Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)334 questions across 34 pages are complete and free, with no account or card.
334 questions in this bank
Free access · progress saved on this device
Which regular expression is needed to capture the IP address 192.168.20.232?
Answer: A
Correct options are: A) ^(?:[0-9]{1,3}.){3}[0-9]{1,3} B) ^(?:[0-9]f1,3}.){1,4} C) ^(?:[0-9]{1,3}.) D) ^([0-9]-{3}) Test and verify the correct option A at https://regex101.com/
Source: Adapted from community discussion — anonymous1966
An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?
Answer: B
B is correct. The options appears encoded to me. The options are: a) Run "ps -u" to find out who executed additional processes that caused a high load on a server. b) Run "ps -ef" to understand which processes are taking a high amount of resources. c) Run "ps -d" to decrease the priority state of high load processes to avoid resource exhaustion. d) Run "ps -m" to capture the existing state of daemons and map required processes to find the gap. ps -u --> Filter processes according to the user ps -ef --> To see every process on the system using standard syntax ps -d --> View all the processes except session leaders ps -m --> display the scheduling policies of a thread I fact ps -eF should be better https://www.journaldev.com/24613/linux-ps-command https://www.geeksforgeeks.org/ps-command-in-linux-with-examples/ https://www.ibm.com/docs/en/aix/7.2?topic=p-ps-command
Source: Adapted from community discussion — anonymous1966
Refer to the exhibit. Which component is identifiable in this exhibit?
Answer: A
Reference: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-hives
An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?
Answer: B
"B" is correct. Precursors is the way the document name the method/event. The documento do not have the other words in the alternatives. 3.2.3 Sources of Precursors and Indicators Precursors and indicators are identified using many different sources, with the most common being computer security software alerts, logs, publicly available information, and people
Source: Adapted from community discussion — anonymous1966
Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?
Answer: D
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf Management. Management establishes incident response policy, budget, and staffing. Ultimately, management is held responsible for coordinating incident response among various stakeholders, minimizing damage, and reporting to Congress, OMB, the General Accounting Office (GAO), and other parties.
Source: Adapted from community discussion — Vetterous
Which incidence response step includes identifying all hosts affected by an attack?
Answer: A
Not really... the question is asking about attacked host, not attacking host. Below explanation from examcol is correct: The correct answer is A. detection and analysis. Based on https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 3.2 Detection and Analysis > 3.2.4 Incident Analysis "When the team believes that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope, such as which networks, systems, or applications are affected..."
Source: Adapted from community discussion — RSA001
Which two elements are used for profiling a network? (Choose two.)
Answer: AB
AB. Explanation: A network profile should include some important elements, such as the following: Total throughput – the amount of data passing from a given source to a given destination in a given period of time Session duration – the time between the establishment of a data flow and its termination Ports used – a list of TCP or UDP processes that are available to accept data Critical asset address space – the IP addresses or the logical location of essential systems or data
Source: Adapted from community discussion — forest111
What is the difference between deep packet inspection and stateful inspection?
Answer: D
The main difference between deep packet inspection and stateful inspection is the layer of the network stack at which they operate. Stateful inspection works at the transport layer (Layer 4) of the network stack, and it verifies that the contents of each packet are allowed based on the state of the connection. It does this by keeping track of the state of each connection, and only allowing packets that match an established connection to pass through. Stateful inspection can provide basic security against network attacks, such as denial-of-service attacks and spoofing attacks. Deep packet inspection, on the other hand, operates at the application layer (Layer 7) of the network stack. It inspects the contents of each packet in detail, looking for specific application-level information such as URLs, keywords, or file types. This allows it to identify and block specific types of traffic, such as malware or unwanted applications.
Source: Adapted from community discussion — drdecker100
Which category relates to improper use or disclosure of PII data?
Answer: C
Many regulations as well as the United States government require organizations to identify personally identifiable information (PII) and protected health information (PHI) and handle them in a secure manner. Unauthorized release or loss of such data could result in severe fines and penalties for the organization. Given the importance of PII and PHI, regulators and the government want to oversee the usage more efficiently. This section explains what PII and PHI are. based on page 158, section PERSONALLY IDENTIFIABLE INFORMATION AND PROTECTED HEALTH INFORMATION of: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide by Omar Santos
Source: Adapted from community discussion — addpro7
Which type of evidence supports a theory or an assumption that results from initial evidence?
Answer: D
"D" is correct Corroborating evidence (or corroboration) is evidence that tends to support a theory or an assumption deduced by some initial evidence. This corroborating evidence confirms the proposition. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide By Omar Santos
Source: Adapted from community discussion — anonymous1966
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
200-201 practice, question 71. 334 questions available.
Version 1.0.0. How we source questions