[Oct 15, 2021] Updates Up to 365 days On Valid 200-201 Braindumps
Best Quality200-201 Exam Questions Cisco Test To Gain Brilliante Result
NEW QUESTION 21
What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)
- A. Tampered images are used in the incident recovery process
- B. Untampered images are used in the security investigation process
- C. The image is tampered if the stored hash and the computed hash match
- D. The image is untampered if the stored hash and the computed hash match
- E. Tampered images are used in the security investigation process
Answer: D,E
Explanation:
Section: Host-Based Analysis
NEW QUESTION 22
Refer to the exhibit.
What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?
- A. disable TCP streams
- B. unfragment TCP
- C. insert TCP subdissectors
- D. extract a file from a packet capture
Answer: B
NEW QUESTION 23
Refer to the exhibit.
Which application protocol is in this PCAP file?
- A. TCP
- B. SSH
- C. TLS
- D. HTTP
Answer: A
NEW QUESTION 24
An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.
Which testing method did the intruder use?
- A. social engineering
- B. eavesdropping
- C. piggybacking
- D. tailgating
Answer: A
NEW QUESTION 25 
Refer to the exhibit. Which event is occurring?
- A. A URL is being evaluated to see if it has a malicious binary
- B. A binary on VM cuckoo1 is being submitted for evaluation
- C. A binary is being submitted to run on VM cuckoo1
- D. A binary named "submit" is running on VM cuckoo1.
Answer: B
NEW QUESTION 26
Refer to the exhibit.
What should be interpreted from this packet capture?
- A. 192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.
- B. 81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.
- C. 192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.
- D. 81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.
Answer: C
NEW QUESTION 27
DRAG DROP
Drag and drop the access control models from the left onto the correct descriptions on the right.
Select and Place:
Answer:
Explanation:
NEW QUESTION 28
An analyst is exploring the functionality of different operating systems.
What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?
- A. has a Common Information Model, which describes installed hardware and software
- B. queries Linux devices that have Microsoft Services for Linux installed
- C. deploys Windows Operating Systems in an automated fashion
- D. is an efficient tool for working with Active Directory
Answer: A
NEW QUESTION 29
Drag and drop the technology on the left onto the data type the technology provides on the right.
Answer:
Explanation:
NEW QUESTION 30
What is the difference between deep packet inspection and stateful inspection?
- A. Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7
- B. Stateful inspection is more secure than deep packet inspection on Layer 7
- C. Deep packet inspection is more secure than stateful inspection on Layer 4
- D. Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4
Answer: D
NEW QUESTION 31
In a SOC environment, what is a vulnerability management metric?
- A. internet exposed devices
- B. code signing enforcement
- C. single factor authentication
- D. full assets scan
Answer: A
NEW QUESTION 32
What is a difference between SIEM and SOAR?
- A. SlEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.
- B. SOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.
- C. SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.
- D. SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.
Answer: B
NEW QUESTION 33
An engineer needs to fetch logs from a proxy server and generate actual events according to the data received.
Which technology should the engineer use to accomplish this task?
- A. Email Security Appliance
- B. Stealthwatch
- C. Firepower
- D. Web Security Appliance
Answer: D
NEW QUESTION 34
Which category relates to improper use or disclosure of PII data?
- A. contractual
- B. regulated
- C. compliance
- D. legal
Answer: B
Explanation:
Section: Security Policies and Procedures
NEW QUESTION 35
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.
Which obfuscation technique is the attacker using?
- A. transport layer security encryption
- B. SHA-256 hashing
- C. Base64 encoding
- D. ROT13 encryption
Answer: A
NEW QUESTION 36
Refer to the exhibit. What does this output indicate?
- A. HTTPS ports are open on the server.
- B. FTP ports are open on the server.
- C. SMB ports are closed on the server.
- D. Email ports are closed on the server.
Answer: A
NEW QUESTION 37
The SOC team has confirmed a potential indicator of compromise on an endpoint. The team has narrowed the executable file's type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling this event?
- A. Perform forensics analysis on the infected endpoint.
- B. Collect public information on the malware behavior.
- C. Isolate the infected endpoint from the network.
- D. Prioritize incident handling based on the impact.
Answer: B
NEW QUESTION 38
......
Focus on 200-201 All-in-One Exam Guide For Quick Preparation: https://www.latestcram.com/200-201-exam-cram-questions.html
Tested Material Used To 200-201: https://drive.google.com/open?id=1fLpmC2nBxwrDz1iWl9NKpNiAQDgMsQkc
