Cisco 200-201 Exam Dumps

Understanding Cisco Cybersecurity Operations Fundamentals (200-201 CBROPS)

Cisco 200-201 Sample Questions

Question # 1

Which type of access control depends on the job function of the user? 

A. discretionary access control
B. nondiscretionary access control
C. role-based access control
D. rule-based access control

Answer: C

Show Answer

Question # 2

What is a difference between data obtained from Tap and SPAN ports?

A. Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.
B. SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times. 
C. SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility. 
D. Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination 

Answer: D

Show Answer

Question # 3

An automotive company provides new types of engines and special brakes for rally sports cars. The company has a database of inventions and patents for their engines and technical information Customers can access the database through the company's website after they register and identify themselves. Which type of protected data is accessed by customers? 

A. IP data
B. PII data
C. PSI data
D. PHI data

Answer: B

Show Answer

Question # 4

Which attack represents the evasion technique of resource exhaustion?

A. SQL injection
B. man-in-the-middle
C. bluesnarfing
D. denial-of-service

Answer: D

Show Answer

Question # 5

Which regular expression is needed to capture the IP address 192.168.20.232? 

A. ^ (?:[0-9]{1,3}\.){3}[0-9]{1,3}
B. ^ (?:[0-9]f1,3}\.){1,4}
C. ^ (?:[0-9]{1,3}\.)'
D. ^ ([0-9]-{3}) 

Answer: A

Show Answer

Question # 6

Which event is a vishing attack? 

A. obtaining disposed documents from an organization
B. using a vulnerability scanner on a corporate network
C. setting up a rogue access point near a public hotspot
D. impersonating a tech support agent during a phone call 

Answer: D

Show Answer

Question # 7

What describes the impact of false-positive alerts compared to false-negative alerts? 

A. A false negative is alerting for an XSS attack. An engineer investigates the alert anddiscovers that an XSS attack happened A false positive is when an XSS attack happensand no alert is raised
B. A false negative is a legitimate attack triggering a brute-force alert. An engineerinvestigates the alert and finds out someone intended to break into the system A falsepositive is when no alert and no attack is occurring
C. A false positive is an event alerting for a brute-force attack An engineer investigates thealert and discovers that a legitimate user entered the wrong credential several times A falsenegative is when a threat actor tries to brute-force attack a system and no alert is raised.
D. A false positive is an event alerting for an SQL injection attack An engineer investigatesthe alert and discovers that an attack attempt was blocked by IPS A false negative is whenthe attack gets detected but succeeds and results in a breach.

Answer: C

Show Answer

Question # 8

What ate two denial-of-service (DoS) attacks? (Choose two) 

A. port scan
B. SYN flood
C. man-in-the-middle
D. phishing
E. teardrop

Answer: B,C

Show Answer

Question # 9

A security engineer notices confidential data being exfiltrated to a domain "Ranso4134- mware31-895" address that is attributed to a known advanced persistent threat group The engineer discovers that the activity is part of a real attack and not a network misconfiguration. Which category does this event fall under as defined in the Cyber Kill Chain?

A. reconnaissance
B. delivery
C. action on objectives
D. weaponization 

Answer: D

Show Answer

Question # 10

What is the difference between inline traffic interrogation (TAPS) and traffic mirroring (SPAN)?

A. APS interrogation is more complex because traffic mirroring applies additional tags todata and SPAN does not alter integrity and provides full duplex network.
B. SPAN results in more efficient traffic analysis, and TAPS is considerably slower due tolatency caused by mirroring.
C. TAPS replicates the traffic to preserve integrity, and SPAN modifies packets beforesending them to other analysis tools
D. SPAN ports filter out physical layer errors, making some types of analyses more difficult,and TAPS receives all packets, including physical errors.

Answer: A

Show Answer

Question # 11

The security team has detected an ongoing spam campaign targeting the organization. The team's approach is to push back the cyber kill chain and mitigate ongoing incidents. At which phase of the cyber kill chain should the security team mitigate this type of attack?

A. actions
B. delivery
C. reconnaissance
D. installation 

Answer: B

Show Answer

Question # 12

A user received an email attachment named "Hr405-report2609-empl094.exe" but did not run it. Which category of the cyber kill chain should be assigned to this type of event?

A. installation
B. reconnaissance
C. weaponization
D. delivery 

Answer: A

Show Answer