200-201 Exam Questions

Refer to the exhibit. A security analyst wraps up the shift and passed open ticket notes to the night shift SOC team analyst. The ticket name in QUESTION 5is "Investigating suspici...

What is the difference between tampered and untampered disk images?

What is the purpose of a host-based intrusion detection system (HIDS)?

Refer to the exhibit. A SOC analyst received a message from SIEM about abnormal activity on the Windows server. The analyst checked the Windows event log and saw numerous Audit Fai...

What is a key difference between a tampered and an untampered disk image during a forensic investigation?

Refer to the exhibit. A SOC engineer is analyzing this Cuckoo Sandbox report for a file that has been identified as suspicious by the endpoint security system. What is the state of...

Refer to the exhibit. What is occurring?

Refer to the exhibit. An engineer must interpret logs. What is occurring?

What is data tunneling?

Which two attacks are denial-of-service attacks? (Choose two.)

Refer to the exhibit. An analyst receives an IDS alert pertaining to a possible data exfiltration attempt. An additional set of logs is collected from different systems and analyze...

A compliance analyst has received a complaint from a customer regarding personal data being held by the company unlawfully, despite the customer's request for it to be deleted. The...

A user reported that a mobile application is working very slowly. The DDOS tool reports high volume traffic. During which phase will CSIRT ensure that the incident does not continu...