Updated Free Cisco 200-201 Test Engine Questions with 478 Q&As
The Best CyberOps Associate 200-201 Professional Exam Questions
NEW QUESTION # 231
Which incidence response step includes identifying all hosts affected by an attack?
- A. post-incident activity
- B. containment, eradication, and recovery
- C. detection and analysis
- D. preparation
Answer: C
Explanation:
The 'detection and analysis' phase of incident response includes identifying all hosts affected by an attack. This step involves analyzing the scope of the incident, determining which systems and data are impacted, and understanding the nature of the attack to inform subsequent containment and eradication efforts45.
Reference:
CrowdStrike's overview of incident response frameworks and steps4.
VCEGuide's explanation of incident response steps
NEW QUESTION # 232 
Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?
- A. disable TCP streams
- B. insert TCP subdissectors
- C. unfragment TCP
- D. extract a file from a packet capture
Answer: C
NEW QUESTION # 233
Which tool provides a full packet capture from network traffic?
- A. Hydra
- B. Wireshark
- C. CAINE
- D. Nagios
Answer: B
Explanation:
Wireshark is a widely-used network protocol analyzer that allows users to capture and interactively browse the traffic running on a computer network. It provides full packet capture capabilities, enabling detailed analysis of network traffic. Reference:: This is supported by the CBROPS course materials, which discuss security monitoring and the analysis of network traffic, including full packet capture tools like Wireshark
NEW QUESTION # 234
What is the communication channel established from a compromised machine back to the attacker?
- A. IDS evasion
- B. man-in-the-middle
- C. port scanning
- D. command and control
Answer: D
NEW QUESTION # 235
Refer to the exhibit.
Which type of log is displayed?
- A. NetFlow
- B. sys
- C. proxy
- D. IDS
Answer: A
NEW QUESTION # 236
According to the September 2020 threat intelligence feeds a new malware called Egregor was introduced and used in many attacks. Distnbution of Egregor is pnmanly through a Cobalt Strike that has been installed on victim's workstations using RDP exploits Malware exfiltrates the victim's data to a command and control server. The data is used to force victims pay or lose it by publicly releasing it. Which type of attack is described?
- A. malware attack
- B. insider threat
- C. ransomware attack
- D. whale-phishing
Answer: C
Explanation:
Ransomware is a type of malware that encrypts the victim's data and demands a ransom for the decryption key. The attacker may also threaten to publish or delete the data if the ransom is not paid. In this case, the Egregor malware is distributed through a Cobalt Strike, which is a penetration testing tool that can be used to deploy payloads on compromised systems. The malware exfiltrates the victim's data to a command and control server and uses it as leverage to extort money from the victim. References := Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.3: Common Network Application Operations and Attacks, Topic 1.3.3: Malware Attacks
NEW QUESTION # 237
What is obtained using NetFlow?
- A. session data
- B. network downtime report
- C. full packet capture
- D. application logs
Answer: A
Explanation:
NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network flow. It provides valuable data about the network sessions occurring within the network, such as source and destination IP addresses, port numbers, and protocols used. This session data is useful for understanding traffic patterns, volume, and usage.
References: Cisco's training and certification materials on NetFlow would discuss how it is used to obtain session data for network analysis.
NEW QUESTION # 238
Which data type is necessary to get information about source/destination ports?
- A. alert data
- B. session data
- C. connectivity data
- D. statistical data
Answer: B
Explanation:
Session data is the data type that is necessary to get information about source/destination ports. Session data is the information about connections between hosts, such as IP addresses, ports, protocols, and duration. Session data can be used to identify the services and applications that are being used on the network, as well as the direction and volume of the traffic. Session data can also help to detect anomalous or malicious behavior, such as port scanning, brute force attacks, or data exfiltration. Session data can be collected from various sources, such as firewalls, routers, switches, or network monitoring tools. References:
* Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 2: Security Monitoring, Lesson 2.2: Data Sources, Topic 2.2.2: Session Data (https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operatio
* Cisco Certified CyberOps Associate Certification Guide, Chapter 3: Data Sources, Section 3.2: Session Data (https://www.ciscopress.com/store/cisco-certified-cyberops-associate-certification-guide-9780136807834)
NEW QUESTION # 239
Refer to the exhibit.
What is the potential threat identified in this Stealthwatch dashboard?
- A. There are three active data exfiltration alerts.
- B. A host on the network is sending a DDoS attack to another inside host.
- C. A policy violation is active for host 10.10.101.24.
- D. A policy violation is active for host 10.201.3.149.
Answer: A
Explanation:
Explanation
"EX" = exfiltration
And there are three.
Also the "suspect long flow" and "suspect data heading" suggest, for example, DNS exfiltration
https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/management_console/smc_users_guide/SW_6 page 177.
NEW QUESTION # 240 
Refer to the exhibit. This request was sent to a web application server driven by a database.
Which type of web server attack is represented?
- A. parameter manipulation
- B. command injection
- C. heap memory corruption
- D. blind SQL injection
Answer: D
Explanation:
Section: Host-Based Analysis
NEW QUESTION # 241
Endpoint logs indicate that a machine has obtained an unusual gateway address and unusual DNS servers via DHCP Which type of attack is occurring?
- A. phishing
- B. evasion methods
- C. command injection
- D. man in the middle attack
Answer: D
Explanation:
The situation where endpoint logs show a machine receiving an unusual gateway address and DNS servers via DHCP is indicative of a Man-in-the-Middle (MitM) attack, specificallya DHCP spoofing attack. In this type of attack, an adversary can set up a rogue DHCP server or manipulate the DHCP communication to provide false gateway and DNS information to clients. This allows the attacker to intercept, monitor, or manipulate traffic between the client and the intended gateway or DNS servers2.
