/us/products/security/what-is-network-detection-response.html) it says "NDR solutions continuously monitor and analyze raw enterprise network traffic to generate a baseline of normal network behavior." So that would suggest that answer B is more correct because C would suggest that after the baseline is generated it doesn't change at all anymore. It also says this in the stealthwatch documentation "After the initial 7 days, Stealthwatch tracks 14 key attributes to create a rolling 28-day baseline. This baseline is the average of the daily attribute values for the past 28 days, heavily weighted for the last 7 days. Since the baseline incorporates the last seven days, these are used to represent weekly values. Therefore, the baseline includes values for the previous month, but is heavily weighted to the most recent week. " So I would really say B is the right answer.

   Source: Adapted from community discussion — Leo_Visser

   References

   • Cisco documentation

   Next question

8. Question 248 · 334 in bank

   

   Refer to the exhibit. What is occurring?

   • AARP spoofing attack
   • Bman-in-the-middle attack
   • Cbrute-force attack
   • Ddenial-of-service attack

   Show answer

   Answer: D

   Explanation

   The exhibit shows a series of TCP SYN packets being sent from a range of public IP addresses to a single destination, `192.168.0.1`, on port 80 (HTTP). Each connection attempt starts with a SYN flag, and no subsequent flags (such as SYN-ACK or ACK) are visible. This pattern indicates a **Denial-of-Service (DoS) attack**, specifically a **SYN flood**. In a SYN flood attack, the attacker sends a large number of SYN requests to a target but does not complete the three-way TCP handshake. This causes the target's resources to become overwhelmed by the half-open connections, potentially leading to service disruption. ### Correct Answer: **D. denial-of-service attack**

   Source: Adapted from community discussion — Hellome123

   Next question

9. Question 249 · 334 in bank

   What technology should be used for the verified and secure exchange of public keys between entities Tom0123456789 and Dan9876543210?

   • APassword-Authenticated Key Exchange
   • BEncrypted Key Exchange
   • CKey Encapsulation Mechanism
   • DInitial Key Sharing

   Show answer

   Answer: C

   Next question

10. Question 250 · 334 in bank

    A security incident occurred with the potential of impacting business services. Who performs the attack?

    • Athreat actor
    • Bmalware author
    • Cdirect competitor
    • Dbug bounty hunter

    Show answer

    Answer: A

    Explanation

    Reference: https://www.paubox.com/blog/what-is-threat-actor/#:~:text=The%20term%20threat%20actor%20refers,CTA)%20when%20referencing% 20cybersecurity%20issues

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 241. 334 questions available.