Pass 200-201 Brain Dump Updated Certification Sample Questions [Q46-Q62]

4.3/5 - (6 votes)

Pass 200-201 Brain Dump Updated Certification Sample Questions

Online 200-201 Test Brain Dump Question and Test Engine

NEW QUESTION 46
An analyst received an alert on their desktop computer showing that an attack was successful on the host.
After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

The computer has a HIPS installed on it.

The computer has a NIPS installed on it.

The computer has a HIDS installed on it.

The computer has a NIDS installed on it.

NEW QUESTION 47
Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

UDP port to which the traffic is destined

TCP port from which the traffic was sourced

source IP address of the packet

destination IP address of the packet

UDP port from which the traffic is sourced

NEW QUESTION 48
Refer to the exhibit.

What is depicted in the exhibit?

Windows Event logs

Apache logs

IIS logs

UNIX-based syslog

NEW QUESTION 49
Drag and drop the uses on the left onto the type of security system on the right.

NEW QUESTION 50
At a company party a guest asks question:s about the company’s user account format and password complexity. How is this type of conversation classified?

Phishing attack

Password Revelation Strategy

Piggybacking

Social Engineering

NEW QUESTION 51
An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications. Which technology should be used to accomplish the task?

digital certificates

static IP addresses

signatures

cipher suite

NEW QUESTION 52
Refer to the exhibit.

Which type of log is displayed?

IDS

proxy

NetFlow

sys

NEW QUESTION 53
What causes events on a Windows system to show Event Code 4625 in the log messages?

The system detected an XSS attack

Someone is trying a brute force attack on the network

Another device is gaining root access to the system

A privileged user successfully logged into the system

NEW QUESTION 54
Which process is used when IPS events are removed to improve data integrity?

data availability

data normalization

data signature

data protection

NEW QUESTION 55
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication.

Which obfuscation technique is the attacker using?

Base64 encoding

transport layer security encryption

SHA-256 hashing

ROT13 encryption

NEW QUESTION 56
An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.
What is the initial event called in the NIST SP800-61?

online assault

precursor

trigger

instigator

Explanation
A precursor is a sign that a cyber-attack is about to occur on a system or network. An indicator is the actual alerts that are generated as an attack is happening. Therefore, as a security professional, it’s important to know where you can find both precursor and indicator sources of information.
The following are common sources of precursor and indicator information:
* Security Information and Event Management (SIEM)
* Anti-virus and anti-spam software
* File integrity checking applications/software
* Logs from various sources (operating systems, devices, and applications)
* People who report a security incident
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

NEW QUESTION 57
What are the two differences between stateful and deep packet inspection? (Choose two )

Stateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports

Deep packet inspection is capable of malware blocking, and stateful inspection is not

Deep packet inspection operates on Layer 3 and 4. and stateful inspection operates on Layer 3 of the OSI model

Deep packet inspection is capable of TCP state monitoring only, and stateful inspection can inspect TCP and UDP.

Stateful inspection is capable of packet data inspections, and deep packet inspection is not

NEW QUESTION 58
Refer to the exhibit.

What does the output indicate about the server with the IP address 172.18.104.139?

open ports of a web server

open port of an FTP server

open ports of an email server

running processes of the server

NEW QUESTION 59

Refer to the exhibit. Which two elements in the table are parts of the 5-tuple? (Choose two.)

First Packet

Initiator User

Ingress Security Zone

Source Port

Initiator IP

NEW QUESTION 60
A developer is working on a project using a Linux tool that enables writing processes to obtain these required results:
* If the process is unsuccessful, a negative value is returned.
* If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process.
Which component results from this operation?

parent directory name of a file pathname

process spawn scheduled

macros for managing CPU sets

new process created by parent process

Explanation
There are two tasks with specially distinguished process IDs: swapper or sched has process ID 0 and is responsible for paging, and is actually part of the kernel rather than a normal user-mode process. Process ID 1 is usually the init process primarily responsible for starting and shutting down the system. Originally, process ID 1 was not specifically reserved for init by any technical measures: it simply had this ID as a natural consequence of being the first process invoked by the kernel. More recent Unix systems typically have additional kernel components visible as ‘processes’, in which case PID 1 is actively reserved for the init process to maintain consistency with older systems

NEW QUESTION 61
An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist Further analysis shows that the threat actor connected an externa USB device to bypass security restrictions and steal data The engineer could not find an external USB device Which piece of information must an engineer use for attribution in an investigation?

list of security restrictions and privileges boundaries bypassed

external USB device

receptionist and the actions performed

stolen data and its criticality assessment

NEW QUESTION 62
Which two components reduce the attack surface on an endpoint? (Choose two.)

secure boot

load balancing

increased audit log levels

restricting USB ports

full packet captures at the endpoint

Loading …