Cisco Understanding Cisco Cybersecurity Operations Fundamentals

QUESTION NO: 1
What is data encapsulation?

A. Multiple hosts can be supported with only a few public IP addresses. B. A protocol of the sending host adds additional data to the packet header. C. Browsing history is erased automatically with every session. D. Data is encrypted backwards, which makes it unusable.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
While analyzing the process of a recent breach case, a forensic investigator determined that an external USB drive was connected to the laptop of the HR manager and personal data of employees was exfiltrated to an external source. Video surveillance showed a stranger giving this USB drive to an HR manager during a job interview. How must this type of evidence be categorized?

A. corroborative evidence B. direct evidence C. indirect evidence D. best evidence

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
What are two differences and benefits of packet filtering, stateful firewalling, and deep packet inspections? (Choose two.)

A. Deep packet inspection operates up to Layer 7, and packet filtering operates on Layer 3 and 4 of OSI model. B. Stateful inspection is capable of packet data inspections, and deep packet inspection is not. C. Packet filtering is capable of UDP state monitoring only, and stateful inspection can provide monitoring of TCP sessions. D. Deep packet inspection is capable of malware blocking, and packet filtering is not. E. Stateful inspection is capable of TCP state tracking, and deep packet inspection checks only TCP source and destination ports.

Correct Answer: D,E

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

A. Tampered images are used in the security investigation process B. The image is untampered if the stored hash and the computed hash match C. Untampered images are used in the security investigation process D. Tampered images are used in the incident recovery process E. The image is tampered if the stored hash and the computed hash match

Correct Answer: B,C

QUESTION NO: 5
Refer to the exhibit. An engineer received a ticket about a slowed-down web application. The engineer runs the #netstat - an command. How must the engineer interpret the results?

A. The engineer must gather more data. B. The web application server is under a denial-of-service attack. C. The web application is receiving a common, legitimate traffic D. The server is under a man-in-the-middle attack between the web application and its database

Correct Answer: B

QUESTION NO: 6
A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.
Which type of evidence is this?

A. prima facie evidence B. indirect evidence C. best evidence D. physical evidence

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Drag and Drop Question
Drag and drop the event term from the left onto the description on the right.

Correct Answer:

Explanation:
https://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/13876-f-pos.html

QUESTION NO: 8
Refer to the exhibit. What is shown in this PCAP file?

A. The HTTP GET is encoded. B. Timestamps are indicated with error. C. The User-Agent is Mozilla/5.0. D. The protocol is TCP.

Correct Answer: A

QUESTION NO: 9
Which access control model does SELinux use?

A. ABAC B. RBAC C. DAC D. MAC

Correct Answer: D

QUESTION NO: 10
What are the three critical security principles or goals of the CIA triad?

A. Ensure that the connections are safe and the data delivery is improved continuously with appropriate monitoring and cross-checks. B. Validate the copyright of the data, and ensure that individual data owners are protected with a defense-in-depth approach. C. Protect the confidentiality of data, and ensure that protected data is unaltered at all stages and available for permitted requesters. D. Implement data tags to identify critical assets and data for preserving the secretness, and develop policies and procedures for accessing data.

Correct Answer: C

QUESTION NO: 11
Refer to the exhibit. What is occurring?

A. possible DNS cache poisoning with misdirects toward a fraudulent website B. possible DNS tunneling with encrypted communication through CNAMEs C. possible botnet traffic with random MX querying to generate increased traffic D. possible DNS amplification attack with requests that maximize data quantity

Correct Answer: B

QUESTION NO: 12
Which term represents a potential danger that could take advantage of a weakness in a system?

A. threat B. exploit C. vulnerability D. risk

Correct Answer: A

QUESTION NO: 13
For which items is an end-point application greylist used?

A. items that have been established as authorized B. items before being established as harmful or malicious C. items that have been installed with a baseline D. items that have been established as malicious

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Cisco Understanding Cisco Cybersecurity Operations Fundamentals - 200-201 Exam Questions