2021 Free Cisco CyberOps Associate 200-201 Questions and Answers

1. 200-201 Free Questions 200-201 Free Questions Understanding Cisco Cybersecurity Operations Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) Fundamentals (CBROPS) https://www.passquestion.com/ https://www.passquestion.com/200-201 200-201.html .html

2. Question 1 Question 1 Which metric should be used when evaluating the effectiveness and scope of a Security Which metric should be used when evaluating the effectiveness and scope of a Security Operations Center? Operations Center? A.The average time the SOC takes to register and assign the incident. A.The average time the SOC takes to register and assign the incident. B.The total incident escalations per week. B.The total incident escalations per week. C.The average time the SOC takes to detect and resolve the incident. C.The average time the SOC takes to detect and resolve the incident. D.The total incident escalations per month. D.The total incident escalations per month. Answer : C Answer : C

3. Question 2 Question 2 A developer is working on a project using a Linux tool that enables writing processes to A developer is working on a project using a Linux tool that enables writing processes to obtain these required results: obtain these required results: If the process is unsuccessful, a negative value is returned. If the process is unsuccessful, a negative value is returned. If the process is successful, 0 value is returned to the child process, and the process ID is If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process. sent to the parent process. Which component results from this operation? Which component results from this operation? A.parent directory name of a file pathname A.parent directory name of a file pathname B.process spawn scheduled B.process spawn scheduled C.macros for managing CPU sets C.macros for managing CPU sets D.new process created by parent process D.new process created by parent process Answer : D Answer : D

4. Question 3 Question 3 An engineer discovered a breach, identified the threat's entry point, and removed access. The An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide? Incident handling guide? A.Recover from the threat. A.Recover from the threat. B.Analyze the threat. B.Analyze the threat. C.Identify lessons learned from the threat. C.Identify lessons learned from the threat. D.Reduce the probability of similar threats. D.Reduce the probability of similar threats. Answer : D Answer : D

5. Question 4 Question 4 What is a difference between tampered and untampered disk images? What is a difference between tampered and untampered disk images? A.Tampered images have the same stored and computed hash. A.Tampered images have the same stored and computed hash. B.Untampered images are deliberately altered to preserve as evidence. B.Untampered images are deliberately altered to preserve as evidence. C.Tampered images are used as evidence. C.Tampered images are used as evidence. D.Untampered images are used for forensic investigations. D.Untampered images are used for forensic investigations. Answer : C Answer : C

6. Question 5 Question 5 What is a difference between tampered and untampered disk images? What is a difference between tampered and untampered disk images? A.Tampered images have the same stored and computed hash. A.Tampered images have the same stored and computed hash. B.Tampered images are used as evidence. B.Tampered images are used as evidence. C.Untampered images are used for forensic investigations. C.Untampered images are used for forensic investigations. D.Untampered images are deliberately altered to preserve as evidence D.Untampered images are deliberately altered to preserve as evidence Answer : B Answer : B

7. Question 6 Question 6 Which event is user interaction? Which event is user interaction? A. gaining root access A. gaining root access B. executing remote code B. executing remote code C. reading and writing file permission C. reading and writing file permission D. opening a malicious file D. opening a malicious file Answer: D Answer: D

8. Question 7 Question 7 Which security principle requires more than one person is required to perform a critical task? Which security principle requires more than one person is required to perform a critical task? A. least privilege A. least privilege B. need to know B. need to know C. separation of duties C. separation of duties D. due diligence D. due diligence Answer: C Answer: C

9. Question 8 Question 8 How is attacking a vulnerability categorized? How is attacking a vulnerability categorized? A. action on objectives A. action on objectives B. delivery B. delivery C. exploitation C. exploitation D. installation D. installation Answer: C Answer: C

10. Question 9 Question 9 What is a benefit of agent-based protection when compared to agentless protection? What is a benefit of agent-based protection when compared to agentless protection? A. It lowers maintenance costs A. It lowers maintenance costs B. It provides a centralized platform B. It provides a centralized platform C. It collects and detects all traffic locally C. It collects and detects all traffic locally D. It manages numerous devices simultaneously D. It manages numerous devices simultaneously Answer: C Answer: C

11. Question 10 Question 10 Which principle is being followed when an analyst gathers information relevant to a security incident Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action? to determine the appropriate course of action? A. decision making A. decision making B. rapid response B. rapid response C. data mining C. data mining D. due diligence D. due diligence Answer: B Answer: B