Best Way To Study For Cisco 200-201 Exam Brilliant 200-201 Exam Questions PDF [Q49-Q64]

Best Way To Study For Cisco 200-201 Exam Brilliant 200-201 Exam Questions PDF

Updated Verified Pass 200-201 Exam – Real Questions and Answers

Cisco 200-201 certification exam covers a wide range of topics, including network security concepts and technologies, threat analysis and intelligence gathering, incident response and management, and compliance and governance. Candidates will be tested on their ability to identify and respond to security threats, analyze network traffic and logs, and implement security policies and procedures.

QUESTION 49
Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

 A policy violation is active for host 10.10.101.24.

 A host on the network is sending a DDoS attack to another inside host.

 There are two active data exfiltration alerts.

 A policy violation is active for host 10.201.3.149.

QUESTION 50
What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

 Untampered images are used in the security investigation process

 Tampered images are used in the security investigation process

 The image is tampered if the stored hash and the computed hash match

 Tampered images are used in the incident recovery process

 The image is untampered if the stored hash and the computed hash match

QUESTION 51
Which type of evidence supports a theory or an assumption that results from initial evidence?

 probabilistic

 indirect

 best

 corroborative

Explanation

QUESTION 52
How does agentless monitoring differ from agent-based monitoring?

 Agentless can access the data via API. while agent-base uses a less efficient method and accesses log data through WMI.

 Agent-based monitoring is less intrusive in gathering log data, while agentless requires open ports to fetch the logs

 Agent-based monitoring has a lower initial cost for deployment, while agentless monitoring requires resource-intensive deployment.

 Agent-based has a possibility to locally filter and transmit only valuable data, while agentless has much higher network utilization

QUESTION 53
Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

 Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.

 Host 152.46.6.91 is being identified as a watchlist country for data transfer.

 Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.

 Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.

QUESTION 54
What is a difference between SIEM and SOAR?

 SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

 SlEM’s primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

 SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

 SOAR’s primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

QUESTION 55
Refer to the exhibit.

Which component is identifiable in this exhibit?

 Trusted Root Certificate store on the local machine

 Windows PowerShell verb

 Windows Registry hive

 local service in the Windows Services Manager

QUESTION 56
Refer to the exhibit.

Which technology generates this log?

 NetFlow

 IDS

 web proxy

 firewall

QUESTION 57

Refer to the exhibit. Which event is occurring?

 A binary named “submit” is running on VM cuckoo1.

 A binary is being submitted to run on VM cuckoo1

 A binary on VM cuckoo1 is being submitted for evaluation

 A URL is being evaluated to see if it has a malicious binary

QUESTION 58
What is a benefit of agent-based protection when compared to agentless protection?

 It lowers maintenance costs

 It provides a centralized platform

 It collects and detects all traffic locally

 It manages numerous devices simultaneously

QUESTION 59
An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist Further analysis shows that the threat actor connected an externa USB device to bypass security restrictions and steal data The engineer could not find an external USB device Which piece of information must an engineer use for attribution in an investigation?

 list of security restrictions and privileges boundaries bypassed

 external USB device

 receptionist and the actions performed

 stolen data and its criticality assessment

QUESTION 60
Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

 A policy violation is active for host 10.10.101.24.

 A host on the network is sending a DDoS attack to another inside host.

 There are three active data exfiltration alerts.

 A policy violation is active for host 10.201.3.149.

QUESTION 61
How does an SSL certificate impact security between the client and the server?

 by enabling an authenticated channel between the client and the server

 by creating an integrated channel between the client and the server

 by enabling an authorized channel between the client and the server

 by creating an encrypted channel between the client and the server

Section: Security Monitoring

QUESTION 62
Which incidence response step includes identifying all hosts affected by an attack’?

 post-incident activity

 detection and analysis

 containment eradication and recovery

 preparation

QUESTION 63
What is a sandbox interprocess communication service?

 A collection of rules within the sandbox that prevent the communication between sandboxes.

 A collection of network services that are activated on an interface, allowing for inter-port communication.

 A collection of interfaces that allow for coordination of activities among processes.

 A collection of host services that allow for communication between sandboxes.

QUESTION 64
What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?

 TAPS interrogation is more complex because traffic mirroring applies additional tags to data and SPAN does not alter integrity and provides full duplex network.

 SPAN results in more efficient traffic analysis, and TAPS is considerably slower due to latency caused by mirroring.

 TAPS replicates the traffic to preserve integrity, and SPAN modifies packets before sending them to other analysis tools

 SPAN ports filter out physical layer errors, making some types of analyses more difficult, and TAPS receives all packets, including physical errors.

 Loading …

Security Procedures & Policies

This is the last topic that consists of 15% of the exam questions. To answer them, the interested individuals need to know how to perform the following tasks:

• Applying the event-handling method to an incident;
• Describing the elements in an event response plan as declared in NIST.SP800-61;
• Mapping the elements for preparation, analysis & detection, eradication, containment, and recovery, as well as post-incident analysis;
• Describing the concepts of evidence collection order, data integrity and preservation, and volatile data collection;
• Identifying the session duration, total throughput, and ports used for the network profiling;

Preparing for the Cisco 200-201 certification exam involves studying and practicing the concepts covered in the exam. Cisco offers a range of resources to help individuals prepare for the exam, including study guides, online courses, and practice exams. With the right preparation, individuals can feel confident in their ability to pass the Cisco 200-201 certification exam and kickstart their career in cybersecurity.

Updated PDF (New 2023) Actual Cisco 200-201 Exam Questions: https://www.actualtorrent.com/200-201-questions-answers.html

Related Links: myportal.utt.edu.tt www.stes.tyc.edu.tw myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt myportal.utt.edu.tt