200-201 practice questions 81–90

1. Question 81 · 334 in bank

   Select 2

   Which two elements are assets in the role of attribution in an investigation? (Choose two.)

   • Acontext
   • Bsession
   • Claptop
   • Dfirewall logs
   • Ethreat actor

   Show answer

   Answer: CD

   Explanation

   I think C,D should be correct: An asset is any data, device or other component of an organisation’s systems that is valuable – often because it contains sensitive data or can be used to access such information. For example, an employee’s desktop computer, laptop or company phone would be considered an asset, as would applications on those devices. Likewise, critical infrastructure, such as servers and support systems, are assets. An organisation’s most common assets are information assets. These are things such as databases and physical files – i.e. the sensitive data that you store.

   Source: Adapted from community discussion — Alannn

   Next question

2. Question 82 · 334 in bank

   What is personally identifiable information that must be safeguarded from unauthorized access?

   • Adate of birth
   • Bdriver's license number
   • Cgender
   • Dzip code

   Show answer

   Answer: B

   Explanation

   I guess Date of birth and driver license number are both correct... From 200-201 Training Resources: Examples of PII data include the following: Name, such as full name, maiden name, mother's maiden name Telephone numbers, including home, and mobile numbers !!!Date and place of birth!!! Passport number, social security number, !!!driver license number!!! Personal characteristics, including photographic image [..]

   Source: Adapted from community discussion — Barney_Stinson

   Next question

3. Question 83 · 334 in bank

   In a SOC environment, what is a vulnerability management metric?

   • Acode signing enforcement
   • Bfull assets scan
   • Cinternet exposed devices
   • Dsingle factor authentication

   Show answer

   Answer: C

   Explanation

   https://purplesec.us/learn/vulnerability-management-metrics/ 6. Internal Vs External Exposure Your external internet facing applications inherently are at highest exposure to outside threats compared to internal. An organization should have separate scanners for each environment. Although an external scan has high priority, internal scans should be prioritized as well due to the potential of a threat actor entering your network and exploiting a threat is always probable.

   Source: Adapted from community discussion — SecurityGuy

   Next question

4. Question 84 · 334 in bank

   A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

   • ACD data copy prepared in Windows
   • BCD data copy prepared in Mac-based system
   • CCD data copy prepared in Linux system
   • DCD data copy prepared in Android-based system

   Show answer

   Answer: C

   Next question

5. Question 85 · 334 in bank

   Select 2

   Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

   • Adetection and analysis
   • Bpost-incident activity
   • Cvulnerability management
   • Drisk assessment
   • Evulnerability scoring

   Show answer

   Answer: AB

   Explanation

   A & B is the correct answers The NIST Incident Response Process contains four steps: 1. Preparation 2. Detection and Analysis 3. Containment, Eradication, and Recovery 4. Post-Incident Activity

   Source: Adapted from community discussion — Eng_ahmedyoussef

   Next question

6. Question 86 · 334 in bank

   DRAG DROP - Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Google Figure 2: Original Lockheed Martin Cyber (Intrusion) Kill Chain - has a very nice image Based on that I would say Exploitation - The targeted Environment is taken advantage of triggering the threat actor's code Installation - Backdoor is placed on the victim system allowing the threat actor to maintain the persistence. Command and Control - An outbound connection is established to an Internet-based controller server. Actions and Objectives - The threat actor takes actions to violate data integrity and availability

   Source: Adapted from community discussion — HarryPotter69

   

   Next question

7. Question 87 · 334 in bank

   

   Refer to the exhibit. What does this output indicate?

   • AHTTPS ports are open on the server.
   • BSMB ports are closed on the server.
   • CFTP ports are open on the server.
   • DEmail ports are closed on the server.

   Show answer

   Answer: D

   Explanation

   What Are Ports 139 And 445? SMB has always been a network file sharing protocol. As such, SMB requires network ports on a computer or server to enable communication to other systems. SMB uses either IP port 139 or 445. Port 139 - SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network. Port 445 - Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet. https://www.varonis.com/blog/smb-port SMB Ports 139 and 445 are open Email Ports 25 and 110 are closed Therefore "D. Email Ports are closed on the Server."

   Source: Adapted from community discussion — SecurityGuy

   Next question

8. Question 88 · 334 in bank

   DRAG DROP - Drag and drop the elements from the left into the order for incident handling on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

9. Question 89 · 334 in bank

   Which evasion technique is a function of ransomware?

   • Aextended sleep calls
   • Bencryption
   • Cresource exhaustion
   • Dencoding

   Show answer

   Answer: B

   Explanation

   The correct answer is B. encryption. Ransomware is a type of malware that encrypts a victim's files and demands payment in exchange for the decryption key. Encryption is the primary evasion technique used by ransomware to avoid detection and protect the malicious code from analysis or reverse-engineering. The other options listed as evasion techniques are not specific to ransomware.

   Source: Adapted from community discussion — alhamry

   Next question

10. Question 90 · 334 in bank

    Which metric should be used when evaluating the effectiveness and scope of a Security Operations Center?

    • AThe average time the SOC takes to register and assign the incident.
    • BThe total incident escalations per week.
    • CThe average time the SOC takes to detect and resolve the incident.
    • DThe total incident escalations per month.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 81. 334 questions available.