Cisco CyberOps Associat CBROPS 200-201 Test Questions

1. While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.

Which technology makes this behavior possible?

2. When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.

Which information is available on the server certificate?

3. A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.

Which type of evidence is this?

4. Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

5. Which utility blocks a host portscan?

6. Which event is user interaction?

7. An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.

Which testing method did the intruder use?

8. Refer to the exhibit.

What information is depicted?

9. Which type of evidence supports a theory or an assumption that results from initial evidence?

10. Which two elements are assets in the role of attribution in an investigation? (Choose two.)

11. Which regular expression matches “color” and “colour”?

12. A user received a malicious attachment but did not run it.

Which category classifies the intrusion?

13. Which process is used when IPS events are removed to improve data integrity?

14. An investigator is examining a copy of an ISO file that is stored in CDFS format.

What type of evidence is this file?

15. Which piece of information is needed for attribution in an investigation?

16. Refer to the exhibit.

In which Linux log file is this output found?

17. What is the difference between the ACK flag and the RST flag in the NetFlow log session?

18. An analyst is investigating an incident in a SOC environment.

Which method is used to identify a session from a group of logs?

19. Refer to the exhibit.

Which type of log is displayed?

20. What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

21. What are the two characteristics of the full packet captures? (Choose two.)

22. A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver.

Which event category is described?

23. How is attacking a vulnerability categorized?

24. What is the difference between the ACK flag and the RST flag in the NetFlow log session?

25. Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

26. An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.

Which testing method did the intruder use?

27. Which security principle is violated by running all processes as root or administrator?

28. Which access control model does SELinux use?

29. Refer to the exhibit.

What does the output indicate about the server with the IP address 172.18.104.139?

30. DRAG DROP

Refer to the exhibit.

Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.

31. Refer to the exhibit.

What is occurring in this network traffic?

32. Why is encryption challenging to security monitoring?

33. How is NetFlow different than traffic mirroring?

34. Which event artifact is used to identify HTTP GET requests for a specific file?

35. What is the difference between deep packet inspection and stateful inspection?

36. A system administrator is ensuring that specific registry information is accurate.

Which type of configuration information does the HKEY_LOCAL_MACHINE hive contain?

37. Which IETF standard technology is useful to detect and analyze a potential security incident by recording session flows that occurs between hosts?

38. What is a difference between inline traffic interrogation and traffic mirroring?

39. Which regular expression matches "color" and "colour"?

40. Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

41. An analyst is exploring the functionality of different operating systems.

What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?

42. Which two components reduce the attack surface on an endpoint? (Choose two.)

43. At which layer is deep packet inspection investigated on a firewall?

44. Which event artifact is used to identity HTTP GET requests for a specific file?

45. Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

46. An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.

Which kind of evidence is this IP address?

47. How does an SSL certificate impact security between the client and the server?

48. An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.

What is the initial event called in the NIST SP800-61?

49. What is the practice of giving an employee access to only the resources needed to accomplish their job?

50. DRAG DROP

Drag and drop the technology on the left onto the data type the technology provides on the right.

51. Which artifact is used to uniquely identify a detected file?

52. What is an example of social engineering attacks?

53. Refer to the exhibit.

Which type of log is displayed?

54. In a SOC environment, what is a vulnerability management metric?

55. Refer to the exhibit.

This request was sent to a web application server driven by a database.

Which type of web server attack is represented?

56. What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

57. Which HTTP header field is used in forensics to identify the type of browser used?

58. Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

59. The target web application server is running as the root user and is vulnerable to command injection.

Which result of a successful attack is true?

60. You have identified a malicious file in a sandbox analysis tool.

Which piece of file information from the analysis is needed to search for additional downloads of this file by other hosts?