Refer to the exhibit. A SOC analyst received a message from SIEM about abnormal activity on the Windows server. The analyst checked the Windows event log and saw numerous Audit Failures logs.What is occurring?
Answer(s): C
A high volume of Windows Security Audit Failure events (such as repeated failed logon attempts) in a short period is a common indicator of automated password guessing against an account, consistent with a brute-force login attempt.
What is the advantage of agent-based protection compared to agentless protection?
Answer(s): B
Agent-based protection involves installing software agents on endpoints, allowing for local monitoring and detection of threats directly on the device. This provides real-time security capabilities such as behavior analysis, file integrity monitoring, and offline protection, which agentless solutions cannot achieve. Agentless protection, on the other hand, relies on network-based monitoring and lacks visibility into local system events.
What is a collection of compromised machines that attackers use to carry out a DDoS attack?
Answer(s): D
A botnet is a network of computers or devices that have been infected with malicious software, allowing an attacker to control them remotely. These compromised machines, known as bots or zombies, can be coordinated by the attacker to perform various tasks, including launching DDoS attacks by flooding a target system or network with an overwhelming volume of traffic.
A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?
A company plans to implement network segmentations and use IP address inventory management best practices. Servers and end-user devices are using the same VLANs and IP subnets with manual address assignment. What are the first two steps the engineers must take to meet these requirements? (Choose two.)
Answer(s): D,E
Which process represents the application-level allow list?
An application-level allow list involves permitting specific files, applications, or software while denying access to everything else. This approach focuses on explicitly specifying and permitting certain trusted applications or files, ensuring that only approved or authorized items are allowed to execute or run within a system or network. All other files or applications not listed in the allow list are automatically restricted or denied from executing or accessing resources.
Refer to the exhibit. Which alert is identified from this packet capture?
An engineer must compare NIST vs ISO frameworks. The engineer decided to compare as readable documentation and also to watch a comparison video review. Using Windows 10 OS, the engineer started a browser and searched for a NIST document and then opened a new tab in the same browser and searched for an ISO document for comparison.The engineer tried to watch the video, but there was an audio problem with OS, so the engineer had to troubleshoot it. At first, the engineer started CMD and looked for a driver path, then looked for a corresponding registry in the registry editor. The engineer enabled "Audiosrv" in task manager and put it on auto-start, and the problem was solved. Which two components of the OS did the engineer touch? (Choose two.)
Answer(s): C,E
The engineer interacted with the services by enabling the "Audiosrv" (Audio Service) in the Task Manager and configuring it to auto-start. This falls under the service component, where system services are managed.Additionally, troubleshooting the audio problem involved investigating processes and threads within the Windows OS. The engineer utilized the Command Prompt (CMD) to check for driver paths and examined corresponding registry entries in the Registry Editor. Processes and threads are integral components of the operating system that manage and execute tasks and programs.
Share your comments for Cisco 200-201 exam with other users:
the exam is listed as 80 questions with a pass mark of 70%, how is your 50 questions related?
all questions are so important and covers all ccna modules
q 44. ans:- b (goto setup > order settings > select enable optional price books for orders) reference link --> https://resources.docs.salesforce.com/latest/latest/en-us/sfdc/pdf/sfom_impl_b2b_b2b2c.pdf(decide whether you want to enable the optional price books feature. if so, select enable optional price books for orders. you can use orders in salesforce while managing price books in an external platform. if you’re using d2c commerce, you must select enable optional price books for orders.)
"cost of replacing data if it were lost" is also correct.
pls upload the questions
good questions
question 182 - correct answer is d. ethernet frame length is 64 - 1518b. length of user data containing is that frame: 46 - 1500b.
i need this exam pls
its required for me, please make it enable to access. thanks
seems good..
took the test last week, i did have about 15 - 20 word for word from this site on the test. (only was able to cram 600 of the questions from this site so maybe more were there i didnt review) had 4 labs, bgp, lacp, vrf with tunnels and actually had to skip a lab due to time. lots of automation syntax questions.
no comments
nice questions bring out the best in you.
really helpful
question #50 and question #81 are exactly the same questions, azure site recovery provides________for virtual machines. the first says that it is fault tolerance is the answer and second says disater recovery. from my research, it says it should be disaster recovery. can anybody explain to me why? thank you
iam thankful for these exam dumps questions, i would not have passed without this exam dumps.
some of the answers seem to be inaccurate. q10 for example shouldnt it be an m custom column?
are the question real or fake?
thank you for providing such assistance.
nice questions
my 3rd purcahse from this site. these exam dumps are helpful. very helpful.
found it good
excellent material
very helpfull
well explained.
i need the pdf, please.
a good source for exam preparation
i need ielts general training audio guide questions
please make this content available
content is good
latest dumps please
aside from pdf the test engine software is helpful. the interface is user-friendly and intuitive, making it easy to navigate and find the questions.
questions and options are correct, but the answers are wrong sometimes. so please check twice or refer some other platform for the right answer