200-201 Exam Questions

A suspicious user opened a connection from a compromised host inside an organization. Traffic was going through a router and the network administrator was able to identify this flo...

What is the difference between antimalware and antivirus solutions?

Refer to the exhibit. What type of event is occurring?

An analyst see that this security alert "Default-Botnet-Communication-Detection-By-Endpoint" has been raised from the IPS. The analyst checks and finds that an endpoint communicate...

What is the difference between authentication and authorization?

Refer to the exhibit. An engineer must map these events to the source technology that generated the event logs. To which technology do the generated logs belong?

An engineer received a ticket to investigate a potentially malicious file detected by a malware scanner that was trying to execute multiple commands. During the initial review, the...

Which management concept best describes developing, operating maintaining upgrading, and disposing of all resources?

What is a disadvantage of the asymmetric encryption system?

Which data capture includes payload and header information?

If a web server accepts input from the user and passes it to a bash shell, to which attack method is it vulnerable?

In digital communications, which method is recommended for securely exchanging public keys between users T0n2262144790 and D4n4126220794?

Refer to the exhibit. The figure shows an X.509 certificate. Which field represents the digital cryptographic algorithm used by the issuer to sign the certificate?

A security analyst reviews the firewall and observes the large number of frequent events. The analyst starts the packet capture with the Wireshark and identifies that TCP port reus...

Which data type is used to recreate a binary file for malware analysis?

Refer to the exhibit. A communication issue exists between hosts 192.168.0.11 and 32.253.101.190. What is a description of the initial tcp connection?

What is the key difference between mandatory access control (MAC) and discretionary access control (DAC)?

Which piece of information is part of the chain of custody during investigation?

What is corroborating evidence?

What is the difference between an attack vector and an attack surface?

Refer to the exhibit. Based on the .pcap file, which protocol's vulnerability has been exploited to establish a session?

How does the approach of a behavioral detection system to identifying security threats compare to that of a rule-based detection system?

What is the definition of threat intelligence in the context of cybersecurity?

Refer to the exhibit. Based on the .pcap file, which DNS server is used to resolve cisco.com?

What describes the public key infrastructure (PKI)?

Which access control should a chief information security officer select to protect extremely sensitive data categorized at various levels of confidentiality?

Refer to the exhibit. A SOC team member receives a case from his colleague with notes attached. The artifacts and alerts associated with the case must be analyzed and a conclusion...

Refer to the exhibit. A security analyst examines Apache web server logs and notices the entries. Which security concern is occurring?

What is an evasion technique?

What describes the difference when comparing attack surface and vulnerability in practice?

A company had a recent breach and lost confidential data to a competitor. An internal investigation found out that a new junior accounting specialist logged in to the accounting se...

Which tool is used by threat actors on a webpage to take advantage of the software vulnerabilities of a system to spread malware?

What is a difference between a threat and a vulnerability?

A company recently encountered a breach. Critical services went through a disturbance and the integrity of the data was altered. An engineer is investigating the issue and searchin...

Refer to the exhibit. A security engineer receives several alerts from the SNORT IPS/IDS reporting malicious traffic. What should the engineer understand by examining the SNORT log...

A data privacy officer at a marketing firm has received a request from a former client to delete all personally sensitive information held by the company. The firm operates globall...

Which type of attack involves sending input commands to a web server to access data?

Drag and Drop Question Drag and drop the definitions from the left onto the phases on the right to classify intrusion events according to the Cyber Kill Chain model. Answer:

Drag and Drop Question Drag and drop the data sources from the left onto the corresponding data types on the right. Answer:

In network security, which scenario highlights an advantage that deep packet inspection holds over traditional packet filtering?

While analyzing the process of a recent breach case, a forensic investigator determined that an external USB drive was connected to the laptop of the HR manager and personal data o...

Refer to the exhibit. During an investigation of unauthorized data exfiltration from a company's network, these logs were collected. Which log entry would be considered the best ev...

An engineer is examining a particular network traffic sample from multiple sources aggregated into an alert via the company SIEM. These observations are noted within said alert: an...

What is the name of the technology that searches and reports on known weaknesses and flaws that are present in the IT infrastructure of an organization?

A security team received a ticket to investigate suspicious emails to company employees sent from a list of malicious domains. Further analysis showed that a targeted phishing atte...

What is a ransomware attack?

An analyst must choose one source of information for further troubleshooting. One key requirement is to use low storage space over the next 12 months and quickly determine the sour...

An engineer must analyze a security event from last month. The engineer has access to a .pcap file collected from traffic mirroring and NetFlow data. The engineer must perform chec...

A multinational organization uses a complex network infrastructure, incorporating various cloud services, different endpoints, and distributed networks with several network securit...

An engineer must gather data for monitoring purposes from different network devices. The engineer must gather events from the local network and use that information for packet snif...