Cisco 200-201 Exam Dumps

Cisco 200-201 Sample Question Answers

Question # 1

What is the function of a command and control server?

A. It enumerates open ports on a network device
B. It drops secondary payload into malware
C. It is used to regain control of the network after a compromise
D. It sends instruction to a compromised system

Show Answer

Question # 2

Which technology on a host is used to isolate a running application from otherapplications?

A. sandbox
B. application allow list
C. application block list
D. host-based firewall

Show Answer

Question # 3

An employee received an email from a colleague’s address asking for the password for thedomain controller. The employee noticed a missing letter within the sender’s address. Whatdoes this incident describe?

A. brute-force attack
B. insider attack
C. shoulder surfing
D. social engineering

Show Answer

Question # 4

During which phase of the forensic process are tools and techniques used to extractinformation from the collected data?

A. investigation
B. examination
C. reporting
D. collection

Show Answer

Question # 5

What should an engineer use to aid the trusted exchange of public keys between usertom0411976943 and dan1968754032?

A. central key management server
B. web of trust
C. trusted certificate authorities
D. registration authority data

Show Answer

Question # 6

Why is HTTPS traffic difficult to screen?

A. HTTPS is used internally and screening traffic (or external parties is hard due toisolation.
B. The communication is encrypted and the data in transit is secured.
C. Digital certificates secure the session, and the data is sent at random intervals.
D. Traffic is tunneled to a specific destination and is inaccessible to others except for thereceiver.

Show Answer

Question # 7

Which tool gives the ability to see session data in real time?

A. tcpdstat
B. trafdump
C. tcptrace
D. trafshow

Show Answer

Question # 8

What are two denial-of-service (DoS) attacks? (Choose two)

A. port scan
B. SYN flood
C. man-in-the-middle
D. phishing
E. teardrop

Show Answer

Question # 9

According to the NIST SP 800-86. which two types of data are considered volatile?(Choose two.)

A. swap files
B. temporary files
C. login sessions
D. dump files
E. free space

Show Answer

Question # 10

What is the difference between discretionary access control (DAC) and role-based accesscontrol (RBAC)?

A. DAC requires explicit authorization for a given user on a given object, and RBACrequires specific conditions.
B. RBAC access is granted when a user meets specific conditions, and in DAC,permissions are applied on user and group levels.
C. RBAC is an extended version of DAC where you can add an extra level of authorizationbased on time.
D. DAC administrators pass privileges to users and groups, and in RBAC, permissions areapplied to specific groups

Show Answer

Question # 11

What is the difference between a threat and an exploit?

A. A threat is a result of utilizing flow in a system, and an exploit is a result of gainingcontrol over the system.
B. A threat is a potential attack on an asset and an exploit takes advantage of thevulnerability of the asset
C. An exploit is an attack vector, and a threat is a potential path the attack must go through.
D. An exploit is an attack path, and a threat represents a potential vulnerability

Show Answer

Question # 12

What describes a buffer overflow attack?

A. injecting new commands into existing buffers
B. fetching data from memory buffer registers
C. overloading a predefined amount of memory
D. suppressing the buffers in a process

Show Answer

Question # 13

An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret fromthe report?

A. The file will appear legitimate by evading signature-based detection.
B. The file will not execute its behavior in a sandbox environment to avoid detection.
C. The file will insert itself into an application and execute when the application is run.
D. The file will monitor user activity and send the information to an outside source.

Show Answer

Question # 14

What is a description of a social engineering attack?

A. fake offer for free music download to trick the user into providing sensitive data
B. package deliberately sent to the wrong receiver to advertise a new product
C. mistakenly received valuable order destined for another person and hidden on purpose
D. email offering last-minute deals on various vacations around the world with a due dateand a counter

Show Answer

Question # 15

Which are two denial-of-service attacks? (Choose two.)

A. TCP connections
B. ping of death
C. man-in-the-middle
D. code-red
E. UDP flooding

Show Answer

Question # 16

What is an incident response plan?

A. an organizational approach to events that could lead to asset loss or disruption ofoperations
B. an organizational approach to security management to ensure a service lifecycle andcontinuous improvements
C. an organizational approach to disaster recovery and timely restoration of operationalservices
D. an organizational approach to system backup and data archiving aligned to regulations

Show Answer

Question # 17

An engineer must compare NIST vs ISO frameworks The engineer deeded to compare asreadable documentation and also to watch a comparison video review. Using Windows 10OS. the engineer started a browser and searched for a NIST document and then opened anew tab in the same browser and searched for an ISO document for comparisonThe engineer tried to watch the video, but there 'was an audio problem with OS so theengineer had to troubleshoot it At first the engineer started CMD and looked fee a driverpath then locked for a corresponding registry in the registry editor The engineer enabled"Audiosrv" in task manager and put it on auto start and the problem was solved Which twocomponents of the OS did the engineer touch? (Choose two)

A. permissions
B. PowerShell logs
C. service
D. MBR
E. process and thread

Show Answer

Question # 18

What is the difference between indicator of attack (loA) and indicators of compromise (loC)?

