200-201 Exam Questions

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

In a SOC environment, what is a vulnerability management metric?

Which category relates to improper use or disclosure of PII data?

Which regex matches only on all lowercase letters?

Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?

An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise. Which kind of evidence is this IP addre...

Which security technology allows only a set of pre-approved applications to run on a system?

Refer to the exhibit. Which type of log is displayed?

Refer to the exhibit. Which two elements in the table are parts of the 5-tuple? (Choose two.)

Which security principle is violated by running all processes as root or administrator?

What is the function of a command and control server?

What is the difference between deep packet inspection and stateful inspection?

Which evasion technique is a function of ransomware?

What does cyber attribution identity in an investigation?

Drag and Drop Question Drag and drop the security concept on the left onto the example of that concept on the right. Answer:

Drag and Drop Question Refer to the exhibit. Drag and drop the element name from the left onto the correct piece of the PCAP file on the right. Answer:

Drag and Drop Question Drag and drop the access control models from the left onto the correct descriptions on the right. Answer:

Drag and Drop Question Drag and drop the technology on the left onto the data type the technology provides on the right. Answer:

Which tool is commonly used by threat actors on a webpage to take advantage of the softwarevulnerabilitiesof a system to spread malware?

Which two methods might be used by an analyst to detect SSL/TLS encrypted command-and- control communication? (Choose two.)

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavio...

When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification. Which information is available on...

A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor. Which typ...

Which two elements of the incident response process are stated in NIST Special Publication 800- 61 r2? (Choose two.)

Which utility blocks a host portscan?

Which event is user interaction?

An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to eng...

Refer to the exhibit. What information is depicted?

Which type of evidence supports a theory or an assumption that results from initial evidence?

When you are researching a Windows operating system vulnerability (such as CVE-2016-7211), which organization can provide detailed information about the specific vulnerability?

Which property of a cryptographic hash algorithm is desirable?

Which two elements are assets in the role of attribution in an investigation? (Choose two.)

Which regular expression matches "color" and "colour"?

A user received a malicious attachment but did not run it. Which category classifies the intrusion?

Which process is used when IPS events are removed to improve data integrity?

An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?

Which piece of information is needed for attribution in an investigation?

Refer to the exhibit. In which Linux log file is this output found?

What is the difference between the ACK flag and the RST flag in the NetFlow log session?

Which type of data typically consists of connection level, application-specific records generated from network traffic?

What are three key components of a threat-centric SOC? (Choose three.)

An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?

Refer to the exhibit. Which type of log is displayed?

What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

Which two components reduce the attack surface on an endpoint? (Choose two.)

An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

Which event artifact is used to identity HTTP GET requests for a specific file?

Which security principle requires more than one person is required to perform a critical task?

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

What makes HTTPS traffic difficult to monitor?