200-201 Exam Questions

An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst...

What best describes the Security Operations Center (SOC)?

Which term represents a potential danger that could take advantage of a weakness in a system?

Which artifact is used to uniquely identify a detected file?

How does an attacker observe network traffic exchanged between two users?

Refer to the exhibit. Which event is occurring?

What is a benefit of agent-based protection when compared to agentless protection?

Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection. Which two pieces of inf...

An analyst is exploring the functionality of different operating systems. What is a feature of Windows Management Instrumentation that must be considered when deciding on an operat...

One of the objectives of information security is to protect the CIA of information and systems. What does CIA mean in this context?

What is rule-based detection when compared to statistical detection?

What is personally identifiable information that must be safeguarded from unauthorized access?

How does an SSL certificate impact security between the client and the server?

Which type of exploit normally requires the culprit to have prior access to the target system?

Which identifier is used to describe the application or process that submitted a log message?

Which type of data is used to monitor and detect anomalies within the organization's network?

At which layer is deep packet inspection investigated on a firewall?

Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?

What is an attack surface as compared to a vulnerability?

What is a difference between SOAR and SIEM?

Refer to the exhibit. Which application protocol is in this PCAP file?

Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

What is a difference between inline traffic interrogation and traffic mirroring?

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network. What is the impact of this traffic?

Which of the following access control models use security labels to make access decisions?

What is the main advantage of using a mandatory access control (MAC) model instead of a discretionary access control (DAC) model?

How is attacking a vulnerability categorized?

A system administrator is ensuring that specific registry information is accurate. Which type of configuration information does the HKEY_LOCAL_MACHINE hive contain?

What is the difference between statistical detection and rule-based detection models?

Which step in the incident response process researches an attacking host through logs in a SIEM?

What is the difference between a threat and a risk?

Which signature impacts network traffic by causing legitimate traffic to be blocked?

Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

What is ransomware?

What two are examples of UDP-based attacks? (Choose two.)

What causes events on a Windows system to show Event Code 4625 in the log messages?

Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

Refer to the exhibit. What does the message indicate?

What are two social engineering techniques? (Choose two.)

Refer to the exhibit. What does the output indicate about the server with the IP address 172.18.104.139?

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?

What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

A malicious file has been identified in a sandbox analysis tool. Which piece of information is needed to search for additional downloads of this file by other hosts?

Which attack method intercepts traffic on a switched network?

Which two elements are used for profiling a network? (Choose two.)