Verified 200-201 dumps Q&As - Pass Guarantee Exam Dumps Test Engine [2025]
200-201 dumps and 452 unique questions
NEW QUESTION # 196 
Refer to the exhibit. Which type of log is displayed?
- A. NetFlow
- B. sys
- C. proxy
- D. IDS
Answer: B
NEW QUESTION # 197
Which type of evidence supports a theory or an assumption that results from initial evidence?
- A. probabilistic
- B. indirect
- C. best
- D. corroborative
Answer: D
Explanation:
Explanation
Corroborating evidence (or corroboration) is evidence that tends to support a theory or an assumption deduced by some initial evidence. This corroborating evidence confirms the proposition. Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide
NEW QUESTION # 198
Refer to the exhibit.
What does this output indicate?
- A. SMB ports are closed on the server.
- B. HTTPS ports are open on the server.
- C. Email ports are closed on the server.
- D. FTP ports are open on the server.
Answer: C
Explanation:
What Are Ports 139 And 445? SMB has always been a network file sharing protocol. As such, SMB requires network ports on a computer or server to enable communication to other systems. SMB uses either IP port
139 or 445. Port 139 - SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network. Port 445 - Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet. https://www.varonis.com/blog/smb-port SMB Ports 139 and 445 are open Email Ports 25 and 110 are closed Therefore "D. Email Ports are closed on the Server."
NEW QUESTION # 199
Refer to the exhibit.
Which type of log is displayed?
- A. proxy
- B. NetFlow
- C. sys
- D. IDS
Answer: B
Explanation:
The exhibit shows a log that contains information such as the date, flow start, duration, protocol used, source and destination IP addresses and ports, packets, bytes, and flows. This type of detailed metadata is typically associated with NetFlow logs which are used for collecting IP traffic information and monitoring network traffic. Reference:= Cisco CyberOps Associate
NEW QUESTION # 200
What is the difference between indicator of attack (loA) and indicators of compromise (loC)?
- A. loA refers to the individual responsible for the security breach, and loC refers to the resulting loss.
- B. loA is the evidence that a security breach has occurred, and loC allows organizations to act before the vulnerability can be exploited.
- C. loC refers to the individual responsible for the security breach, and loA refers to the resulting loss.
- D. loC is the evidence that a security breach has occurred, and loA allows organizations to act before the vulnerability can be exploited.
Answer: D
Explanation:
Indicators of Compromise (IoC) are pieces of forensic data, such as system log entries or files, that suggest an intrusion may have occurred. Indicators of Attack (IoA) are signs that an attack may be underway, allowing organizations to take action before any potential breach occurs.
NEW QUESTION # 201
What is the difference between deep packet inspection and stateful inspection?
- A. Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4
- B. Deep packet inspection is more secure than stateful inspection on Layer 4
- C. Stateful inspection is more secure than deep packet inspection on Layer 7
- D. Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7
Answer: A
Explanation:
Deep packet inspection (DPI) and stateful inspection are two techniques that are used by firewalls and other network security devices to inspect and filter network traffic. Stateful inspection allows visibility on Layer 4 (transport layer) of the OSI model, which means it can track the state of TCP or UDP connections and filter packets based on source and destination IP addresses, ports, and protocols. Deep packet inspection allows visibility on Layer 7 (application layer) of the OSI model, which means it can inspect the contents and payloads of packets and filter packets based on application-specific criteria, such as signatures, keywords, URLs, or behaviors. References:
* Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 2: Security Monitoring, Lesson 2.2: Network Security Monitoring Tools
* Cisco Certified CyberOps Associate Overview, Exam Topics, 2.2 Describe the impact of network security monitoring tools on data privacy
NEW QUESTION # 202
What is a comparison between rule-based and statistical detection?
- A. Statistical is based on measured data while rule-based uses the evaluated probability approach.
- B. Statistical uses the probability approach while rule-based Is based on measured data.
- C. Rule-based uses data known beforehand and statistical is based on assumptions.
- D. Rule-based Is based on assumptions and statistical uses data Known beforehand.
Answer: C
Explanation:
* Rule-based detection methods rely on predefined rules and patterns that are known beforehand. These rules are created based on prior knowledge of what constitutes normal and abnormal behavior.
