[CISCO] CISCO - 200-201 Exam Dumps & Study Guide

Free [CISCO] CISCO - 200-201 Practice Questions Preview

• Question 1

  Which event is user interaction?
  

  • A. gaining root access
  • B. executing remote code
  • C. reading and writing file permission
  • D. opening a malicious file

  Correct Answer: D

  Explanation:

  I agree with the suggested answer of D. Opening a malicious file constitutes user interaction because it requires a user to actively initiate the action of opening the file, which then triggers the execution of potentially harmful code.
  
  Reasoning: User interaction implies a direct action performed by a user. Opening a file, especially a malicious one, is a direct user action. This action can then lead to consequences like code execution, but the initial trigger is the user's interaction.
  
  Reasons for not choosing other options:

  • A. Gaining root access: While it can involve user interaction, it is not inherently a direct form of user interaction. It often involves exploiting vulnerabilities or using elevated privileges, which may not always be initiated directly by the user.
  • B. Executing remote code: This is a consequence, not necessarily a user interaction. Remote code execution can happen without direct user involvement.
  • C. Reading and writing file permission: This refers to the system's access control mechanisms and doesn't necessarily involve a direct user action. It defines what users *can* do, not what they are actively doing.

  The key aspect is that opening a malicious file requires a deliberate action by the user, making it the most appropriate answer representing user interaction.

• Question 2

  Which security principle requires more than one person is required to perform a critical task?
  

  • A. least privilege
  • B. need to know
  • C. separation of duties
  • D. due diligence

  Correct Answer: C

  Explanation:

  I agree with the suggested answer.
  The correct answer is C. separation of duties.
  Reason: Separation of duties is a security principle that dictates that critical tasks should be divided among multiple individuals. This prevents any single person from having excessive control or the ability to compromise the system. This aligns directly with the question's requirement of more than one person performing a critical task.
  Reasons for Incorrect Answers:

  • A. Least privilege: This principle focuses on granting users only the minimum level of access necessary to perform their job functions. It doesn't necessarily involve multiple people for a single task.
  • B. Need to know: Similar to least privilege, this principle restricts access to information based on whether it's required for an individual's responsibilities. It doesn't inherently require multiple individuals to perform tasks.
  • D. Due diligence: This involves taking reasonable steps to protect assets and prevent harm, but it does not specifically mandate multiple people for critical tasks.

• Question 3

  How is attacking a vulnerability categorized?
  

  • A. action on objectives
  • B. delivery
  • C. exploitation
  • D. installation

  Correct Answer: C

  Explanation:

  The recommended answer is C. exploitation.
  Reasoning: Attacking a vulnerability directly aligns with the 'Exploitation' phase in frameworks like the Cyber Kill Chain. Exploitation is the stage where an attacker leverages a discovered vulnerability to gain unauthorized access or cause harm.
  Why other options are incorrect:

  • A. Action on objectives: This occurs after successful exploitation, when the attacker is actively pursuing their goals within the compromised system or network.
  • B. Delivery: This is the stage where the malicious payload (e.g., malware) is transmitted to the target.
  • D. Installation: This refers to the process of installing malicious code or tools on the compromised system, which typically follows exploitation.

  Citations:

  • Cyber Kill Chain, https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

• Question 4

  What is a benefit of agent-based protection when compared to agentless protection?
  

  • A. It lowers maintenance costs
  • B. It provides a centralized platform
  • C. It collects and detects all traffic locally
  • D. It manages numerous devices simultaneously

  Correct Answer: C

  Explanation:

  The suggested answer is C.
  Reasoning: Agent-based protection involves installing software directly on the endpoint. This allows for local traffic inspection and detection, ensuring comprehensive monitoring of all activity on that specific device. This is a key advantage because it allows the agent to see all traffic, even if it doesn't traverse the network.
  Reasons for not choosing other options:

  • A: While agent-based solutions might offer long-term benefits, the initial maintenance can be higher due to installation and management of agents on each endpoint. Agentless solutions often claim to lower maintenance initially.
  • B: Centralized platforms can be a feature of both agent-based and agentless solutions. Agentless solutions often rely on a central management console to coordinate scans and policies.
  • D: Both agent-based and agentless solutions can manage numerous devices simultaneously through centralized management systems. This isn't a differentiator.

