200-201 practice questions 271–280

1. Question 271 · 334 in bank

   

   Refer to the exhibit. Which type of log is displayed?

   • AIDS
   • Bproxy
   • CNetFlow
   • Dsys

   Show answer

   Answer: A

   Explanation

   You also see the 5-tuple in IPS events, NetFlow records, and other event data. In fact, on the exam you may need to differentiate between a firewall log versus a traditional IPS or IDS event. One of the things to remember is that traditional IDS and IPS use signatures, so an easy way to differentiate is by looking for a signature ID (SigID). If you see a signature ID, then most definitely the event is a traditional IPS or IDS event. Cisco CyberOps Associate_P861 CBROPS 200-201 Official Cert Guide Omar Santos

   Source: Adapted from community discussion — addpro7

   Next question

2. Question 272 · 334 in bank

   What is the purpose of command and control for network-aware malware?

   • AIt controls and shuts down services on the infected host.
   • BIt helps the malware to profile the host.
   • CIt contacts a remote server for commands and updates.
   • DIt takes over the user account for analysis.

   Show answer

   Answer: C

   Next question

3. Question 273 · 334 in bank

   

   Refer to the exhibit. What information is depicted?

   • AIIS data
   • BNetFlow data
   • Cnetwork discovery event
   • DIPS event data

   Show answer

   Answer: B

   Next question

4. Question 274 · 334 in bank

   Which element is included in an incident response plan as stated in NIST.SP800-617

   • Asecurity of sensitive information
   • Bindividual approach to incident response
   • Cconsistent threat identification
   • Dapproval of senior management

   Show answer

   Answer: D

   Next question

5. Question 275 · 334 in bank

   What is the difference between the ACK flag and the RST flag in the NetFlow log session?

   • AThe RST flag confirms the beginning of the TCP connection, and the ACK flag responds when the data for the payload is complete
   • BThe ACK flag confirms the beginning of the TCP connection, and the RST flag responds when the data for the payload is complete
   • CThe RST flag confirms the receipt of the prior segment, and the ACK flag allows for the spontaneous termination of a connection
   • DThe ACK flag confirms the receipt of the prior segment, and the RST flag allows for the spontaneous termination of a connection

   Show answer

   Answer: D

   Next question

6. Question 276 · 334 in bank

   

   Refer to exhibit. Which alert is identified from this packet?

   • ASSDP amplification
   • BSYN flood
   • CTCP fragmentation attack
   • DFraggle attack

   Show answer

   Answer: B

   Next question

7. Question 277 · 334 in bank

   

   Refer to the exhibit. Which type of log is displayed?

   • Aproxy
   • BNetFlow
   • CIDS
   • Dsys

   Show answer

   Answer: B

   Next question

8. Question 278 · 334 in bank

   Which statement describes patch management?

   • Ascanning servers and workstations for missing patches and vulnerabilities
   • Bprocess of appropriate distribution of system or software updates
   • Cmanaging and keeping previous patches lists documented for audit purposes
   • Dworkflow of distributing mitigations of newly found vulnerabilities

   Show answer

   Answer: B

   Next question

9. Question 279 · 334 in bank

   How is NetFlow different from traffic mirroring?

   • ANetFlow collects metadata and traffic mirroring clones data.
   • BTraffic mirroring impacts switch performance and NetFlow does not.
   • CTraffic mirroring costs less to operate than NetFlow.
   • DNetFlow generates more data than traffic mirroring.

   Show answer

   Answer: A

   Explanation

   NetFlow is a protocol developed by Cisco that allows network administrators to collect metadata about network traffic, such as source and destination IP addresses, traffic volumes, and protocols used. NetFlow works by capturing traffic at the network layer and generating flow records, which are then exported to a collector for further analysis. NetFlow data is typically used for network traffic analysis, capacity planning, and security monitoring. Traffic mirroring, on the other hand, involves copying network traffic from a switch port and sending it to another port for analysis. This allows administrators to capture and inspect all of the data contained in the mirrored traffic, including payload content.

   Source: Adapted from community discussion — drdecker100

   Next question

10. Question 280 · 334 in bank

    What makes HTTPS traffic difficult to monitor?

    • ASSL interception
    • Bpacket header size
    • Csignature detection time
    • Dencryption

    Show answer

    Answer: D

    Explanation

    HTTPS traffic is difficult to monitor because it is encrypted, which makes it more difficult for network administrators and security systems to inspect the contents of the traffic. The encryption used by HTTPS, which is typically based on SSL/TLS, ensures that data transmitted between the client and server is secure and cannot be easily intercepted or tampered with by third parties. However, this also means that anyone trying to monitor or inspect the traffic would need to decrypt it first in order to see its contents.

    Source: Adapted from community discussion — drdecker100

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 271. 334 questions available.