* Statistical detection, on the other hand, involves analyzing data to identify anomalies. It is based on assumptions about what normal behavior looks like and uses statistical methods to detect deviations from this norm.
* Rule-based systems are typically straightforward but may miss novel attacks that do not match existing rules.
* Statistical methods can detect previously unknown threats by recognizing patterns that deviate from established baselines but may produce more false positives.
References
* Intrusion Detection Systems (IDS) Concepts
* Comparative Studies on Rule-based and Statistical Anomaly Detection
* Understanding Anomaly Detection in Network Security
NEW QUESTION # 203
Which data type is necessary to get information about source/destination ports?
- A. session data
- B. statistical data
- C. connectivity data
- D. alert data
Answer: A
Explanation:
Session data is the data type that is necessary to get information about source/destination ports. Session data is the information about connections between hosts, such as IP addresses, ports, protocols, and duration. Session data can be used to identify the services and applications that are being used on the network, as well as the direction and volume of the traffic. Session data can also help to detect anomalous or malicious behavior, such as port scanning, brute force attacks, or data exfiltration. Session data can be collected from various sources, such as firewalls, routers, switches, or network monitoring tools. References:
* Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 2: Security Monitoring, Lesson 2.2: Data Sources, Topic 2.2.2: Session Data (https://learningnetworkstore.cisco.
com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0
/CSCU-LP-CBROPS-V1-028093.html)
* Cisco Certified CyberOps Associate Certification Guide, Chapter 3: Data Sources, Section 3.2: Session Data (https://www.ciscopress.com/store/cisco-certified-cyberops-associate-certification-guide-
9780136807834)
NEW QUESTION # 204
Which signature impacts network traffic by causing legitimate traffic to be blocked?
- A. false positive
- B. true positive
- C. true negative
- D. false negative
Answer: A
Explanation:
Section: Network Intrusion Analysis
NEW QUESTION # 205
Refer to the exhibit.
What is occurring in this network?
- A. ARP cache poisoning
- B. MAC flooding attack
- C. DNS cache poisoning
- D. MAC address table overflow
Answer: B
Explanation:
The exhibit shows a network diagram with a switch, a router, and two hosts. The switch has a MAC address table that maps the MAC addresses of the connected devices to the corresponding ports. A MAC flooding attack is a type of attack that aims to overload the switch's MAC address table by sending a large number of frames with spoofed source MAC addresses. This causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, effectively turning it into a hub. This allows the attacker tosniff the traffic between the hosts and the router, or launch other attacks such as ARP spoofing or man-in-the- middle
NEW QUESTION # 206
Refer to the exhibit.
What should be interpreted from this packet capture?
- A. 192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.
- B. 81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.
- C. 192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.
- D. 81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.
Answer: A
Explanation:
The packet capture exhibit shows that the source IP address is 192.168.122.100 and it is sending a packet from source port 50272 to destination port 80 of destination IP address 81.179.179.69 using TCP protocol.
The TCP protocol is indicated by the Protocol field which has the value 6. The source and destination ports are indicated by the SrcPort and DstPort fields respectively. The source and destination IP addresses are indicated by the SrcAddr and DstAddr fields respectively. References := Cisco Cybersecurity Operations Fundamentals - Module 3: Network Data and Event Analysis
NEW QUESTION # 207
What is the impact of false positive alerts on business compared to true positive?
- A. False positives alerts are manually ignored signatures to avoid warnings that are already acknowledged, while true positives are warnings that are not yet acknowledged.
- B. False-positive alerts are detected by confusion as potential attacks, while true positives are attack attempts identified appropriately.
- C. True-positive alerts are blocked by mistake as potential attacks, while False-positives are actual attacks Identified as harmless.
- D. True positives affect security as no alarm is raised when an attack has taken place, while false positives are alerts raised appropriately to detect and further mitigate them.
Answer: B
Explanation:
False-positive alerts are alerts that are triggered by benign or normal network traffic and are mistakenly identified as malicious. False positives can have a negative impact on business as they may consume the resources and time of the security team that need to analyze and verify them. True-positive alerts are alerts that correctly identify malicious traffic or activity and require proper incident response procedures. True positives can help the security team to quickly detect and mitigate threats and minimize the damage to the organization.
