Cisco 200-201 Dumps PDF Free Download - Page: 10

QUESTION: 73

Which regular expression is needed to capture the IP address 192.168.20.232?

^(?:[0-9]{1,3}\.){3}[0-9]{1,3}
^(?:[0-9]{1,3}\.)*
^)?:[0-9]{1,3}\.){1,4}
^([0-9].{3})

Answer(s): A

Explanation:

Reference:

https://www.cisco.com/c/en/us/td/docs/security/security_management/cs-mars/4-3/user/guide/local _controller/appreexp.html

Reveal Solution Next Question

QUESTION: 74

Refer to the exhibit. A SOC analyst is examining the Windows security logs of one of the endpoints.
What is the possible reason for this event log?

System maintenance logs
Windows failed to audit logs
Malware Attack
Brute force attack

Answer(s): C

Explanation:

Looking at the event log, there are several indicators that suggest a potential malware attack:
● Event ID 4688: A new process was created in the *C:\Temp* directory (s21351b.exe). This is suspicious because legitimate processes typically don’t run from temporary directories, which are often used by malware to hide malicious executables.
● Event ID 1102: The audit log was cleared by SYSTEM. Attackers often clear event logs to cover their tracks after gaining access to a system, which is a clear indicator of malicious activity.
● Event ID 4657: A registry key related to Windows Defender was modified. Malware often disables security software like Windows Defender to prevent detection and removal.
● Event ID 7045: The Windows Defender Antivirus Service was stopped. Stopping the antivirus service is a common action taken by malware to disable security defenses.
These events together strongly suggest that a malware attack is taking place, where an attacker has executed a malicious process, modified system security settings, and disabled the antivirus to avoid detection.

Reveal Solution Next Question

QUESTION: 75

Which evasion technique is a function of ransomware?

resource exhaustion
encryption
encoding
extended sleep calls

Answer(s): D

Explanation:

Extended sleep calls delay execution so that dynamic analysis environments (like sandboxes) time out before the malicious activity runs; this is a common time-based anti-analysis evasion technique used by ransomware/malware.

Reveal Solution Next Question

QUESTION: 76

What is the difference between indicator of attack (IoA) and indicators of compromise (IoC)?

IoA refers to the individual responsible for the security breach, and IoC refers to the resulting loss.
IoA is the evidence that a security breach has occurred, and IoC allows organizations to act before the vulnerability can be exploited.
IoC refers to the individual responsible for the security breach, and IoA refers to the resulting loss.
IoC is the evidence that a security breach has occurred, and IoA allows organizations to act before the vulnerability can be exploited.

Answer(s): D

Explanation:

An Indicator of Compromise (IoC) is a sign that a system or network has already been compromised and is used to determine if an attack has already occurred and to identify the scope of the compromise. An Indicator of Attack (IoA), on the other hand, is a signal or pattern that suggests an attack is currently underway or about to occur and is used to detect and respond to an attack in progress.

Reveal Solution Next Question

QUESTION: 77

A multinational organization uses a complex network infrastructure, incorporating various cloud services, different endpoints, and distributed networks with several network security devices.
Which challenge will the security team face when ensuring robust data visibility across the organization for effective threat detection and response?

inconsistent data aggregation from different technologies used within the organization
different protocols used through different technologies across the organization
duplicate logs and alerts from different platforms
limited data retention policies across different platforms

Answer(s): A

Explanation:

With many different platforms and security tools generating telemetry in different formats and levels of detail, the main visibility challenge is consistently collecting, normalizing, and correlating that data so it can be analyzed together for reliable detection and response.

Reveal Solution Next Question

QUESTION: 78

What describes the impact of false-positive alerts compared to false-negative alerts?

A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened. A false positive is when an XSS attack happens and no alert is raised.
A false positive is an event altering for an SQL injection attack. An engineer investigates the alert and discovers that an attack attempt was blocked by IPS. A false negative is when the attack gets detected but succeeds and results in a breach.
A false positive is an event altering for a brute-force attack. An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times. A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.
A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system. A false positive is when no alert and no attack is occurring.

Answer(s): C

Explanation:

False Positive: This occurs when an alert is generated for an event that is flagged as an attack or threat, but upon investigation, it is determined to be a legitimate action or benign event. For instance, in the case of a brute-force attack alert, the investigation reveals that the multiple login attempts were made by a legitimate user who forgot their password.
False Negative: This happens when an attack or malicious activity occurs, but the security system fails to detect or generate an alert for it. In the context of a brute-force attack, a false negative occurs when a threat actor is attempting to break into the system using multiple incorrect login attempts, yet the security system fails to raise an alert for this suspicious activity.

Reveal Solution Next Question

QUESTION: 79

An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time.
Which technology makes this behavior feasible?

access control list
NAT
encryption
tunneling

Answer(s): D

Reveal Solution Next Question

QUESTION: 80

Refer to the exhibit. A security analyst wraps up the shift and passed open ticket notes to the night shift SOC team analyst. The ticket name in question is “Investigating suspicious activity on a Windows Server”.
Which operating system components must the analyst prioritize to uncover the attacker’s persistence mechanisms?

Review the Windows Defender setup and failed login attempts in Event Viewer.
Investigate the Task Scheduler entries and Windows Defender settings.
Analyze the Windows Registry changes and Task Scheduler tasks.
Focus on the user account log-ins and delete newly added Run keys in the registry.

Answer(s): C

Explanation:

Persistence on Windows systems is most commonly achieved by configuring programs to automatically execute after reboot or on a schedule, which is done through startup-related registry keys and scheduled tasks. The modified Run keys and newly created Task Scheduler entries directly indicate mechanisms the attacker is using to maintain continued access to the system.

Reveal Solution Next Question

Cisco Understanding Cybersecurity Operations Fundamentals (CBROPS) 200-201 Dumps in PDF

Free Cisco 200-201 Real Questions (page: 10)

QUESTION: 73

Explanation:

Reference:

QUESTION: 74

Explanation:

QUESTION: 75

Explanation:

QUESTION: 76

Explanation:

QUESTION: 77

Explanation:

QUESTION: 78

Explanation:

QUESTION: 79

QUESTION: 80

Explanation: