Cisco 200-201 Exam Dumps

The security team has detected an ongoing spam campaign targeting the organization. The team's approach is to push back the cyber kill chain and mitigate ongoing incidents. At which phase of the cyber kill chain should the security team mitigate this type of attack?

A. actions
B. delivery
C. reconnaissance
D. installation 

Answer: B

A user received an email attachment named "Hr405-report2609-empl094.exe" but did not run it. Which category of the cyber kill chain should be assigned to this type of event?

A. installation
B. reconnaissance
C. weaponization
D. delivery 

Answer: A

Which type of verification consists of using tools to compute the message digest of the original and copied data, then comparing the similarity of the digests?

A. evidence collection order
B. data integrity
C. data preservation
D. volatile data collection 

Answer: B

According to the September 2020 threat intelligence feeds a new malware called Egregor was introduced and used in many attacks. Distnbution of Egregor is pnmanly through a Cobalt Strike that has been installed on victim's workstations using RDP exploits Malware exfiltrates the victim's data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it. Which type of attack is described?

A. malware attack
B. ransomware attack
C. whale-phishing
D. insider threat 

Answer: B

What are the two differences between stateful and deep packet inspection? (Choose two ) 

A. Stateful inspection is capable of TCP state tracking, and deep packet filtering checksonly TCP source and destination ports
B. Deep packet inspection is capable of malware blocking, and stateful inspection is not
C. Deep packet inspection operates on Layer 3 and 4. and stateful inspection operates onLayer 3 of the OSI model
D. Deep packet inspection is capable of TCP state monitoring only, and stateful inspectioncan inspect TCP and UDP.
E. Stateful inspection is capable of packet data inspections, and deep packet inspection isnot

Answer: A,B

How does agentless monitoring differ from agent-based monitoring? 

A. Agentless can access the data via API. while agent-base uses a less efficient method and accesses log data through WMI.
B. Agent-based monitoring is less intrusive in gathering log data, while agentless requires open ports to fetch the logs
C. Agent-based monitoring has a lower initial cost for deployment, while agentless monitoring requires resource-intensive deployment.
D. Agent-based has a possibility to locally filter and transmit only valuable data, while agentless has much higher network utilization 

Answer: B

How does TOR alter data content during transit? 

A. It spoofs the destination and source information protecting both sides. 
B. It encrypts content and destination information over multiple layers. 
C. It redirects destination traffic through multiple sources avoiding traceability.
D. It traverses source traffic through multiple destinations before reaching the receiver

Answer: B

An organization is cooperating with several third-party companies. Data exchange is on an unsecured channel using port 80 Internal employees use the FTP service to upload and download sensitive data An engineer must ensure confidentiality while preserving the integrity of the communication. Which technology must the engineer implement in this scenario'?

A. X 509 certificates
B. RADIUS server
C. CA server
D. web application firewall

Answer: A

Syslog collecting software is installed on the server For the log containment, a disk with FAT type partition is used An engineer determined that log files are being corrupted when the 4 GB tile size is exceeded. Which action resolves the issue? 

A. Add space to the existing partition and lower the retention penod.
B. Use FAT32 to exceed the limit of 4 GB.
C. Use the Ext4 partition because it can hold files up to 16 TB.
D. Use NTFS partition for log file containment 

Answer: D

What is threat hunting? 

A. Managing a vulnerability assessment report to mitigate potential threats.
B. Focusing on proactively detecting possible signs of intrusion and compromise.
C. Pursuing competitors and adversaries to infiltrate their system to acquire intelligencedata.
D. Attempting to deliberately disrupt servers by altering their availability

Answer: A

An engineer is addressing a connectivity issue between two servers where the remote server is unable to establish a successful session. Initial checks show that the remote server is not receiving an SYN-ACK while establishing a session by sending the first SYN. What is causing this issue?

A. incorrect TCP handshake
B. incorrect UDP handshake
C. incorrect OSI configuration
D. incorrect snaplen configuration 

Answer: A

Which data type is necessary to get information about source/destination ports? 

A. statistical data
B. session data
C. connectivity data
D. alert data 

Answer: B

Which of these describes SOC metrics in relation to security incidents? 

A. time it takes to detect the incident
B. time it takes to assess the risks of the incident
C. probability of outage caused by the incident
D. probability of compromise and impact caused by the incident

Answer: A

What is an advantage of symmetric over asymmetric encryption? 

A. A key is generated on demand according to data type.
B. A one-time encryption key is generated for data transmission
C. It is suited for transmitting large amounts of data.
D. It is a faster encryption mechanism for sessions

Answer: C

What describes the defense-m-depth principle? 

A. defining precise guidelines for new workstation installations
B. categorizing critical assets within the organization
C. isolating guest Wi-Fi from the focal network
D. implementing alerts for unexpected asset malfunctions

Answer: B

What is a benefit of using asymmetric cryptography? 

A. decrypts data with one key
B. fast data transfer
C. secure data transfer
D. encrypts data with one key

Answer: B

What is a difference between an inline and a tap mode traffic monitoring? 

A. Inline monitors traffic without examining other devices, while a tap mode tags traffic andexamines the data from monitoring devices.
B. Tap mode monitors traffic direction, while inline mode keeps packet data as it passesthrough the monitoring devices.
C. Tap mode monitors packets and their content with the highest speed, while the inlinemode draws a packet path for analysis.
D. Inline mode monitors traffic path, examining any traffic at a wire speed, while a tap modemonitors traffic as it crosses the network.

Answer: D