200-201 practice questions 51–60

1. Question 51 · 334 in bank

   

   Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

   • Ainsert TCP subdissectors
   • Bextract a file from a packet capture
   • Cdisable TCP streams
   • Dunfragment TCP

   Show answer

   Answer: B

   Explanation

   Answer must be D? The TCP protocol preference “Allow subdissector to reassemble TCP streams” (enabled by default) makes it possible for Wireshark to collect a contiguous sequence of TCP segments and hand them over to the higher-level protocol (for example, to reconstruct a full HTTP message). 7.8. Packet Reassembly - Wiresharkhttps://www.wireshark.org ›

   Source: Adapted from community discussion — Cnoteone

   Next question

2. Question 52 · 334 in bank

   Which type of data collection requires the largest amount of storage space?

   • Aalert data
   • Btransaction data
   • Csession data
   • Dfull packet capture

   Show answer

   Answer: D

   Next question

3. Question 53 · 334 in bank

   An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

   • Atrue negative
   • Bfalse negative
   • Cfalse positive
   • Dtrue positive

   Show answer

   Answer: B

   Explanation

   A false negative occurs when the security system (usually a WAF) fails to identify a threat. It produces a “negative” outcome (meaning that no threat has been observed), even though a threat exists. This is the opposite of a false positive alarm, where a system mistakenly identifies legitimate traffic as being hostile. I would answer - false negative

   Source: Adapted from community discussion — HarryPotter69

   Next question

4. Question 54 · 334 in bank

   Which signature impacts network traffic by causing legitimate traffic to be blocked?

   • Afalse negative
   • Btrue positive
   • Ctrue negative
   • Dfalse positive

   Show answer

   Answer: D

   Explanation

   A false negative occurs when the security system (usually a WAF) fails to identify a threat. It produces a “negative” outcome (meaning that no threat has been observed), even though a threat exists. This is the opposite of a false positive alarm, where a system mistakenly identifies legitimate traffic as being hostile. I would answer - false positive

   Source: Adapted from community discussion — HarryPotter69

   Next question

5. Question 55 · 334 in bank

   Select 2

   Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

   • AUDP port to which the traffic is destined
   • BTCP port from which the traffic was sourced
   • Csource IP address of the packet
   • Ddestination IP address of the packet
   • EUDP port from which the traffic is sourced

   Show answer

   Answer: CD

   Next question

6. Question 56 · 334 in bank

   Which security principle is violated by running all processes as root or administrator?

   • Aprinciple of least privilege
   • Brole-based access control
   • Cseparation of duties
   • Dtrusted computing base

   Show answer

   Answer: A

   Explanation

   The security principle violated by running all processes as root or administrator is the "principle of least privilege." The principle of least privilege states that users and applications should only have the minimum permissions required to perform their necessary tasks, and no more. By running all processes as the root or administrator account, all processes are given full permissions, which could pose a security risk if a malicious process is executed.

   Source: Adapted from community discussion — drdecker100

   Next question

7. Question 57 · 334 in bank

   Which HTTP header field is used in forensics to identify the type of browser used?

   • Areferrer
   • Bhost
   • Cuser-agent
   • Daccept-language

   Show answer

   Answer: C

   Explanation

   "C" is correct. Example: User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0 In computing, a user agent is any software, acting on behalf of a user, which "retrieves, renders and facilitates end-user interaction with Web content".[1] A user agent is therefore a special kind of software agent. https://en.wikipedia.org/wiki/User_agent#User_agent_identification

   Source: Adapted from community discussion — anonymous1966

   Next question

8. Question 58 · 334 in bank

   Which event artifact is used to identify HTTP GET requests for a specific file?

   • Adestination IP address
   • BTCP ACK
   • CHTTP status code
   • DURI

   Show answer

   Answer: D

   Explanation

   Answer D: A Uniform Resource Identifier (URI) is a unique sequence of characters that identifies a logical or physical resource used by web technologies. URIs may be used to identify anything, including real-world objects, such as people and places, concepts, or information resources such as web pages and books

   Source: Adapted from community discussion — omita

   Next question

9. Question 59 · 334 in bank

   What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

   • ATapping interrogation replicates signals to a separate port for analyzing traffic
   • BTapping interrogations detect and block malicious traffic
   • CInline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies
   • DInline interrogation detects malicious traffic but does not block the traffic

   Show answer

   Answer: A

   Explanation

   In my oppinion Correct is "C" "A" = SPAN (not TAP) According to the book: The following are some key benefits of using a physical inline tap: It will create a full copy of the network traffic and send it to the security monitoring device. It does not drop any traffic. A physical inline tap does not require any sort of configuration. It is simple to implement on a network. Most inline taps do not require power for the device to operate. It does not create any contention on the network.

   Source: Adapted from community discussion — anonymous1966

   Next question

10. Question 60 · 334 in bank

    At which layer is deep packet inspection investigated on a firewall?

    • Ainternet
    • Btransport
    • Capplication
    • Ddata link

    Show answer

    Answer: C

    Explanation

    Deep packet = Application. With deep packet inspection (DPI), firewalls can look at specific Layer 7 payloads to protect against security threats. You can also configure these devices to deny specific FTP commands, HTTP content types, and other application protocols. Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide Omar Santos

    Source: Adapted from community discussion — anonymous1966

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 51. 334 questions available.