A. loA is the evidence that a security breach has occurred, and loC allows organizations toact before the vulnerability can be exploited.
B. loA refers to the individual responsible for the security breach, and loC refers to theresulting loss.
C. loC is the evidence that a security breach has occurred, and loA allows organizations toact before the vulnerability can be exploited.
D. loC refers to the individual responsible for the security breach, and loA refers to theresulting loss.

Show Answer

Question # 19

Which security model assumes an attacker within and outside of the network and enforcesstrict verification before connecting to any system or resource within the organization?

A. Biba
B. Object-capability
C. Take-Grant
D. Zero Trust

Show Answer

Question # 20

How does a certificate authority impact security?

A. It validates client identity when communicating with the server.
B. It authenticates client identity when requesting an SSL certificate.
C. It authenticates domain identity when requesting an SSL certificate.
D. It validates the domain identity of the SSL certificate.

Show Answer

Question # 21

What is vulnerability management?

A. A security practice focused on clarifying and narrowing intrusion points.
B. A security practice of performing actions rather than acknowledging the threats.
C. A process to identify and remediate existing weaknesses.
D. A process to recover from service interruptions and restore business-critical applications

Show Answer

Question # 22

What is the difference between the ACK flag and the RST flag?

A. True positives affect security as no alarm is raised when an attack has taken place,resulting in a potential breach.
B. True positive alerts are blocked by mistake as potential attacks affecting applicationavailability.
C. False positives affect security as no alarm is raised when an attack has taken place,resulting in a potential breach.
D. False positive alerts are blocked by mistake as potential attacks affecting applicationavailability.

Show Answer

Question # 23

What is the difference between the ACK flag and the RST flag?

A. The RST flag approves the connection, and the ACK flag terminates spontaneousconnections.
B. The ACK flag confirms the received segment, and the RST flag terminates theconnection.
C. The RST flag approves the connection, and the ACK flag indicates that a packet needsto be resent
D. The ACK flag marks the connection as reliable, and the RST flag indicates the failurewithin TCP Handshake

Show Answer

Question # 24

What is a difference between SIEM and SOAR?

A. SOAR predicts and prevents security alerts, while SIEM checks attack patterns andapplies the mitigation.
B. SlEM's primary function is to collect and detect anomalies, while SOAR is more focusedon security operations automation and response.
C. SIEM predicts and prevents security alerts, while SOAR checks attack patterns andapplies the mitigation.
D. SOAR's primary function is to collect and detect anomalies, while SIEM is more focusedon security operations automation and response.

Show Answer

Question # 25

A user received a targeted spear-phishing email and identified it as suspicious beforeopening the content. To which category of the Cyber Kill Chain model does to this type ofevent belong?

A. weaponization
B. delivery
C. exploitation
D. reconnaissance

Show Answer

Question # 26

Which type of access control depends on the job function of the user? 

A. discretionary access control
B. nondiscretionary access control
C. role-based access control
D. rule-based access control

Show Answer

Question # 27

What is a difference between data obtained from Tap and SPAN ports?

A. Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.
B. SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times. 
C. SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility. 
D. Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination 

Show Answer

Question # 28

An automotive company provides new types of engines and special brakes for rally sports cars. The company has a database of inventions and patents for their engines and technical information Customers can access the database through the company's website after they register and identify themselves. Which type of protected data is accessed by customers? 

A. IP data
B. PII data
C. PSI data
D. PHI data

Show Answer

Question # 29

Which attack represents the evasion technique of resource exhaustion?

A. SQL injection
B. man-in-the-middle
C. bluesnarfing
D. denial-of-service

Show Answer

Question # 30

Which regular expression is needed to capture the IP address 192.168.20.232? 

A. ^ (?:[0-9]{1,3}\.){3}[0-9]{1,3}
B. ^ (?:[0-9]f1,3}\.){1,4}
C. ^ (?:[0-9]{1,3}\.)'
D. ^ ([0-9]-{3}) 

Show Answer

Question # 31

Which event is a vishing attack? 

A. obtaining disposed documents from an organization
B. using a vulnerability scanner on a corporate network
C. setting up a rogue access point near a public hotspot
D. impersonating a tech support agent during a phone call 

Show Answer

Question # 32

What describes the impact of false-positive alerts compared to false-negative alerts? 

A. A false negative is alerting for an XSS attack. An engineer investigates the alert anddiscovers that an XSS attack happened A false positive is when an XSS attack happensand no alert is raised
B. A false negative is a legitimate attack triggering a brute-force alert. An engineerinvestigates the alert and finds out someone intended to break into the system A falsepositive is when no alert and no attack is occurring
C. A false positive is an event alerting for a brute-force attack An engineer investigates thealert and discovers that a legitimate user entered the wrong credential several times A falsenegative is when a threat actor tries to brute-force attack a system and no alert is raised.
D. A false positive is an event alerting for an SQL injection attack An engineer investigatesthe alert and discovers that an attack attempt was blocked by IPS A false negative is whenthe attack gets detected but succeeds and results in a breach.

Show Answer

Question # 33

What ate two denial-of-service (DoS) attacks? (Choose two) 

A. port scan
B. SYN flood
C. man-in-the-middle
D. phishing
E. teardrop

Show Answer