200-201 Exam Questions

Which two protocols are used for DDoS amplification attacks? (Choose two.)

An engineer must create a SIEM rule to test events and traffic for spikes and changes that occur in regular patterns to detect irregularities. Which rules achieve the desired resul...

Refer to the exhibit. What occurred on this system based on this output?

Which type of evasion technique is accomplished by separating the traffic into smaller segments before transmitting across the network?

What is a Shellshock vulnerability?

Refer to the exhibit. What is occurring in this network traffic?

What is the impact of encapsulation on the network?

An analyst performs traffic analysis to detect data exfiltration and identifies a high frequency of DNS requests in a small period of time. Which technology makes this behavior fea...

According to CVSS, what is the attack vector?

An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The se...

A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple a...

What is the relationship between a vulnerability and a threat?

What is the principle of defense-in-depth?

What is the difference between the rule-based detection when compared to behavioral detection?

What is the difference between attack surface and vulnerability management?

What technology should be used for the verified and secure exchange of public keys between entities Tom0123456789 and Dan9876543210?

How is symmetric encryption used for HTTPS connections?

What is the difference between a vulnerability and an attack surface?

Which two elements are used by the defense-in-depth strategy? (Choose two.)

Which technology assures that the information transferred from point A to point B is unaltered and authentic?

What is a difference between authorization and authentication from an access control perspective?

What is a characteristic of a temporal score in CVSS?

An engineer is working on the implementation of digital certificates for new critical web applications. One of the requirements is that the https connection must be validated and p...

What is the difference between vulnerability and risk?

Which scenario describes a social engineering attack?

What is a difference between antivirus and antimalware security systems?

An employee of a company receives an email with an attachment. They notice that this email is from a suspicious source, and they decide not to open the attached file. After further...

What is the effect of TOR on data visibility?

What is the difference between true positive and false negative?

What is the difference between attack surface and vulnerability?

Which system should be implemented to authenticate and secure the distribution of public keys in a scenario involving users identified as Tom4140299040 and Dan2091400494?

What are two differences and benefits of packet filtering, stateful firewalling, and deep packet inspections? (Choose two.)

Developers must implement tasks on remote Windows environments. They decided to use scripts for enterprise applications through PowerShell. Why does the functionality not work?

What is a vulnerability?

What does this regular expression do? \b(192|172).(168|1[6-9]|2[0-9]|3[0-1]).[0-9]{1,3}.[0-9]{1.3}\b

Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interfa...

At a company party a guest asks questions about the company's user account format and password complexity. How is this type of conversation classified?

Which security monitoring data type requires the largest storage space?

What are two denial of service attacks? (Choose two.)

An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish t...

An engineer must verify vulnerabilities found in the scanning process. The engineer checks the impact of those findings to the organization and compares the results with known thre...

A security engineer must determine why a new core application does not work as desired. The client can send requests toward the application server but receives no response. One of...

Which difficulty occurs when log messages are compared from two devices separated by a Layer 3 device that performs Network Address Translation?

What is the difference between statistical detection and rule-based detection models?

What are indicators of attack?

What is the role of indicators of compromise during the attribution process?

What is the role of indicator of attack in an investigation?

Refer to the exhibit. Which type of data filtering is provided?

An engineer must profile new servers that have been released recently and must identify running web services on nonstandard ports. Why is the probe returning no result?