  The primary benefit of agent-based protection compared to agentless is its ability to collect and analyze all traffic directly on the endpoint, providing more granular and comprehensive security coverage.

• Question 5

  Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?
  

  • A. decision making
  • B. rapid response
  • C. data mining
  • D. due diligence

  Correct Answer: D

  Explanation:

  Based on the analysis, I disagree with the suggested answer of D (due diligence). The more appropriate answer is A (decision making).
  
  Reasoning: The scenario describes an analyst gathering information to determine the appropriate course of action for a security incident. This directly aligns with the principle of decision making, where information is collected and analyzed to make an informed choice. The analyst is actively using data to decide on the best response.
  
  Why other options are incorrect:

  • B (rapid response): While rapid response is important in security incidents, it usually follows the decision-making process. Gathering information to determine the correct action precedes the rapid deployment of that action. Rapid response is about *how quickly* you act, not *what* action you take.
  • C (data mining): Data mining is the process of discovering patterns in large datasets. While data mining techniques might *inform* decision making, the question specifically asks about the principle being followed when *gathering information to determine an action*. Thus, data mining itself is not the principle.
  • D (due diligence): Due diligence is a more comprehensive and ongoing process of risk assessment and mitigation. While relevant to security in general, it doesn't specifically address the action of gathering information to decide on a course of action in response to a specific incident. Due diligence is preventative, while the question describes a reactive scenario.

  Therefore, the best answer is A (decision making), as it directly describes the activity of gathering information to determine the best course of action.

• Question 6

  One of the objectives of information security is to protect the CIA of information and systems.
  What does CIA mean in this context?
  

  • A. confidentiality, identity, and authorization
  • B. confidentiality, integrity, and authorization
  • C. confidentiality, identity, and availability
  • D. confidentiality, integrity, and availability

  Correct Answer: D

  Explanation:

  I agree with the suggested answer of D (confidentiality, integrity, and availability).
  Reasoning: The CIA triad is a well-established model in information security, representing the core principles of data security.

  • Confidentiality ensures that sensitive information is accessible only to authorized individuals.
  • Integrity guarantees the accuracy and completeness of information, preventing unauthorized modification or destruction.
  • Availability ensures that authorized users have timely and reliable access to information and resources.

  Reasons for not choosing other answers:

  • Option A (confidentiality, identity, and authorization): While identity and authorization are related to security, they are not part of the core CIA triad.
  • Option B (confidentiality, integrity, and authorization): Authorization is related to security, it is not part of the core CIA triad.
  • Option C (confidentiality, identity, and availability): Identity is related to security, it is not part of the core CIA triad.

  The CIA triad is a fundamental concept in cybersecurity and is widely recognized as a cornerstone of information security principles.
  

• Question 7

  What is rule-based detection when compared to statistical detection?
  

  • A. proof of a user's identity
  • B. proof of a user's action
  • C. likelihood of user's action
  • D. falsification of a user's identity

  Correct Answer: B

  Explanation:

  I agree with the suggested answer.
  Rule-based detection systems use predefined rules to identify security threats, focusing on specific patterns or signatures. Statistical detection, on the other hand, uses statistical models to establish a baseline of normal behavior and identify deviations that may indicate a threat.
  The answer is B. proof of a user's action because statistical detection determines the likelihood of a particular action being a security threat by analyzing patterns of behavior, and that likelihood can be used to prove the action was performed by a specific user.
  Here's why the other options are not correct:
  

  • A. proof of a user's identity: While identity management is important in security, statistical detection primarily focuses on actions, not identities.
  • C. likelihood of user's action: Rule-based detection provides specific information about a users action.
  • D. falsification of a user's identity: Similar to option A, this relates to identity but isn't the core focus of statistical detection in comparison to rule-based detection.

• Question 8

  An engineer configured regular expression ".*\.([Dd][Oo][Cc]|[Xx][LI][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]" on Cisco ASA firewall. What does this regular expression do?

  • A. It captures .doc, .xls, and .pdf files in HTTP v1.0 and v1.1.
  • B. It captures documents in an HTTP network session.
  • C. It captures Word, Excel, and PowerPoint files in HTTP v1.0 and v1.1.
  • D. It captures .doc, .xls, and .ppt files extensions in HTTP v1.0.

