Verified 200-201 Q&As – Pass Guarantee 200-201 Exam Dumps [Q149-Q171]

Rate this post

Verified 200-201 Q&As – Pass Guarantee 200-201 Exam Dumps

Check the Free demo of our 200-201 Exam Dumps with 312 Questions

NEW QUESTION 149
Refer to the exhibit.

What is occurring within the exhibit?

regular GET requests

XML External Entities attack

insecure deserialization

cross-site scripting attack

NEW QUESTION 150
Refer to the exhibit.

Which type of log is displayed?

proxy

NetFlow

IDS

sys

NEW QUESTION 151
A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

CD data copy prepared in Windows

CD data copy prepared in Mac-based system

CD data copy prepared in Linux system

CD data copy prepared in Android-based system

NEW QUESTION 152
An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.
What is the initial event called in the NIST SP800-61?

online assault

precursor

trigger

instigator

NEW QUESTION 153
What is the difference between an attack vector and attack surface?

An attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.

An attack vector identifies components that can be exploited; and an attack surface identifies the potential path an attack can take to penetrate the network.

An attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible with these vulnerabilities.

An attack vector identifies the potential outcomes of an attack; and an attack surface launches an attack using several methods against the identified vulnerabilities.

NEW QUESTION 154
Which step in the incident response process researches an attacking host through logs in a SIEM?

detection and analysis

preparation

eradication

containment

NEW QUESTION 155
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

NEW QUESTION 156
What is the difference between a threat and a risk?

Threat represents a potential danger that could take advantage of a weakness in a system

Risk represents the known and identified loss or danger in the system

Risk represents the nonintentional interaction with uncertainty in the system

Threat represents a state of being exposed to an attack or a compromise, either physically or logically.

NEW QUESTION 157
Refer to the exhibit.

What does the message indicate?

an access attempt was made from the Mosaic web browser

a successful access attempt was made to retrieve the password file

a successful access attempt was made to retrieve the root of the website

a denied access attempt was made to retrieve the password file

NEW QUESTION 158
Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2?
(Choose two.)

detection and analysis

post-incident activity

vulnerability management

risk assessment

vulnerability scoring

NEW QUESTION 159
Which type of access control depends on the job function of the user?

discretionary access control

nondiscretionary access control

role-based access control

rule-based access control

NEW QUESTION 160
A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?

company assets that are threatened

customer assets that are threatened

perpetrators of the attack

victims of the attack

NEW QUESTION 161
A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

NEW QUESTION 162
Refer to the exhibit.

An engineer is reviewing a Cuckoo report of a file. What must the engineer interpret from the report?

The file will appear legitimate by evading signature-based detection.

The file will not execute its behavior in a sandbox environment to avoid detection.

The file will insert itself into an application and execute when the application is run.

The file will monitor user activity and send the information to an outside source.

NEW QUESTION 163
Which incidence response step includes identifying all hosts affected by an attack?

detection and analysis

post-incident activity

preparation

containment, eradication, and recovery

NEW QUESTION 164
Refer to the exhibit.

What does the output indicate about the server with the IP address 172.18.104.139?

open ports of a web server

open port of an FTP server

open ports of an email server

running processes of the server

NEW QUESTION 165
Which two elements are used for profiling a network? (Choose two.)

session duration

total throughput

running processes

listening ports

OS fingerprint

NEW QUESTION 166
What is a sandbox interprocess communication service?

A collection of rules within the sandbox that prevent the communication between sandboxes.

A collection of network services that are activated on an interface, allowing for inter-port communication.

A collection of interfaces that allow for coordination of activities among processes.

A collection of host services that allow for communication between sandboxes.

NEW QUESTION 167
Which signature impacts network traffic by causing legitimate traffic to be blocked?

false negative

true positive

true negative

false positive

NEW QUESTION 168
Refer to the exhibit.

An engineer is analyzing a PCAP file after a recent breach An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers. Further analysis showed several SSH Server Banner and Key Exchange Initiations. The engineer cannot see the exact data being transmitted over an encrypted channel and cannot identify how the attacker gained access How did the attacker gain access?

by using the buffer overflow in the URL catcher feature for SSH

by using an SSH Tectia Server vulnerability to enable host-based authentication

by using an SSH vulnerability to silently redirect connections to the local host

by using brute force on the SSH service to gain access

NEW QUESTION 169
What does cyber attribution identify in an investigation?

exploit of an attack

threat actors of an attack

vulnerabilities exploited

cause of an attack

NEW QUESTION 170
What are the two characteristics of the full packet captures? (Choose two.)

Identifying network loops and collision domains.

Troubleshooting the cause of security and performance issues.

Reassembling fragmented traffic from raw data.

Detecting common hardware faults and identify faulty assets.

Providing a historical record of a network transaction.

NEW QUESTION 171
What should an engineer use to aid the trusted exchange of public keys between user tom0411976943 and dan1968754032?

central key management server

web of trust

trusted certificate authorities

registration authority data

Get professional help from our 200-201 Dumps PDF: https://www.testsimulate.com/200-201-study-materials.html

Leave a Reply Cancel reply