Cisco's best practices for network protections and attack identification3, and additional insights on securing networks from DHCP attacks
NEW QUESTION # 242
Refer to the exhibit.
Refer to the exhibit A penetration tester runs the Nmap scan against the company server to uncover possible vulnerabilities and exploit them Which two elements can the penetration tester identity from the scan results? (Choose two.)
- A. UIDs and group identifiers
- B. number of concurrent connections the server can handle
- C. running services and applications
- D. server purpose and functionality
- E. server uptime and internal clock
Answer: C,D
NEW QUESTION # 243
Which regular expression is needed to capture the IP address 192.168.20.232?
- A. ^ ([0-9]-{3})
- B. ^ (?:[0-9]{1,3}\.){3}[0-9]{1,3}
- C. ^ (?:[0-9]f1,3}\.){1,4}
- D. ^ (?:[0-9]{1,3}\.)'
Answer: B
Explanation:
The regular expression ^ (?:[0-9]{1,3}.){3}[0-9]{1,3} is needed to capture the IP address 192.168.20.232.
This regex matches any string that starts with three groups of one to three digits followed by a dot, and ends with one group of one to three digits. The IP address 192.168.20.232 matches this pattern exactly. The other options are either invalid or do not match the IP address format. References := Cisco Cybersecurity Operations Fundamentals, Module 5: Security Policies and Procedures, Lesson 5.3: Data and Event Analysis, Topic 5.3.2:
Regular Expressions
NEW QUESTION # 244
An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?
- A. The computer has a HIPS installed on it.
- B. The computer has a NIPS installed on it.
- C. The computer has a HIDS installed on it.
- D. The computer has a NIDS installed on it.
Answer: C
Explanation:
Section: Host-Based Analysis
NEW QUESTION # 245
Refer to the exhibit.
Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.
Answer:
Explanation:
NEW QUESTION # 246
Drag and drop the elements from the left into the correct order for incident handling on the right.
Answer:
Explanation:
NEW QUESTION # 247
Drag and drop the data source from the left onto the data type on the right.
Answer:
Explanation:
NEW QUESTION # 248
A user received a targeted spear-phishing email and identified it as suspicious before opening the content. To which category of the Cyber Kill Chain model does to this type of event belong?
- A. reconnaissance
- B. weaponization
- C. exploitation
- D. delivery
Answer: D
Explanation:
The delivery phase of the Cyber Kill Chain model involves the transmission of the weapon to the targeted environment. In the case of a spear-phishing email, the delivery is the act of sending the email to the user. The email itself is the weapon, designed to exploit the recipient's trust to cause a breach
NEW QUESTION # 249
Which category relates to improper use or disclosure of PII data?
- A. compliance
- B. legal
- C. regulated
- D. contractual
Answer: C
Explanation:
Section: Security Policies and Procedures
NEW QUESTION # 250 
Refer to the exhibit. What is occurring?
- A. ARP poisoning
- B. DNS amplification attack
- C. Denial of service
- D. Brute force attack
Answer: B
NEW QUESTION # 251
What is a sandbox interprocess communication service?
- A. A collection of network services that are activated on an interface, allowing for inter-port communication.
- B. A collection of host services that allow for communication between sandboxes.
- C. A collection of rules within the sandbox that prevent the communication between sandboxes.
- D. A collection of interfaces that allow for coordination of activities among processes.
Answer: D
Explanation:
Explanation
Inter-process communication (IPC) allows communication between different processes. A process is one or more threads running inside its own, isolated address space. https://docs.legato.io/16_10/basicIPC.html
NEW QUESTION # 252
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?
- A. Base64 encoding
- B. ROT13 encryption
- C. SHA-256 hashing
- D. TLS encryption
Answer: D
NEW QUESTION # 253
Which type of evidence supports a theory or an assumption that results from initial evidence?
- A. best
- B. probabilistic
- C. indirect
- D. corroborative
Answer: D
Explanation:
Corroborative evidence is the type of evidence that supports a theory or an assumption that results from initial evidence. It provides additional support to the initial findings, strengthening the theory or assumption by confirming the same facts or pointing towards the same conclusion with independent pieces of evidence4567.
NEW QUESTION # 254
Refer to exhibit.
An analyst performs the analysis of the pcap file to detect the suspicious activity. What challenges did the analyst face in terms of data visibility?
- A. data encryption
- B. code obfuscation
- C. data encapsulation
- D. IP fragmentation
Answer: A
Explanation:
When analyzing a pcap file, data encryption can pose a significant challenge in terms of visibility. Encrypted data cannot be easily inspected, which means that the analyst may not be able to view the contents of the network packets to detect suspicious activity.
References: The answers are based on the general knowledge of host-based firewalls and the challenges faced during the analysis of pcap files in cybersecurity, as outlined in Cisco's cybersecurity documentation and resources.
NEW QUESTION # 255
A company recently encountered a breach. Critical services went through a disturbance and the integrity of the data was altered. An engineer is investigating the issue and searching through the logs in the SIEM.
Which phase of the incident response is an engineer working on?
- A. recovery and restoration
- B. containment and eradication
- C. post-incident and lessons learned
- D. detection and analysis
Answer: D
NEW QUESTION # 256
......
To fully prepare for the Cisco 200-201 exam, candidates should have a strong understanding of networking concepts and protocols, as well as basic knowledge of cybersecurity principles. It's also recommended to have hands-on experience with the tools and technologies used in network security operations. Passing 200-201 exam can lead to a variety of job opportunities in the cybersecurity field, including roles such as network security analyst, security operations center (SOC) analyst, and incident response analyst.
Try 100% Updated 200-201 Exam Questions [2026]: https://actualtests.prep4away.com/Cisco-certification/braindumps.200-201.ete.file.html