200-201 practice questions 261–270

1. Question 261 · 334 in bank

   An engineer must profile new servers that have been released recently and must identify running web services on nonstandard ports. Why is the probe returning no result?

   • APort 80 or 443 is blocked by the firewall.
   • BServers use IPs from the DHCP server.
   • CThe policy Is allowing Initial collection of data.
   • DListening ports can use a range between 1 and 65535.

   Show answer

   Answer: D

   Next question

2. Question 262 · 334 in bank

   What is a difference between SIEM and SOAR?

   • ASIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.
   • BSIEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.
   • CSOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.
   • DSOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

   Show answer

   Answer: B

   Explanation

   Reference: https://www.cisco.com/c/en/us/products/security/what-is-a-security-platform.html

   Next question

3. Question 263 · 334 in bank

   What is vulnerability management?

   • AA process to identify and remediate existing weaknesses.
   • BA process to recover from service interruptions and restore business-critical applications.
   • CA security practice of performing actions rather than acknowledging the threats.
   • DA security practice focused on clarifying and narrowing intrusion points.

   Show answer

   Answer: A

   Explanation

   Reference: https://www.brinqa.com/vulnerability-management-primer-part-2-challenges/

   Source: Adapted from community discussion — eggheadsv

   Next question

4. Question 264 · 334 in bank

   What is a difference between signature-based and behavior-based detection?

   • ASignature-based identifies behaviors that may be linked to attacks, while behavior-based has a predefined set of rules to match before an alert.
   • BBehavior-based identifies behaviors that may be linked to attacks, while signature-based has a predefined set of rules to match before an alert.
   • CBehavior-based uses a known vulnerability database, while signature-based intelligently summarizes existing data.
   • DSignature-based uses a known vulnerability database, while behavior-based intelligently summarizes existing data.

   Show answer

   Answer: B

   Explanation

   Signature-based detection and behavior-based detection are two common approaches used in cybersecurity to detect and prevent attacks. The main difference between these two methods is how they identify potential threats. Signature-based detection involves using a predefined set of rules, or signatures, to identify known patterns of malicious activity. These signatures are often based on specific characteristics of a known threat, such as a particular virus or malware strain. When a signature-based system detects a pattern that matches one of these predefined rules, it generates an alert or takes some other action to prevent the attack. On the other hand, behavior-based detection focuses on identifying abnormal behavior that may indicate an attack. Instead of using predefined rules or signatures, behavior-based systems analyze patterns of activity to identify anomalies that may be indicative of an attack. For example, a behavior-based system might flag an unusual amount of network traffic from a particular device or identify a user accessing a critical system outside of normal business hours.

   Source: Adapted from community discussion — drdecker100

   Next question

5. Question 265 · 334 in bank

   What is a scareware attack?

   • Ainserting malicious code that causes popup windows with flashing colors
   • Boverwhelming a targeted website with fake traffic
   • Cgaining access to your computer and encrypting data stored on it
   • Dusing the spoofed email addresses to trick people into providing login credentials

   Show answer

   Answer: A

   Next question

6. Question 266 · 334 in bank

   When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification. Which information is available on the server certificate?

   • Aserver name, trusted subordinate CA, and private key
   • Btrusted subordinate CA, public key, and cipher suites
   • Ctrusted CA name, cipher suites, and private key
   • Dserver name, trusted CA, and public key

   Show answer

   Answer: D

   Explanation

   The server wont never share it's private key, so A and C are not right, and the cypher suite is in the handshake, not the certificate so B isn't right either. so D is correct.

   Source: Adapted from community discussion — Leo_Visser

   Next question

7. Question 267 · 334 in bank

   Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

   • Adecision making
   • Brapid response
   • Cdata mining
   • Ddue diligence

   Show answer

   Answer: D

   Explanation

   Due diligence is the process of gathering and analyzing all relevant information before making a decision or taking action. In the context of security incidents, due diligence involves gathering and analyzing all available information about the incident, such as the nature of the threat, the extent of the damage or potential damage, and the possible impact on the organization's operations and assets. This information is then used to determine the appropriate course of action, such as containing and mitigating the threat, restoring systems and data, and identifying and addressing any underlying vulnerabilities

   Source: Adapted from community discussion — EVL87

   References

   • nist.gov documentation

   Next question

8. Question 268 · 334 in bank

   How does an SSL certificate impact security between the client and the server?

   • Aby enabling an authenticated channel between the client and the server
   • Bby creating an integrated channel between the client and the server
   • Cby enabling an authorized channel between the client and the server
   • Dby creating an encrypted channel between the client and the server

   Show answer

   Answer: D

   Explanation

   An SSL certificate is a security credential that binds a public key to a website's identity. When a user visits a website that uses SSL, the browser will verify the website's certificate and establish an encrypted connection between the client and the server. This ensures that all data exchanged between the client and the server is protected from eavesdropping and tampering.

   Source: Adapted from community discussion — Faio

   Next question

9. Question 269 · 334 in bank

   Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

   • Aforgery attack
   • Bplaintext-only attack
   • Cciphertext-only attack
   • Dmeet-in-the-middle attack

   Show answer

   Answer: C

   Explanation

   In a ciphertext-only attack, an attacker intercepts two ciphertexts encrypted using the same key and tries to obtain information about the plaintext or the key. With two ciphertexts encrypted using the same key, an attacker can XOR the two ciphertexts together to obtain the XOR of the two plaintexts. If the attacker can guess or obtain some of the plaintext, they can use it to recover the other plaintext by XORing it with the XOR of the two ciphertexts. This can allow the attacker to obtain the key and decrypt other messages encrypted using the same key. Therefore, it is important to use a unique key for each encryption operation when using a stream cipher like RC4 to avoid such vulnerabilities.

   Source: Adapted from community discussion — drdecker100

   Next question

10. Question 270 · 334 in bank

    Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?

    • AClientStart, ClientKeyExchange, cipher-suites it supports, and suggested compression methods
    • BClientStart, TLS versions it supports, cipher-suites it supports, and suggested compression methods
    • CClientHello, TLS versions it supports, cipher-suites it supports, and suggested compression methods
    • DClientHello, ClientKeyExchange, cipher-suites it supports, and suggested compression methods

    Show answer

    Answer: C

    Explanation

    During the negotiation phase of the TLS handshake, the client sends a ClientHello message to the server, which includes information about the TLS versions it supports, cipher-suites it supports, suggested compression methods, and other information. Therefore, the list that identifies the information that the client sends to the server in the negotiation phase of the TLS handshake is: ClientHello, TLS versions it supports, cipher-suites it supports, and suggested compression methods. Option D is incorrect because ClientKeyExchange is sent later in the handshake, after the negotiation phase.

    Source: Adapted from community discussion — drdecker100

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 261. 334 questions available.