Prepare With Top Rated High-quality 200-201 Dumps For Success in 200-201 Exam [Q47-Q65]

Rate this post

Prepare With Top Rated High-quality 200-201 Dumps For Success in 200-201 Exam

200-201 Free Certification Exam Easy to Download PDF Format 2022

NO.47 An organization is cooperating with several third-party companies. Data exchange is on an unsecured channel using port 80 Internal employees use the FTP service to upload and download sensitive data An engineer must ensure confidentiality while preserving the integrity of the communication. Which technology must the engineer implement in this scenario’?

X 509 certificates

RADIUS server

CA server

web application firewall

NO.48 How is NetFlow different than traffic mirroring?

NetFlow collects metadata and traffic mirroring clones data

Traffic mirroring impacts switch performance and NetFlow does not

Traffic mirroring costs less to operate than NetFlow

NetFlow generates more data than traffic mirroring

NO.49 A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

CD data copy prepared in Windows

CD data copy prepared in Mac-based system

CD data copy prepared in Linux system

CD data copy prepared in Android-based system

NO.50 Refer to the exhibit.

Which technology generates this log?

NetFlow

IDS

web proxy

firewall

NO.51 When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.
Which information is available on the server certificate?

server name, trusted subordinate CA, and private key

trusted subordinate CA, public key, and cipher suites

trusted CA name, cipher suites, and private key

server name, trusted CA, and public key

NO.52 Refer to the exhibit.

Which application protocol is in this PCAP file?

SSH

TCP

TLS

HTTP

NO.53 Refer to the exhibit.

What should be interpreted from this packet capture?

81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.

192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.

192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.

81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.

NO.54 What is the virtual address space for a Windows process?

physical location of an object in memory

set of pages that reside in the physical memory

system-level memory protection feature built into the operating system

set of virtual memory addresses that can be used

NO.55

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are two active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

Section: Host-Based Analysis

NO.56 A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

NO.57 Drag and drop the security concept from the left onto the example of that concept on the right.

Explanation

Table Description automatically generated

NO.58 A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

NO.59 An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication.

Which obfuscation technique is the attacker using?

Base64 encoding

transport layer security encryption

SHA-256 hashing

ROT13 encryption

NO.60 An engineer needs to fetch logs from a proxy server and generate actual events according to the data received.
Which technology should the engineer use to accomplish this task?

Firepower

Email Security Appliance

Web Security Appliance

Stealthwatch

NO.61 What is the difference between a threat and a risk?

Threat represents a potential danger that could take advantage of a weakness in a system

Risk represents the known and identified loss or danger in the system

Risk represents the nonintentional interaction with uncertainty in the system

Threat represents a state of being exposed to an attack or a compromise, either physically or logically.

Explanation
A threat is any potential danger to an asset. If a vulnerability exists but has not yet been exploited-or, more importantly, it is not yet publicly known-the threat is latent and not yet realized.

NO.62 An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.
What is the initial event called in the NIST SP800-61?

online assault

precursor

trigger

instigator

Explanation
A precursor is a sign that a cyber-attack is about to occur on a system or network. An indicator is the actual alerts that are generated as an attack is happening. Therefore, as a security professional, it’s important to know where you can find both precursor and indicator sources of information.
The following are common sources of precursor and indicator information:
* Security Information and Event Management (SIEM)
* Anti-virus and anti-spam software
* File integrity checking applications/software
* Logs from various sources (operating systems, devices, and applications)
* People who report a security incident
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

NO.63 An engineer received a flood of phishing emails from HR with the source address HRjacobm@companycom.
What is the threat actor in this scenario?

phishing email

sender

receiver

NO.64

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?