Refer to the exhibit. An engineer is analyzing DNS response packets that are larger than expected. The engineer looks closer and notices a lack of appropriate DNS queries. What is occurring?
Answer(s): D
DNS Amplification Attack takes advantage of the UDP-based nature of DNS, which allows a small query to generate a significantly larger response. Attackers send a DNS request with a spoofed source IP (the target's IP) to a vulnerable DNS server. The DNS server responds with a large response, amplifying the amount of traffic sent to the victim.Look for response packets with a size that is significantly larger than the queries. The image shows flows with a relatively high number of packets and bytes, which suggests larger-than-normal responses are being sent from the source IP (84.200.70.40) to different targets (195.165.10.x). This aligns with the symptom of larger-than-expected DNS responses. Typically, amplification exploits DNS records like ANY, which request all available information about a domain, producing a large response.One of the defining characteristics of a DNS Amplification Attack is IP spoofing. Attackers spoof the victim's IP address in the query, so the DNS server sends large responses to the victim. As a result, the target (victim) receives large DNS response packets that it never requested.A lack of appropriate DNS queries indicates that the responses are being sent without matching queries from the target IP addresses, which is consistent with an amplification attack. The targets did not initiate these requests, meaning the traffic is unwanted and spoofed.
An analyst received a ticket about degraded processing capability for one of the HR department's servers. On the same day, an engineer noticed disabled antivirus software and could not determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?
Answer(s): B
Discovering unusual system behavior and disabled antivirus indicates a potential incident, placing the investigation in the detection phase, where signs of compromise are identified and validated before moving to analysis or response actions.
What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?
Answer(s): A
Traffic tapping involves capturing a copy of network traffic and sending it to a separate analysis tool or system. It doesn't interrupt the flow of traffic on the network but allows monitoring and analysis.
Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?
SSL (Secure Sockets Layer) certificates are used to secure communication between a web server and a client's browser. They ensure the integrity and authenticity of messages transferred to and from a web application by encrypting the data exchanged, providing a secure channel, and verifying the identity of the server.
DRAG DROP (Drag and Drop is not supported)Refer to the exhibit. Drag and drop the element name from the left onto the appropriate piece of the PCAP file on the right.Select and Place:
What is a key difference between a tampered and an untampered disk image during a forensic investigation?
A tampered disk image has been altered after acquisition, which changes its cryptographic hash and breaks integrity verification, while an untampered image retains the same hash value and can be validated as unchanged.
DRAG DROP (Drag and Drop is not supported)Drag and drop the security concept from the left onto the example of that concept on the right.Select and Place:
Refer to the exhibit. An analyst is reviewing network logs using the 5-tuple approach to identify potential security threats. A determination must be made as to which host exhibits a pattern indicative of a sophisticated intrusion attempt. The review considers variations in access patterns, unexpected protocol use, and anomalies in source-destination relationships. Which host is compromised based on the observed network behavior?
The host at 10.1.1.10 repeatedly accesses TCP port 3389, commonly used for Remote Desktop, and also contacts a different subnet on TCP port 8080. This combination suggests possible lateral movement and additional web-based communication. It is the intended suspicious host, although these connection records alone do not prove compromise.
Share your comments for Cisco 200-201 exam with other users:
very useful!
for this question - "which three type of basic patient or member information is displayed on the patient info component? (choose three.)", list of conditions is not displayed (it is displayed in patient card, not patient info). so should be thumbnail of chatter photo
q52 should be d. vm storage controller bandwidth represents the amount of data (in terms of bandwidth) that a vms storage controller is using to read and write data to the storage fabric.
nice questions
very useful
question # 208: failure logs is not an example of operational metadata.
good questions
thank you for the test materials!
its very helpful
good questons
i need the dumb of the hcip security v4.0 exam
upload the dump please
yes, iam looking this
please upload cima e2 managing performance dumps
wonderful questions
i used this site since 2000, still great to support my career
why is the answer to "which of the following is required by scrum?" all of the following stated below since most of them are not mandatory? sprint retrospective. members must be stand up at the daily scrum. sprint burndown chart. release planning.
great job. hope this helps out.
upload please. many thanks!
this is so interesting
great material thanks
anyone who wrote this exam recently
ok they re good
relevant questions
please post
q:42 there has to be a image in the question to choose what does it mean from the options
looking for cphq dumps, where can i find these for free? please and thank you.
@aarun , thanks for the information. it would be great help if you share your email
1z0-1078-23 need this dumps
i gave the microsoft azure az-500 tests and prepared from this site as it has latest mock tests available which helped me evaluate my performance and score 919/1000
i cannot see the button to go to the questions
q-6 ans-b correct. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/commit-configuration-changes