Cisco 200-201 Exam Dumps

What is the function of a command and control server?

A. It enumerates open ports on a network device
B. It drops secondary payload into malware
C. It is used to regain control of the network after a compromise
D. It sends instruction to a compromised system

Answer: D

Which technology on a host is used to isolate a running application from otherapplications?

A. sandbox
B. application allow list
C. application block list
D. host-based firewall

Answer: A

An employee received an email from a colleague’s address asking for the password for thedomain controller. The employee noticed a missing letter within the sender’s address. Whatdoes this incident describe?

A. brute-force attack
B. insider attack
C. shoulder surfing
D. social engineering

Answer: B

During which phase of the forensic process are tools and techniques used to extractinformation from the collected data?

A. investigation
B. examination
C. reporting
D. collection

Answer: D

What should an engineer use to aid the trusted exchange of public keys between usertom0411976943 and dan1968754032?

A. central key management server
B. web of trust
C. trusted certificate authorities
D. registration authority data

Answer: C

Why is HTTPS traffic difficult to screen?

A. HTTPS is used internally and screening traffic (or external parties is hard due toisolation.
B. The communication is encrypted and the data in transit is secured.
C. Digital certificates secure the session, and the data is sent at random intervals.
D. Traffic is tunneled to a specific destination and is inaccessible to others except for thereceiver.

Answer: B

Which tool gives the ability to see session data in real time?

A. tcpdstat
B. trafdump
C. tcptrace
D. trafshow

Answer: C

What are two denial-of-service (DoS) attacks? (Choose two)

A. port scan
B. SYN flood
C. man-in-the-middle
D. phishing
E. teardrop

Answer: B,C

According to the NIST SP 800-86. which two types of data are considered volatile?(Choose two.)

A. swap files
B. temporary files
C. login sessions
D. dump files
E. free space

Answer: C,E

What is the difference between discretionary access control (DAC) and role-based accesscontrol (RBAC)?

A. DAC requires explicit authorization for a given user on a given object, and RBACrequires specific conditions.
B. RBAC access is granted when a user meets specific conditions, and in DAC,permissions are applied on user and group levels.
C. RBAC is an extended version of DAC where you can add an extra level of authorizationbased on time.
D. DAC administrators pass privileges to users and groups, and in RBAC, permissions areapplied to specific groups

Answer: A

What is the difference between a threat and an exploit?

A. A threat is a result of utilizing flow in a system, and an exploit is a result of gainingcontrol over the system.
B. A threat is a potential attack on an asset and an exploit takes advantage of thevulnerability of the asset
C. An exploit is an attack vector, and a threat is a potential path the attack must go through.
D. An exploit is an attack path, and a threat represents a potential vulnerability

Answer: B

What describes a buffer overflow attack?

A. injecting new commands into existing buffers
B. fetching data from memory buffer registers
C. overloading a predefined amount of memory
D. suppressing the buffers in a process

Answer: C

An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret fromthe report?

A. The file will appear legitimate by evading signature-based detection.
B. The file will not execute its behavior in a sandbox environment to avoid detection.
C. The file will insert itself into an application and execute when the application is run.
D. The file will monitor user activity and send the information to an outside source.

Answer: B

What is a description of a social engineering attack?

A. fake offer for free music download to trick the user into providing sensitive data
B. package deliberately sent to the wrong receiver to advertise a new product
C. mistakenly received valuable order destined for another person and hidden on purpose
D. email offering last-minute deals on various vacations around the world with a due dateand a counter

Answer: D

Which are two denial-of-service attacks? (Choose two.)

A. TCP connections
B. ping of death
C. man-in-the-middle
D. code-red
E. UDP flooding

Answer: B,E

What is an incident response plan?

A. an organizational approach to events that could lead to asset loss or disruption ofoperations
B. an organizational approach to security management to ensure a service lifecycle andcontinuous improvements
C. an organizational approach to disaster recovery and timely restoration of operationalservices
D. an organizational approach to system backup and data archiving aligned to regulations

Answer: C

An engineer must compare NIST vs ISO frameworks The engineer deeded to compare asreadable documentation and also to watch a comparison video review. Using Windows 10OS. the engineer started a browser and searched for a NIST document and then opened anew tab in the same browser and searched for an ISO document for comparisonThe engineer tried to watch the video, but there 'was an audio problem with OS so theengineer had to troubleshoot it At first the engineer started CMD and looked fee a driverpath then locked for a corresponding registry in the registry editor The engineer enabled"Audiosrv" in task manager and put it on auto start and the problem was solved Which twocomponents of the OS did the engineer touch? (Choose two)

A. permissions
B. PowerShell logs
C. service
D. MBR
E. process and thread

Answer: A,C

What is the difference between indicator of attack (loA) and indicators of compromise (loC)?

A. loA is the evidence that a security breach has occurred, and loC allows organizations toact before the vulnerability can be exploited.
B. loA refers to the individual responsible for the security breach, and loC refers to theresulting loss.
C. loC is the evidence that a security breach has occurred, and loA allows organizations toact before the vulnerability can be exploited.
D. loC refers to the individual responsible for the security breach, and loA refers to theresulting loss.

Answer: C

Which security model assumes an attacker within and outside of the network and enforcesstrict verification before connecting to any system or resource within the organization?

A. Biba
B. Object-capability
C. Take-Grant
D. Zero Trust

Answer: D

How does a certificate authority impact security?

A. It validates client identity when communicating with the server.
B. It authenticates client identity when requesting an SSL certificate.
C. It authenticates domain identity when requesting an SSL certificate.
D. It validates the domain identity of the SSL certificate.

Answer: D

What is vulnerability management?

A. A security practice focused on clarifying and narrowing intrusion points.
B. A security practice of performing actions rather than acknowledging the threats.
C. A process to identify and remediate existing weaknesses.
D. A process to recover from service interruptions and restore business-critical applications

Answer: C

What is the difference between the ACK flag and the RST flag?

A. True positives affect security as no alarm is raised when an attack has taken place,resulting in a potential breach.
B. True positive alerts are blocked by mistake as potential attacks affecting applicationavailability.
C. False positives affect security as no alarm is raised when an attack has taken place,resulting in a potential breach.
D. False positive alerts are blocked by mistake as potential attacks affecting applicationavailability.

Answer: C

What is the difference between the ACK flag and the RST flag?

A. The RST flag approves the connection, and the ACK flag terminates spontaneousconnections.
B. The ACK flag confirms the received segment, and the RST flag terminates theconnection.
C. The RST flag approves the connection, and the ACK flag indicates that a packet needsto be resent
D. The ACK flag marks the connection as reliable, and the RST flag indicates the failurewithin TCP Handshake

Answer: B