200-201 Free Certification Exam Material from TorrentExam with 379 Questions
Use Real 200-201 - 100% Cover Real Exam Questions
Cisco 200-201 exam is a multiple-choice exam that consists of 95-105 questions. 200-201 exam is timed, and candidates have 120 minutes to complete it. 200-201 exam is administered by Pearson VUE and can be taken at one of their testing centers or online. To pass the exam, candidates must score at least 750 out of 1000.
NEW QUESTION # 65
An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?
- A. nmap -sV 192.168.1.0/24
- B. nmap --top-ports 192.168.1.0/24
- C. nmap -sP 192.168.1.0/24
- D. nmap -sL 192.168.1.0/24
Answer: C
Explanation:
Explanation
https://explainshell.com/explain?cmd=nmap+-sP
NEW QUESTION # 66
Refer to the exhibit.
What is occurring in this network?
- A. ARP cache poisoning
- B. DNS cache poisoning
- C. MAC address table overflow
- D. MAC flooding attack
Answer: D
Explanation:
The exhibit shows a network diagram with a switch, a router, and two hosts. The switch has a MAC address table that maps the MAC addresses of the connected devices to the corresponding ports. A MAC flooding attack is a type of attack that aims to overload the switch's MAC address table by sending a large number of frames with spoofed source MAC addresses. This causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, effectively turning it into a hub. This allows the attacker to sniff the traffic between the hosts and the router, or launch other attacks such as ARP spoofing or man-in-the-middle
NEW QUESTION # 67
Which attack method intercepts traffic on a switched network?
- A. denial of service
- B. ARP cache poisoning
- C. DHCP snooping
- D. command and control
Answer: C
NEW QUESTION # 68
What is the difference between a threat and a risk?
- A. Threat represents a potential danger that could take advantage of a weakness in a system
- B. Threat represents a state of being exposed to an attack or a compromise either physically or logically
- C. Risk represents the nonintentional interaction with uncertainty in the system
- D. Risk represents the known and identified loss or danger in the system
Answer: A
NEW QUESTION # 69
Which two protocols are used for DDoS amplification attacks? (Choose two.)
- A. DNS
- B. NTP
- C. HTTP
- D. TCP
- E. ICMPv6
Answer: A,B
NEW QUESTION # 70
What are two differences between tampered disk images and untampered disk images'? (Choose two.)
- A. Tampered images are used as an element for the root cause analysis report
- B. Tampered Images are used in a security investigation process
- C. The image is tampered if the stored hash and the computed hash are identical
- D. The image is untampered if the existing stored hash matches the computed one
- E. Untampered images can be used as law enforcement evidence.
Answer: A,D
Explanation:
An untampered disk image is one that has not been altered since its creation. This is verified by comparing the stored hash of the image at the time of creation with a newly computed hash; if they match, the image is considered untampered. Tampered images, on the other hand, may be used during the root cause analysis process to understand how and what was altered12. Reference:: The differences between tampered and untampered disk images are discussed in cybersecurity literature, including Cisco's certification guides, which explain the importance of hash matching for verifying the integrity of disk images
NEW QUESTION # 71
Refer to the exhibit.
What is occurring?
- A. ARP flood
- B. ARP poisoning
- C. DNS amplification
- D. DNS tunneling
Answer: D
NEW QUESTION # 72
Refer to the exhibit.
What does the output indicate about the server with the IP address 172.18.104.139?
- A. open ports of an email server
- B. open port of an FTP server
- C. open ports of a web server
- D. running processes of the server
Answer: A
NEW QUESTION # 73
Refer to the exhibit.
An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?
- A. The file has an embedded executable and was matched by PEiD threat signatures for further analysis.
- B. The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.
- C. The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.
- D. The file has an embedded non-Windows executable but no suspicious features are identified.
Answer: B
NEW QUESTION # 74
What are two social engineering techniques? (Choose two.)
- A. phishing
- B. pharming
- C. privilege escalation
- D. DDoS attack
- E. man-in-the-middle
Answer: A,B
Explanation:
Social engineering techniques often involve manipulating individuals into divulging confidential information or performing actions that compromise security. Phishing involves sending fraudulent messages (often emails) that appear to be from reputable sources with the goal of stealing sensitive data or installing malware. Pharming redirects the traffic of a legitimate website to another fraudulent website without the user's knowledge, aiming to collect the user's credentials. Reference:= Cisco Cybersecurity Source Documents
NEW QUESTION # 75
An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?
- A. nmap -sV 192.168.1.0/24
- B. nmap --top-ports 192.168.1.0/24
- C. nmap -sP 192.168.1.0/24
- D. nmap -sL 192.168.1.0/24
Answer: C
Explanation:
https://explainshell.com/explain?cmd=nmap+-sP
NEW QUESTION # 76
Refer to the exhibit.
What does the message indicate?
- A. a successful access attempt was made to retrieve the password file
- B. a successful access attempt was made to retrieve the root of the website
- C. an access attempt was made from the Mosaic web browser
- D. a denied access attempt was made to retrieve the password file
Answer: B
NEW QUESTION # 77
Which technology prevents end-device to end-device IP traceability?
- A. NAT/PAT
- B. load balancing
- C. encryption
- D. tunneling
Answer: A
NEW QUESTION # 78
An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications. Which technology should be used to accomplish the task?
- A. static IP addresses
- B. cipher suite
- C. signatures
- D. digital certificates
Answer: D
Explanation:
Digital certificates are electronic documents that use public key cryptography to verify the identity and authenticity of the sender and the receiver of encrypted communications. Digital certificates are issued and signed by trusted entities called certificate authorities (CAs), and they contain information such as the public key, the name, and the expiration date of the certificate. Digital certificates enable network security devices to decrypt perimeter traffic and inspect it for command and control communications or other malicious activity.
References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 51.
NEW QUESTION # 79
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.
Answer:
Explanation:
Explanation:
Delivery: This step involves transmitting the weapon to the target.
Weaponization: In this step, the intruder creates a malware weapon like a virus, worm or such in order to exploit the vulnerabilities of the target. Depending on the target and the purpose of the attacker, this malware can exploit new, undetected vulnerabilities (also known as the zero-day exploits) or it can focus on a combination of different vulnerabilities.
Reconnaissance: In this step, the attacker / intruder chooses their target. Then they conduct an in-depth research on this target to identify its vulnerabilities that can be exploited.
NEW QUESTION # 80
......
Cisco 200-201 exam is a vendor-specific exam that is focused on Cisco's cybersecurity operations fundamentals. 200-201 exam covers a wide range of topics, including network security concepts, network security technologies, security monitoring, and threat analysis. 200-201 exam is intended for individuals who are looking to gain a basic understanding of cybersecurity operations in a Cisco environment.
Dumps Brief Outline Of The 200-201 Exam: https://www.torrentexam.com/200-201-exam-latest-torrent.html
200-201 Training & Certification Get Latest CyberOps Associate: https://drive.google.com/open?id=12PFkhuLNfIb-2sZos6GU7omcwkvMgJoj
