200-201 practice questions 291–300

1. Question 291 · 334 in bank

   

   Refer to the exhibit. What should be interpreted from this packet capture?

   • A81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.
   • B192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.
   • C192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.
   • D81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP protocol.

   Show answer

   Answer: B

   Next question

2. Question 292 · 334 in bank

   Select 2

   What are the two characteristics of the full packet captures? (Choose two.)

   • AIdentifying network loops and collision domains.
   • BTroubleshooting the cause of security and performance issues.
   • CReassembling fragmented traffic from raw data.
   • DDetecting common hardware faults and identify faulty assets.
   • EProviding a historical record of a network transaction.

   Show answer

   Answer: BE

   Explanation

   "C" is correct. IP Reassembly IP Reassembly is a feature in Wireshark and TShark to automatically reassemble all fragmented IP Datagrams into a full IP packet before calling the higher layer dissector. Ref: https://wiki.wireshark.org/IP_Reassembly This feature will require a lot of extra memory to be consumed by wireshark in order to store the reassembly buffers and is disabled by default. "E" is correct. By the book: Packet captures provide a full historical record of a network transaction or an attack. It is important to recognize that no other data source offers this level of detail. There are many study of cases of using Wireshark to troubleshooting the cause of security and performance issues. So, "B" would also be right. But the other options are more direct.

   Source: Adapted from community discussion — anonymous1966

   Next question

3. Question 293 · 334 in bank

   

   Refer to the exhibit. An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?

   • AThe file has an embedded executable and was matched by PEiD threat signatures for further analysis.
   • BThe file has an embedded non-Windows executable but no suspicious features are identified.
   • CThe file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.
   • DThe file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.

   Show answer

   Answer: C

   Next question

4. Question 294 · 334 in bank

   What is rule-based detection when compared to statistical detection?

   • Aproof of a user's identity
   • Bproof of a user's action
   • Clikelihood of user's action
   • Dfalsification of a user's identity

   Show answer

   Answer: B

   Explanation

   A and D are not right because both detections have nothing to do with idenity. C is incorrect as statistical detection would concern with the likelihood so B is the correct answer.

   Source: Adapted from community discussion — Leo_Visser

   Next question

5. Question 295 · 334 in bank

   DRAG DROP - Drag and drop the technology on the left onto the data type the technology provides on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The correct answer is: StateFull Firewall, TCPDUMP, Cisco Umbrella, Snort StateFull Firewall --> Session data Session data is data about a network session that is usually established between two devices either on the same network or remote networks. Session data contains the following elements, which are used to identify the details within the network session: Source and destination IP addresses Source and destination service ports Layer 3 protocol details and code TCPDUMP --> full packet capture Cisco Umbrella (DNS) --> Transaction Data The actual data that is exchanged during a session is known as transaction data. The actual data that is being sent across the network. Snort (IDS) --> connection event Connection events – These events are generated when a device establishes a session with another device on the network. When a session is detected by NGIPS, it creates a connection log that contains all the information about the session/connection itself. Reference: Book Cisco Certified CyberOps Associate 200-201 Certification Guide - By Glen D. Singh

   Source: Adapted from community discussion — anonymous1966

   

   Next question

6. Question 296 · 334 in bank

   

   Refer to the exhibit. What is occurring in this network traffic?

   • AHigh rate of SYN packets being sent from a multiple source towards a single destination IP.
   • BHigh rate of ACK packets being sent from a single source IP towards multiple destination IPs.
   • CFlood of ACK packets coming from a single source IP to multiple destination IPs.
   • DFlood of SYN packets coming from a single source IP to a single destination IP.

   Show answer

   Answer: D

   Explanation

   In the provided network traffic capture, there is a flood of SYN packets (Synchronize) coming from a single source IP (10.128.0.2) to a single destination IP (10.0.0.2) on port 80. This is indicative of an attempt to establish multiple TCP connections. Therefore, the correct answer is D. Flood of SYN packets coming from a single source IP to a single destination IP

   Source: Adapted from community discussion — AhmedAbdalla

   Next question

7. Question 297 · 334 in bank

   Select 2

   An engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Application Visibility and Control should the engineer use to accomplish this goal? (Choose two.)

   • Amanagement and reporting
   • Btraffic filtering
   • Cadaptive AVC
   • Dmetrics collection and exporting
   • Eapplication recognition

   Show answer

   Answer: DE

   Explanation

   Correct D and E AVC can do many things. Attention to the question. The engineering needs: visibility on several parameters - metrics collection and exporting (D) identify unknown software by its network traffic flow - application recognition (E)

   Source: Adapted from community discussion — anonymous1966

   Next question

8. Question 298 · 334 in bank

   Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

   • AHypertext Transfer Protocol
   • BSSL Certificate
   • CTunneling
   • DVPN

   Show answer

   Answer: B

   Next question

9. Question 299 · 334 in bank

   An engineer is investigating a case of the unauthorized usage of the `Tcpdump` tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

   • Atagged protocols being used on the network
   • Ball firewall alerts and resulting mitigations
   • Ctagged ports being used on the network
   • Dall information and data within the datagram

   Show answer

   Answer: D

   Explanation

   using verbose parameter (-v or -vv) increases the amount of detail shown in the output, showing more than tagged protocols.

   Source: Adapted from community discussion — fejec

   Next question

10. Question 300 · 334 in bank

    At a company party a guest asks questions about the company's user account format and password complexity. How is this type of conversation classified?

    • APhishing attack
    • BPassword Revelation Strategy
    • CPiggybacking
    • DSocial Engineering

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 291. 334 questions available.