200-201 practice questions 311–320

1. Question 311 · 334 in bank

   An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network. Which testing method did the intruder use?

   • Asocial engineering
   • Beavesdropping
   • Cpiggybacking
   • Dtailgating

   Show answer

   Answer: A

   Explanation

   The only problem here is that Social Engineering is not a "testing method" it is an attack. But the other alternatives are wrong, so (A) is correct. Social engineering attacks leverage the weakest link, which is the human user. If the attacker can get the user to reveal information, it is much easier for the attacker to cause harm rather than use some other method of reconnaissance. This could be done through email or misdirection of web pages, which results in the user clicking something that leads to the attacker gaining information. Social engineering can also be done in person by an insider or outside entity or over the phone.

   Source: Adapted from community discussion — anonymous1966

   Next question

2. Question 312 · 334 in bank

   Select 2

   What are two social engineering techniques? (Choose two.)

   • Aprivilege escalation
   • BDDoS attack
   • Cphishing
   • Dman-in-the-middle
   • Epharming

   Show answer

   Answer: CE

   Explanation

   From the book: Other social engineering techniques include the following: Phishing, Spear phishing, Pharming (is the term used to describe a threat actor redirecting a victim from a valid website or resource to a malicious one that could be made to appear as the valid site to the user. From there, an attempt is made to extract confidential information from the user or to install malware in the victim’s system. Pharming can be done by altering the host file on a victim’s system, through DNS poisoning, or by exploiting a vulnerability in a DNS server.), Malvertising, SMS phishing, Voice phishing (or vishing), Whaling, Elicitation, interrogation, and impersonation (Pretexting)

   Source: Adapted from community discussion — anonymous1966

   Next question

3. Question 313 · 334 in bank

   

   Refer to the exhibit. What does the output indicate about the server with the IP address 172.18.104.139?

   • Aopen ports of a web server
   • Bopen port of an FTP server
   • Copen ports of an email server
   • Drunning processes of the server

   Show answer

   Answer: C

   Explanation

   Some facts that may be helpful. IMAP (Internet Messaging Access Protocol) - It allows you to access your email wherever you are, from any device. - When you read an email message using IMAP, you aren't actually downloading or storing it on your computer; instead, you're reading it from the email service. POP (Post Office Protocol) - It works by contacting your email service and downloading all of your new messages from it. - Once they are downloaded onto your PC or Mac, they are deleted from the email service. This means that after the email is downloaded, it can only be accessed using the same computer. https://support.microsoft.com/en-us/office/what-are-imap-and-pop-ca2c5799-49f9-4079-aefe-ddca85d5b1c9

   Source: Adapted from community discussion — SecurityGuy

   Next question

4. Question 314 · 334 in bank

   What does the Zero Trust security model signify?

   • AZero Trust security means that no one is trusted by default from inside or outside the network.
   • BZero Trust addresses access control and states that an individual should have only the minimum access privileges necessary to perform specific tasks.
   • CZero Trust states that no users should be given enough privileges to misuse the system on their own.
   • DZero Trust states that unless a subject is given explicit access to an object, it should be denied access to that object.

   Show answer

   Answer: A

   Explanation

   I think it should be A. Whilst Zero Trust applies the principle of least privilege, it primarily assumes by default that no one is trusted.

   Source: Adapted from community discussion — fisher004

   Next question

5. Question 315 · 334 in bank

   An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications Which technology should be used to accomplish the task?

   • Astatic IP addresses
   • Bcipher suite
   • Cdigital certificates
   • Dsignatures

   Show answer

   Answer: C

   Explanation

   The answer is B. c A cipher suite is a set of cryptographic algorithms that are used to secure network communications. By configuring network systems to use a cipher suite that supports decryption, the engineer can inspect the traffic for malicious activity, including command and control communications. The other options are not correct. Option A, static IP addresses, is not a technology that can be used to decrypt traffic. Option C, digital certificates, are used to verify the identity of a sender, but they do not provide encryption. Option D, signatures, are used to verify the integrity of a message, but they do not provide encryption.

   Source: Adapted from community discussion — Faio

   Next question

6. Question 316 · 334 in bank

   What is indicated by an increase in IPv4 traffic carrying protocol 41?

   • Adeployment of a GRE network on top of an existing Layer 3 network
   • Battempts to tunnel IPv6 traffic through an IPv4 network
   • Cunauthorized peer-to-peer traffic
   • Dadditional PPTP traffic due to Windows clients

   Show answer

   Answer: B

   Explanation

   Reference: https://simple.wikipedia.org/wiki/Protocol_41

   Source: Adapted from community discussion — Eng_ahmedyoussef

   Next question

7. Question 317 · 334 in bank

   When an event is investigated, which type of data provides the investigate capability to determine if data exfiltration has occurred?

   • Afirewall logs
   • Bfull packet capture
   • Csession data
   • DNetFlow data

   Show answer

   Answer: B

   Explanation

   B. full packet capture. Other data could be an indicators of data exfiltration. But only packet insight could gives answer.

   Source: Adapted from community discussion — akustic

   Next question

8. Question 318 · 334 in bank

   Which process is used when IPS events are removed to improve data integrity?

   • Adata availability
   • Bdata normalization
   • Cdata signature
   • Ddata protection

   Show answer

   Answer: B

   Explanation

   By using data normalization duplicate data is removed and the overal memory/storage impact is reduced. This will make the data actionable. It's debatable if it really helps with the integrity of the data, but you could argue by removing the duplicates the data can be matched better with timestamps from other data sources in a forensic investigation. So answer B is correct

   Source: Adapted from community discussion — Leo_Visser

   Next question

9. Question 319 · 334 in bank

   Which attack represents the evasion technique of resource exhaustion?

   • ASQL injection
   • Bbluesnarfing
   • Cdenial-of-service
   • Dman-in-the-middle

   Show answer

   Answer: C

   Explanation

   Reference: https://www.ciscopress.com/articles/article.asp?p=3100055&seqNum=3

   Next question

10. Question 320 · 334 in bank

    

    Refer to the exhibit. Which event is occurring?

    • AA binary named "submit" is running on VM cuckoo1.
    • BA binary is being submitted to run on VM cuckoo1
    • CA binary on VM cuckoo1 is being submitted for evaluation
    • DA URL is being evaluated to see if it has a malicious binary

    Show answer

    Answer: B

    Explanation

    One well-known open source sandbox is Cuckoo. This sandbox allows a security professional to implement Cuckoo on a local system and execute malicious files and malware within a safe environment.

    Source: Adapted from community discussion — eggheadsv

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 311. 334 questions available.