200-201 practice questions 31–40

1. Question 31 · 334 in bank

   While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

   • Aencapsulation
   • BTOR
   • Ctunneling
   • DNAT

   Show answer

   Answer: D

   Explanation

   the answer is correct, Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.

   Source: Adapted from community discussion — afifulinuha

   Next question

2. Question 32 · 334 in bank

   Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

   • AModify the settings of the intrusion detection system.
   • BDesign criteria for reviewing alerts.
   • CRedefine signature rules.
   • DAdjust the alerts schedule.

   Show answer

   Answer: A

   Explanation

   "A" is correct Traditional intrusion detection system (IDS) and intrusion prevention system (IPS) devices need to be tuned to avoid false positives and false negatives. Next-generation IPSs do not need the same level of tuning compared to traditional IPSs. Also, you can obtain much deeper reports and functionality, including advanced malware protection and retrospective analysis to see what happened after an attack took place. Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide By Omar Santos

   Source: Adapted from community discussion — anonymous1966

   Next question

3. Question 33 · 334 in bank

   What is the impact of false positive alerts on business compared to true positive?

   • ATrue positives affect security as no alarm is raised when an attack has taken place, while false positives are alerts raised appropriately to detect and further mitigate them.
   • BTrue-positive alerts are blocked by mistake as potential attacks, while False-positives are actual attacks identified as harmless.
   • CFalse positives alerts are manually ignored signatures to avoid warnings that are already acknowledged, while true positives are warnings that are not yet acknowledged.
   • DFalse-positive alerts are detected by confusion as potential attacks, while true positives are attack attempts identified appropriately.

   Show answer

   Answer: D

   Explanation

   A false positive occurs when an alert or warning is triggered when no threat is present. For example, an antivirus program detecting a harmless file as malicious. A false negative occurs when an alert or warning is not triggered when a threat is present. For example, a virus infecting a system without being detected by antivirus software. A true positive occurs when an alert or warning is triggered correctly when a threat is present. For example, an intrusion detection system detecting a hacking attempt. A true negative occurs when an alert or warning is not triggered correctly when no threat is present. For example, an intrusion detection system not detecting any malicious activity on a network that is in fact safe.

   Source: Adapted from community discussion — drdecker100

   Next question

4. Question 34 · 334 in bank

   What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

   • Aleast privilege
   • Bneed to know
   • Cintegrity validation
   • Ddue diligence

   Show answer

   Answer: A

   Explanation

   The practice of giving employees only the necessary permissions to perform their specific role within an organization is called "least privilege". This is an important concept in information security because it reduces the risk of unauthorized access to sensitive information and systems. By giving employees the minimum amount of privileges they need to do their job, they are less likely to accidentally cause harm or intentionally misuse the information or systems they have access to. This helps to increase overall security and reduce the risk of security incidents.

   Source: Adapted from community discussion — drdecker100

   Next question

5. Question 35 · 334 in bank

   An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task?

   • AFirepower
   • BEmail Security Appliance
   • CWeb Security Appliance
   • DStealthwatch

   Show answer

   Answer: D

   Explanation

   Stealthwatch is a network traffic monitoring and analysis tool that provides visibility into network behavior and detects anomalies and threats. It can collect and analyze data from a variety of sources, including network devices, servers, and applications, and generate alerts and reports based on predefined rules and machine learning algorithms. In this case, the engineer can configure Stealthwatch to collect logs from the proxy server and analyze the data to identify any suspicious or malicious activity. Stealthwatch can also correlate the logs with other network data to provide a more comprehensive view of the network and detect advanced threats that may be hiding in the noise. Firepower, Email Security Appliance, and Web Security Appliance are security technologies that can provide additional layers of protection for specific types of traffic, but they are not designed for network monitoring and analysis like Stealthwatch.

   Source: Adapted from community discussion — Stevens0103

   Next question

6. Question 36 · 334 in bank

   

   Refer to the exhibit. Which technology generates this log?

   • ANetFlow
   • BIDS
   • Cweb proxy
   • Dfirewall

   Show answer

   Answer: D

   Explanation

   This picture was in the exam, but in another aspect: wich type of evidence is this picture: Best, Corroboration, Circumstance or Indirect.

   Source: Adapted from community discussion — tsabee

   Next question

7. Question 37 · 334 in bank

   Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

   • Asrc=10.11.0.0/16 and dst=10.11.0.0/16
   • Bip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16
   • Cip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16
   • Dsrc==10.11.0.0/16 and dst==10.11.0.0/16

   Show answer

   Answer: B

   Explanation

   B is correct. New exam quistion - filtering by port in this case by FTP port (21) in wireshark the correct answer is "tcp.port==21".

   Source: Adapted from community discussion — [Removed]

   Next question

8. Question 38 · 334 in bank

   Which tool provides a full packet capture from network traffic?

   • ANagios
   • BCAINE
   • CHydra
   • DWireshark

   Show answer

   Answer: D

   Next question

9. Question 39 · 334 in bank

   A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engineer needs to analyze the network and identify ways to improve traffic movement to minimize delays. Which information must the engineer obtain for this analysis?

   • Atotal throughput on the interface of the router and NetFlow records
   • Boutput of routing protocol authentication failures and ports used
   • Crunning processes on the applications and their total network usage
   • Ddeep packet captures of each application flow and duration

   Show answer

   Answer: A

   Explanation

   "D" is correct DPI can be made by AVC that can setup QoS to tune traffic. Cisco AVC uses existing Cisco Network-Based Application Recognition Version 2 (NBAR2) to provide deep packet inspection (DPI) technology to identify a wide variety of applications within the network traffic flow, using Layer 3 to Layer 7 data. NBAR works with quality of services (QoS) features to help ensure that the network bandwidth is best used to fulfill its main primary objectives. The benefits of combining these features include the ability to guarantee bandwidth to critical applications, limit bandwidth to other applications, drop selective packets to avoid congestion, and mark packets appropriately so that the network and the service provider’s network can provide QoS from end to end. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide By Omar Santos

   Source: Adapted from community discussion — anonymous1966

   Next question

10. Question 40 · 334 in bank

    

    Refer to the exhibit. What is depicted in the exhibit?

    • AWindows Event logs
    • BApache logs
    • CIIS logs
    • DUNIX-based syslog

    Show answer

    Answer: B

    Explanation

    https://www.w3schools.com/tags/ref_httpmethods.asp "GET" is an HTTP Method which more inclined to web technologies such as Apache or IIS. HTTP Methods: - GET - POST - PUT - HEAD - DELETE - PATCH - OPTIONS - CONNECT - TRACE IIS Logs Format: https://learn.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525807(v=vs.90)

    Source: Adapted from community discussion — SecurityGuy

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 31. 334 questions available.