  Correct Answer: C

  Explanation:

  Based on my analysis and understanding of regular expressions, I disagree with the suggested answer (C).
  The correct answer is C: It captures Word, Excel, and PowerPoint files in HTTP v1.0 and v1.1.
  
  Reasoning:
  The regular expression ".*\.([Dd][Oo][Cc]|[Xx][Ll][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]" is designed to match specific file extensions within HTTP requests. Let's break it down:

  • `.*\.`: Matches any character (`.`) zero or more times (`*`), followed by a literal dot (`.`). This part captures the file name before the extension.
  • `([Dd][Oo][Cc]|[Xx][Ll][Ss]|[Pp][Pp][Tt])`: This is the core part that captures the file extensions. The `|` symbol acts as an "or".
    • `[Dd][Oo][Cc]`: Matches `.doc` (case-insensitive due to the character class `[Dd]` for 'D' or 'd', etc.).
    • `[Xx][Ll][Ss]`: Matches `.xls` (case-insensitive).
    • `[Pp][Pp][Tt]`: Matches `.ppt` (case-insensitive).
    So, it looks for `.doc`, `.xls`, or `.ppt` extensions. These extensions are commonly associated with Microsoft Word, Excel, and PowerPoint files, respectively.
  • `HTTP/1.[01]`: Matches either `HTTP/1.0` or `HTTP/1.1`. This specifies that the file is being transferred using one of these HTTP versions.

  Therefore, the entire regular expression captures HTTP requests for Word (.doc), Excel (.xls), and PowerPoint (.ppt) files in HTTP v1.0 or v1.1.
  
  Why other options are incorrect:

  • Option A is incorrect because although it captures .doc and .xls files, it incorrectly captures .pdf files, which are not included in the regular expression.
  • Option B is too broad. While it's true that the regex captures documents in an HTTP session, it only targets specific types of documents (Word, Excel, PowerPoint).
  • Option D is incorrect because it only considers HTTP v1.0. The regular expression clearly matches both HTTP/1.0 and HTTP/1.1.

  
  

• Question 9

  Which process is used when IPS events are removed to improve data integrity?
  

  • A. data availability
  • B. data normalization
  • C. data signature
  • D. data protection

  Correct Answer: B

  Explanation:

  I agree with the suggested answer.
  The recommended answer is B. data normalization.
  Reason: Data normalization is the process of organizing data to reduce redundancy and improve data integrity. Removing duplicate or irrelevant IPS events falls under this category as it ensures the data is accurate and consistent.
  Reasons for not choosing other options:

  • A. data availability: This refers to ensuring data is accessible when needed, not removing events.
  • C. data signature: This relates to verifying the authenticity of data, not removing events.
  • D. data protection: This is a broad term encompassing measures to safeguard data, but not specifically the removal of events for integrity.

  Citations:

  • Data normalization - Wikipedia, https://en.wikipedia.org/wiki/Data_normalization

• Question 10

  An analyst is investigating an incident in a SOC environment.
  Which method is used to identify a session from a group of logs?
  

  • A. sequence numbers
  • B. IP identifier
  • C. 5-tuple
  • D. timestamps

  Correct Answer: C

  Explanation:

  I agree with the suggested answer, which is C. 5-tuple.
  Reasoning: The 5-tuple (source IP address, source port, destination IP address, destination port, and protocol) is the standard method for uniquely identifying a network session. By examining these five attributes in network logs, analysts can accurately pinpoint and correlate activities associated with a specific session. This is because the combination of these five elements is highly likely to be unique for each communication stream between two hosts.
  Reasons for not choosing other answers:

  • A. Sequence numbers: While sequence numbers are crucial for reliable data transmission within a TCP session, they are not sufficient on their own to identify a session across different hosts or protocols. Sequence numbers are relative to a specific TCP connection between two endpoints.
  • B. IP identifier: The IP identifier is a field in the IP header used for fragment reassembly. It doesn't provide enough information to uniquely identify a session, as multiple sessions can occur between the same IP addresses.
  • D. Timestamps: Timestamps can be helpful in ordering events within a log, but they are not unique identifiers for sessions. Multiple sessions can occur at or around the same time.

  Therefore, the 5-tuple is the most reliable method for session identification in a SOC environment.

  Citations:

  • What is 5-Tuple? - Definition from Techopedia, https://www.techopedia.com/definition/32574/5-tuple