200-201 practice questions 61–70

1. Question 61 · 334 in bank

   DRAG DROP - Drag and drop the access control models from the left onto its corresponding descriptions on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   DAC -> object owner determines permissions MAC -> OS determines permissions RBAC -> role of the subject determines permissions ABAC -> attributes of the subject determines permissions

   Source: Adapted from community discussion — [Removed]

   

   Next question

2. Question 62 · 334 in bank

   DRAG DROP - Drag and drop the event term from the left onto the description on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/13876-f-pos.html

   Source: Adapted from community discussion — Mack279

   

   Next question

3. Question 63 · 334 in bank

   

   Refer to the exhibit. What is occurring?

   • Ainsecure deserialization
   • Bcross-site scripting attack
   • CXML External Entities attack
   • Dregular GET requests

   Show answer

   Answer: B

   Explanation

   Here is one sample web access log entry that is a sign of an XSS attack. 192.168.0.252 – – [05/Aug/2009:15:16:42 -0400] “GET /%27%27;!–%22%3CXSS%3E=&{() } HTTP/1.1″ 404 310 “-” “Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.12) Gecko/2009070812 Ubuntu/8.04 (hardy) Firefox/3.0.12″ The part to look for is the GET /%27%27 command (there are several variants).

   Source: Adapted from community discussion — MartinRB

   Next question

4. Question 64 · 334 in bank

   What is a difference between data obtained from Tap and SPAN ports?

   • ASPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times.
   • BTap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.
   • CSPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility.
   • DTap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination.

   Show answer

   Answer: D

   Explanation

   Reference: https://www.gigamon.com/resources/resource-library/white-paper/to-tap-or-to-span.html

   Source: Adapted from community discussion — Eng_ahmedyoussef

   Next question

5. Question 65 · 334 in bank

   DRAG DROP - Drag and drop the data source from the left onto the data type on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   the correct answer : Wireshark => Full Packet Capture Netflow => Session Data Server log => Transaction IPS = > Alert Data the confusion is between session data & transaction data, so, NetFlow provides information about network session data, and NetFlow records take less space than a full packet capture. P957_ Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide (Certification Guide) by Omar Santos

   Source: Adapted from community discussion — addpro7

   

   Next question

6. Question 66 · 334 in bank

   A threat actor penetrated an organization's network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?

   • Aevent name, log source, time, source IP, and username
   • Bevent name, log source, time, source IP, and host name
   • Cprotocol, log source, source IP, destination IP, and host name
   • Dprotocol, source IP, source port destination IP, and destination port

   Show answer

   Answer: D

   Explanation

   Reference: https://blogs.cisco.com/security/the-dreaded-5-tuple

   Next question

7. Question 67 · 334 in bank

   What is the function of a command and control server?

   • AIt enumerates open ports on a network device
   • BIt drops secondary payload into malware
   • CIt is used to regain control of the network after a compromise
   • DIt sends instruction to a compromised system

   Show answer

   Answer: D

   Explanation

   The function of a command and control (C2) server is to send instructions to a compromised system, also known as a bot or a zombie. Once a system is compromised by malware such as a botnet, the C2 server acts as a central point of control for the attacker to send commands to the compromised systems. These commands could include downloading additional malware or executing specific commands on the compromised system, such as launching a distributed denial-of-service (DDoS) attack or stealing sensitive information. Enumerating open ports on a network device is a network scanning technique that is not directly related to the function of a C2 server. Dropping secondary payloads into malware may be a function of a specific type of malware, but it is not a primary function of a C2 server. Regaining control of a network after a compromise is typically done through incident response procedures and is not a function of a C2 server.

   Source: Adapted from community discussion — drdecker100

   Next question

8. Question 68 · 334 in bank

   What is a difference between an inline and a tap mode traffic monitoring?

   • ATap mode monitors packets and their content with the highest speed, while the inline mode draws a packet path for analysis.
   • BInline monitors traffic without examining other devices, while a tap mode tags traffic and examines the data from monitoring devices.
   • CInline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network.
   • DTap mode monitors traffic direction, while inline mode keeps packet data as it passes through the monitoring devices.

   Show answer

   Answer: C

   Explanation

   Inline mode and tap mode are two different methods of network traffic monitoring. Inline mode involves inserting a monitoring device, such as an Intrusion Prevention System (IPS), directly into the network traffic path. The monitoring device actively inspects all traffic passing through it, typically at wire speed, and can take action to block or allow specific traffic based on security policies. In contrast, tap mode involves using a network tap, which is a device that is inserted into the network without disrupting the normal flow of traffic. The tap makes a copy of the traffic and sends it to a monitoring device for analysis. This means that tap mode can capture traffic as it crosses the network, but at a potentially lower speed than inline mode. Therefore, the correct answer is C, as inline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network.

   Source: Adapted from community discussion — drdecker100

   Next question

9. Question 69 · 334 in bank

   An engineer is addressing a connectivity issue between two servers where the remote server is unable to establish a successful session. Initial checks show that the remote server is not receiving a SYN-ACK while establishing a session by sending the first SYN. What is causing this issue?

   • Aincorrect TCP handshake
   • Bincorrect UDP handshake
   • Cincorrect OSI configuration
   • Dincorrect snaplen configuration

   Show answer

   Answer: A

   Explanation

   Reference: https://www.sciencedirect.com/topics/computer-science/three-way-handshake#:~:text=The%20TCP%20handshake,as%20shown%20in%20Figure% 203.8

   Next question

10. Question 70 · 334 in bank

    

    Refer to the exhibit. What is shown in this PCAP file?

    • AThe User-Agent is Mozilla/5.0.
    • BTimestamps are indicated with error.
    • CThe HTTP GET is encoded.
    • DThe protocol is TCP.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 61. 334 questions available.