Free Understanding Cisco Cybersecurity Operations Fundamentals Exam 200-201 Exam Practice Test

An organization's security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning How should the analyst collect the traffic to isolate the suspicious host?

• by most active source IP
• by most used ports
• based on the protocols used
• based on the most used applications

Refer to the exhibit.An engineer received a ticket about a slowed-down web application. The engineer runs the #netstat -an command. How must the engineer interpret the results?

• The web application is receiving a common, legitimate traffic
• The engineer must gather more data.
• The web application server is under a denial-of-service attack.
• The server is under a man-in-the-middle attack between the web application and its database

What is the difference between an attack vector and attack surface?

• An attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.
• An attack vector identifies components that can be exploited, and an attack surface identifies the potential path an attack can take to penetrate the network.
• An attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible with these vulnerabilities.
• An attack vector identifies the potential outcomes of an attack; and an attack surface launches an attack using several methods against the identified vulnerabilities.

Which two elements of the incident response process are stated in NIST SP 800-61 r2? (Choose two.)

• detection and analysis
• post-incident activity
• vulnerability scoring
• vulnerability management
• risk assessment

Which attack method is being used when an attacker tries to compromise a network with an authentication system that uses only 4-digit numeric passwords and no username?

• SQL injection
• dictionary
• replay
• cross-site scripting

An analyst is exploring the functionality of different operating systems.What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?

• queries Linux devices that have Microsoft Services for Linux installed
• deploys Windows Operating Systems in an automated fashion
• is an efficient tool for working with Active Directory
• has a Common Information Model, which describes installed hardware and software

Refer to the exhibit.A security analyst is investigating unusual activity from an unknown IP address Which type of evidence is this file1?

• indirect evidence
• best evidence
• corroborative evidence
• direct evidence

Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

• detection and analysis
• post-incident activity
• vulnerability management
• risk assessment
• vulnerability scoring

Which technique is a low-bandwidth attack?

• social engineering
• session hijacking
• evasion
• phishing

Which security principle is violated by running all processes as root or administrator?

• principle of least privilege
• role-based access control
• separation of duties
• trusted computing base