200-201 Exam Questions

A security engineer must implement IPS inside a DMZ organization. One of the requirements is to be able to block suspicious traffic based on a triggered signature in real life. IPS...

Refer to the exhibit. What is occurring?

Refer to the exhibit. An engineer is analyzing events from a recent attack attempt on an organization where threat actors managed to target HR critical servers within the internal...

What is a description of the use of full packet capture in security monitoring?

What is a sandbox interprocess communication service?

A vulnerability analyst is performing the monthly scan data review. Output data is very big and getting bigger each month. The analyst decides to create a more efficient process to...

Refer to the exhibit. A SOC analyst is examining the Windows security logs of one of the endpoints. What is the possible reason for this event log?

A cyber security engineer is performing a forensic investigation on a system. What is evidence that data has been modified?

Refer to the exhibit. A SOC analyst is examining the Auth.log file logs of one the breached systems. What is the possible reason for this event log?

What is the purpose of the endpoint sandboxing technology?

An engineer configured regular expression ".*\.([Dd][Oo][Cc]|[Xx][LI][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]" on Cisco ASA firewall. What does this regular expression do?

Refer to the exhibit. What is occurring?

Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?

Refer to the exhibit. What kind of activity occurs in the network?

Refer to the exhibit. In the PCAP file, what is the MAC address of the server that has 443 port open?

Refer to the exhibit. An engineer is analyzing DNS response packets that are larger than expected. The engineer looks closer and notices a lack of appropriate DNS queries. What is...

Refer to the exhibit. An attacker infiltrated an organization's network and ran a scan to advance with the lateral movement technique. Which two elements from the scan assists the...

Refer to the exhibit. A network engineer received a report that a host is communicating with unknown domains on the internet. The network engineer collected packet capture but coul...

A penetration tester runs the Nmap scan against the company server to uncover possible vulnerabilities and exploit them. Which two elements can the penetration tester identify from...

Refer to the exhibit. An engineer must use a 5-tuple approach to isolate a compromised host in a grouped set of logs. Which data must the engineer use?

Refer to the exhibit. What is occurring?

Refer to the exhibit. What is a description of the initial tcp connection?

What is the difference between RST flag and ACK flag?

Refer to the exhibit. An engineer must interpret the exhibit with a 5-tuple approach. What is occurring?

Refer to the exhibit. An engineer must identify the certificate components. Which TLS version must an engineer identify?

The SOC team has confirmed a potential indicator of compromise on an isolated endpoint. The team has narrowed the potential malware type to a new trojan family. According to the NI...

An OSINT team scans the target hosts, gathers information regarding the adversary online services, and equips the red team with the obtained information. Which step in the kill cha...

A group of company-owned endpoints were infected by ransomware via phishing email. Which two stakeholders must be involved in the containment phase? (Choose two.)

A member of the SOC team is checking the dashboard provided by the Cisco Firepower Manager for further isolation actions. According to NIST.SP800-61, in which phase of incident res...

A software development company develops high-end technology for the customer that will go through the HIPAA audit program. The technology will be hosted on the cloud, and the healt...

A network engineer informed a security team of a large amount of traffic and suspicious activity from an unknown source to the company DMZ server. The security team reviewed the da...

A security consultant must change the identity access management model for their organization. The new approach will put responsibility on the owner, who will decide which users wi...

What describes the vulnerability management process?

An organization had a major incident recently where their servers were attacked and the data integrity was breached. An attacker used a vulnerability on TLS version 1.2 and perform...

A security team received a ticket regarding a potentially malicious file found on a company server. A security team confirmed that the file is malicious and identified it as a new...

What does the Zero Trust security model signify?

What describes the impact of TOR on data visibility?

Drag and Drop Question Drag and drop the uses on the left onto the type of security system on the right. Answer:

Refer to the exhibit. Which set of actions must an engineer perform to identify and fix this issue?

Refer to the exhibit, which TLS version does this client support?

An engineer is sharing folders and files with different departments and got this error: "No such file or directory". What must the engineer verify next?

What is a difference between rule-based and role-based access control mechanisms?

A large load of data is being transferred to an external destination via UDP 53 port. Which obfuscation technique is used?

Which regular expression matches loopback IP address (127.0.0.1)?

What is the role of indicator of compromise in an investigation?

What is the benefit of processing statistical data for security systems?

A security specialist is investigating an incident regarding a recent major breach in the organization. The accounting data from a 24-month period is affected due to a trojan detec...

According to CVSS, which condition is required for attack complexity metrics?

What are two differences and benefits of packet filtering, stateful firewalling, and deep packet inspections? (Choose two.)

What is the advantage of agent-based protection compared to agentless protection?