200-201 Exam Questions

Refer to the exhibit. Which field contains DNS header information if the payload is a query or a response?

Refer to the exhibit. What is occurring?

What is the difference between vulnerability and risk?

An engineer received a flood of phishing emails from HR with the source address HRjacobm@companycom. What is the threat actor in this scenario?

Refer to the exhibit. A security analyst is investigating unusual activity from an unknown IP address Which type of evidence is this file1?

Drag and Drop Question Drag and drop the data source from the left onto the data type on the right. Answer:

A user received a targeted spear-phishing email and identified it as suspicious before opening the content. To which category of the Cyber Kill Chain model does to this type of eve...

According to the NIST SP 800-86, which two types of data are considered volatile? (Choose two.)

Refer to the exhibit. An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

What is the difference between deep packet inspection and stateful inspection?

What should an engineer use to aid the trusted exchange of public keys between user tom0411976943 and dan1968754032?

Which tool gives the ability to see session data in real time?

What is a description of a social engineering attack?

What describes a buffer overflow attack?

Which are two denial-of-service attacks? (Choose two.)

Refer to the exhibit. Where is the executable file?

Why is HTTPS traffic difficult to screen?

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for fur...

Which two elements of the incident response process are stated in NIST SP 800-61 r2? (Choose two.)

Which security model assumes an attacker within and outside of the network and enforces strict verification before connecting to any system or resource within the organization?

An employee received an email from a colleague's address asking for the password for the domain controller. The employee noticed a missing letter within the sender's address. What...

What is the difference between indicator of attack (loA) and indicators of compromise (loC)?

Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

What are the three critical security principles or goals of the CIA triad?

What is the difference between SIEM and SOAR?

Refer to the exhibit. A SOC engineer is analyzing the provided Cuckoo Sandbox report for a file that has been downloaded from an URL, received via email. What is the state of this...

Refer to the exhibit. An engineer needs to identify certificate information on server1234567890. What does the exhibit indicate?

Which of these describes volatile evidence?

What are two differences between tampered disk images and untampered disk images? (Choose two.)

What is the functionality of an IDS?

What is a description of "phishing" as a social engineering attack?

Which technique describes altering the data content and avoiding identification?

Which CVSS metric group identifies other components that are affected by a successful security attack?

Refer to the exhibit. A suspicious IP address is tagged by Threat Intelligence as a brute-force attempt source. After the attacker produces many of failed login entries it successf...

An engineer is working on a ticket for an incident from the incident management team. A week ago, an external web application was targeted by a DDoS attack. Server resources were e...

What is the difference between attack surface and vulnerability?

What is a scareware attack?

What is the communication channel established from a compromised machine back to the attacker?

During which phase of the forensic process are tools and techniques used to extract information from the collected data?

An information security analyst inspects the .pcap file and observes encrypted unusual SSH traffic flow over nonstandard ports Which technology makes this behavior feasible?+

Refer to the exhibit. Which technology produced the log?

What is the role of NAT in data visibility?

What is the purpose of command and control for network-aware malware?

Which element is included in an incident response plan as stated in NIST.SP800-617

Refer to exhibit. Which alert is identified from this packet?

Which statement describes patch management?

A user received a malicious email attachment named "DS045-report1122345.exe" and executed it. In which step of the Cyber Kill Chain is this event?

What is sliding window anomaly detection?

Refer to the exhibit. What should be interpreted from this packet capture?

Which type of attack is a blank email with the subject "price deduction" that contains a malicious attachment?