200-201 Exam Questions

What does an attacker use to determine which network ports are listening on a potential target device?

What type of spoofing attack uses fake source IP addresses that are different than their real IP addresses?

What is a purpose of a vulnerability management framework?

Refer to the exhibit. Which kind of attack method is depicted in this string?

Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?

How does certificate authority impact a security system?

How is NetFlow different than traffic mirroring?

What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

Which type of data collection requires the largest amount of storage space?

Which HTTP header field is used in forensics to identify the type of browser used?

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applicat...

What is the virtual address space for a Windows process?

Which access control model does SELinux use?

Which two compliance frameworks require that data be encrypted when it is transmitted over a public network? (Choose two.)

Which IETF standard technology is useful to detect and analyze a potential security incident by recording session flows that occurs between hosts?

What do the Security Intelligence Events within the FMC allow an administrator to do?

The target web application server is running as the root user and is vulnerable to command injection. Which result of a successful attack is true?

A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this...

What is the practice of giving an employee access to only the resources needed to accomplish their job?

Which metric is used to capture the level of access needed to launch a successful attack?

What is the difference between an attack vector and attack surface?

Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and write...

What specific type of analysis is assigning values to the scenario to see expected outcomes?

When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

Why is encryption challenging to security monitoring?

What is an example of social engineering attacks?

Refer to the exhibit. What is occurring in this network?

Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

Which action prevents buffer overflow attacks?

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

Refer to the exhibit. What should be interpreted from this packet capture?

What are the two characteristics of the full packet captures? (Choose two.)

Refer to the exhibit. An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?

Refer to the exhibit. What is occurring in this network traffic?

A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

Which incidence response step includes identifying all hosts affected by an attack?

Which event artifact is used to identify HTTP GET requests for a specific file?

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occu...

What does cyber attribution identify in an investigation?

Which system monitors local system operation and local network access for violations of a security policy?

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

What is the impact of false positive alerts on business compared to true positive?

An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task?

Refer to the exhibit. Which technology generates this log?

Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers with...

Which tool provides a full packet capture from network traffic?

A company is using several network applications that require high availability and responsiveness, such that milliseconds of latency on network traffic is not acceptable. An engine...

Refer to the exhibit. What is depicted in the exhibit?