200-201 Exam Questions

A SOC analyst detected connections to known C&C and port scanning activity to main HR database servers from one of the HR endpoints, via Cisco StealthWatch. What are the two next s...

Refer to the exhibit. An engineer received a ticket about a slowdown of a web application. During analysis of traffic, the engineer suspects a possible attack on a web server. How...

Refer to the exhibit. Which alert is identified from this packet capture?

An organization that develops high-end technology is going through an internal audit. The organization uses two databases. The main database stores patent information and a seconda...

Which option describes indicators of attack?

Refer to the exhibit. Where is the executable file?

Refer to the exhibit. A company's user HTTP connection to a malicious site was blocked according to configured policy. What is the source technology used for this measure?

What is a difference between a threat and a risk?

A SOC analyst observed Ursnif malware at the SIEM dashboard. The analyst opened the PCAP file to search the certificate issue data. Where must the analyst navigate?

Which technique is a low-bandwidth attack?

Refer to exhibit. An analyst performs the analysis of the pcap file to detect the suspicious activity. What challenges did the analyst face in terms of data visibility?

What matches the regular expression c(rgr)+e?

Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

Which classification of cross-site scripting attack executes the payload without storing it for repeated use?

Which attack method is being used when an attacker tries to compromise a network with an authentication system that uses only 4-digit numeric passwords and no username?

What is the purpose of a ransomware attack?

A company's cyber security team performed a phishing simulation campaign for employees and performed security awareness trainings to affected personal. According to NIST.SP800-61,...

What do host-based firewalls protect workstations from?

Which type of data must an engineer capture to analyze payload and header information?

An engineer must compare NIST vs ISO frameworks. The engineer decided to compare as readable documentation and also to watch a comparison video review. Using Windows 10 OS, the eng...

Refer to the exhibit. Which application-level protocol is being targeted?

How can TOR impact data visibility inside an organization?

A network engineer noticed in the NetFlow report that internal hosts are sending many DNS requests to external DNS servers. A SOC analyst checked the endpoints and discovered that...

Endpoint logs indicate that a machine has obtained an unusual gateway address and unusual DNS servers via DHCP. Which type of attack is occurring?

Why should an engineer use a full packet capture to investigate a security breach?

Which action matches the weaponization step of the Cyber Kill Chain model?

Which process represents the application-level allow list?

A cyberattacker notices a security flaw in a software that a company is using. They decide to tailor a specific worm to exploit this flaw and extract saved passwords from the softw...

According to CVSS, what is a description of the attack vector score?

Refer to the exhibit. An attacker gained initial access to the company's network and ran an Nmap scan to advance with the lateral movement technique and to search the sensitive dat...

Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?

Which two measures are used by the defense-in-depth strategy? (Choose two.)

Refer to the exhibit. What is the outcome of the command?

Which example represents the defense-in-depth principle?

What is the purpose of a SIEM solution?

Refer to the exhibit. What does this Cuckoo sandbox report indicate?

Which evasion method is being used when TLS is observed between two endpoints?

What is a comparison between rule-based and statistical detection?

What are the two differences between vulnerability and exploit? (Choose two.)

What are two differences of deep packet inspection compared to stateful firewall inspection? (Choose two.)

Refer to the exhibit. A network engineer is analyzing a network activity within captured traffic. An engineer notices suspicious behavior, a type of ICMP that Wireshark does not re...

Refer to the exhibit. What is occurring?

Refer to the exhibit. A security analyst received a ticket about suspicious traffic from one of the workstations. During the investigation, the analyst discovered that the workstat...

What is email greylisting by the mail transfer agent?

What is used to maintain persistent control of an exploited device?

Refer to the exhibit. Which type of evidence is this file?

According to CVSS, which metric group does user interaction belong to?

What is the impact of a ransomware infection?

Which piece of information is needed for attribution in an investigation?

What are two types of cross site scripting attacks? (Choose two.)