References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 92;
[Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide], page 98
NEW QUESTION # 208
Refer to the exhibit.
Which tool was used to generate this data?
- A. NetFlow
- B. firewall
- C. dnstools
- D. tcpdump
Answer: D
Explanation:
The data shown in the exhibit is typical of what can be captured and displayed using tcpdump, a command-line packet analyzer that allows users to display TCP/IP and other packets being transmitted or received over a network.
NEW QUESTION # 209
Which step in the incident response process researches an attacking host through logs in a SIEM?
- A. containment
- B. detection and analysis
- C. eradication
- D. preparation
Answer: B
Explanation:
Preparation --> Detection and Analysis --> Containment, Erradicaion and Recovery --> Post-Incident Activity Detection and Analysis --> Profile networks and systems, Understand normal behaviors, Create a log retention policy, Perform event correlation. Maintain and use a knowledge base of information.Use Internet search engines for research. Run packet sniffers to collect additional data. Filter the data. Seek assistance from others.
Keep all host clocks synchronized. Know the different types of attacks and attack vectors. Develop processes and procedures to recognize the signs of an incident. Understand the sources of precursors and indicators.
Create appropriate incident documentation capabilities and processes. Create processes to effectively prioritize security incidents. Create processes to effectively communicate incident information (internal and external communications).
Ref: Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide
NEW QUESTION # 210
Which event artifact is used to identify HTTP GET requests for a specific file?
- A. destination IP address
- B. TCP ACK
- C. URI
- D. HTTP status code
Answer: C
Explanation:
The Uniform Resource Identifier (URI) is used to identify specific resources on the internet, including files. In the context of HTTP GET requests, the URI specifies the path to the file being requested.
References: This explanation is based on standard web protocols and practices, as the current page does not provide specific Cisco documentation.
NEW QUESTION # 211
Which security principle requires more than one person is required to perform a critical task?
- A. need to know
- B. due diligence
- C. separation of duties
- D. least privilege
Answer: C
Explanation:
Separation of duties is a security principle that requires more than one person to perform a critical task, such as authorizing a transaction, approving a budget, or granting access to sensitive data. Separation of duties reduces the risk of fraud, error, abuse, or conflict of interest by preventing any single person from having too much power or privilege. Least privilege, need to know, and due diligence are other security principles, but they do not require more than one person to perform a critical task. Reference: Separation of Duty (SOD) - Glossary | CSRC - NIST Computer Security ..., Separation of Duties | Imperva
NEW QUESTION # 212
Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?
- A. replay
- B. man-in-the-middle
- C. known-plaintext
- D. dictionary
Answer: B
Explanation:
A man-in-the-middle attack occurs when a third party intercepts and potentially alters the communication between two parties (in this case, two IP phones) without them knowing. This type of attack can lead to eavesdropping, where the attacker can gain unauthorized access to sensitive data being communicated between the two parties. References := Cisco Cybersecurity Operations Fundamentals - Module 5: Endpoint Threat Analysis and Computer Forensics
NEW QUESTION # 213
Which two elements are assets in the role of attribution in an investigation? (Choose two.)
- A. firewall logs
- B. threat actor
- C. session
- D. context
- E. laptop
Answer: B,E
Explanation:
In the context of cybersecurity, an asset is anything that has value to the organization, its business operations and their continuity, including data and physical devices. In the role of attribution in an investigation, which is the process of associating an action or event with a particular individual or entity, certain assets are particularly relevant. A laptop can be an asset because it may contain data or clues that can help trace the origin of a cyber attack. Similarly, identifying the threat actor (E) is crucial for attribution, as it involves understanding who is behind the attack and their motives, which can be essential for preventing future attacks and for legal proceedings.
NEW QUESTION # 214
......
200-201 Dumps for Pass Guaranteed - Pass 200-201 Exam: https://www.practicetorrent.com/200-201-practice-exam-torrent.html
200-201 Exam Dumps - Try Best 200-201 Exam Questions: https://drive.google.com/open?id=1BXW9PH0zjeRPMEJNbwNILi-nyDnjgs8Q