200-201 Exam Questions

What is a Heartbleed vulnerability?

Refer to the exhibit. What is the logical source device for these events?

A user received a suspicious email and reported it to the SOC team. After analysis, the team concluded that it was a spear phishing attack. According to the Diamond Model, how is t...

What is the difference between the ACK flag and the RST flag?

An engineer must investigate suspicious connections. Data has been gathered using a tcpdump command on a Linux device and saved as sandboxmalware2022-12-22.pcaps file. The engineer...

Where is a host-based intrusion detection system located?

Which SOC metric represents the time to stop the incident from causing further damage to systems or data?

Which technique obtains information about how the system works without knowing it's design details?

Which risk approach eliminates activities posing a risk exposure?

What is session data used for in network security?

Drag and Drop Question Refer to the exhibit. Drag and drop the element names from the left onto the corresponding pieces of the PCAP file on the right. Answer:

Drag and Drop Question Cisco's Zero Trust Architecture simplifies the Zero Trust journey into three critical areas. Drag the definitions onto the graphic to describe Zero Trust fro...

Refer to the exhibit. Which tool was used to generate this data?

Which evasion method involves performing actions slower than normal to prevent detection?

After a large influx of network traffic to externally facing devices, a security engineer begins investigating what appears to be a denial of service attack. When the packet captur...

What is a difference between SIEM and SOAR security systems?

What is the dataflow set in the NetFlow flow-record format?

An employee received an email from a colleague's address asking for the password for the domain controller. The employee noticed a missing letter within the sender's address. What...

A security engineer must investigate a recent breach within the organization. An engineer noticed that a breached workstation is trying to connect to the domain "Ranso4676-mware41-...

According to CVSS, what is attack complexity?

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

Which action matches the weaponization step of the Cyber Kill Chain Model?

A security engineer must protect the company from known issues that trigger adware. Recently a new incident has been raised that could harm the system. Which security concepts are...

Refer to exhibit. An engineer is investigating an intrusion and is analyzing the pcap file. Which two key elements must an engineer consider? (Choose two.)

For which items is an end-point application greylist used?

How does rule-based detection differ from behavioral detection?

What is a description of a social engineering attack?

A user reports difficulties accessing certain external web pages. When an engineer examines traffic to and from the external domain in full packet captures, they notice that many S...

Refer to the exhibit. Which attack is being attempted against a web application?

What is the impact of false negative alerts when compared to true negative alerts?

What describes the framework that enables to control user access to critical information in the heterogenous technology environments?

A company plans to implement network segmentations and use IP address inventory management best practices. Servers and end-user devices are using the same VLANs and IP subnets with...

What does the SOC metric MTTC provide in incident analysis?

How is SQL injection prevented?

A vulnerability is discovered on a network. If successfully exploited, it will completely remove the ability of the system to limit disclosure of information to an unauthorized use...

What matches the regular expression r(ege)+x?

Which statement describes indicators of attack?

Which type of data is used to detect anomalies in the network?

What is data encapsulation?

Which type of attack uses a botnet to reflect requests off of an NTP server to overwhelm a target?

An analyst performs traffic analysis to detect suspicious activity and identifies the multiple UDP connections through the same port. Which technology makes this behavior feasible?

Which of these is a defense-in-depth strategy principle?

Which security monitoring data type is associated with application server logs?

Which principle reduces the risk of attackers gaining access to sensitive data by compromising a low-level user account?

What is the impact of encryption on data visibility?

During a quarterly vulnerability scan, a security analyst discovered unused uncommon ports open and in a listening state. Further investigation showed that the unknown application...

Which description is a defense-in-depth principal strategy?

What can be identified from the exhibit?

What is a description of a man-in-the-middle network attack?

What is a threat actor?