200-201 Online Practice Questions and Answers

Refer to the exhibit.

Which type of log is displayed?

A. IDS

B. proxy

C. NetFlow

D. sys

The security team has detected an ongoing spam campaign targeting the organization. The team's approach is to push back the cyber kill chain and mitigate ongoing incidents. At which phase of the cyber kill chain should the security team mitigate this type of attack?

A. actions

B. delivery

C. reconnaissance

D. installation

Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

A. Hypertext Transfer Protocol

B. SSL Certificate

C. Tunneling

D. VPN

What describes the impact of false-positive alerts compared to false-negative alerts?

A. A false negative is alerting for an XSS attack. An engineer investigates the alert and discovers that an XSS attack happened A false positive is when an XSS attack happens and no alert is raised

B. A false negative is a legitimate attack triggering a brute-force alert. An engineer investigates the alert and finds out someone intended to break into the system A false positive is when no alert and no attack is occurring

C. A false positive is an event alerting for a brute-force attack An engineer investigates the alert and discovers that a legitimate user entered the wrong credential several times A false negative is when a threat actor tries to brute-force attack a system and no alert is raised.

D. A false positive is an event alerting for an SQL injection attack An engineer investigates the alert and discovers that an attack attempt was blocked by IPS A false negative is when the attack gets detected but succeeds and results in a breach.

During which phase of the forensic process are tools and techniques used to extract information from the collected data?

A. investigation

B. examination

C. reporting

D. collection

Which evasion method is being used when TLS is observed between two endpoints?

A. encryption

B. obfuscation

C. X.509 certificate authentication

D. traffic insertion

Which type of data is used to detect anomalies in the network?

A. statistical data

B. metadata

C. transaction data

D. alert data

Which type of attack involves executing arbitrary commands on the operating system to escalate privileges?

A. Apache log

B. cross-site scripting

C. command injection

D. SQL injection

Which action matches the weaponization step of the Cyber Kill Chain Model?

A. Develop a specific malware to exploit a vulnerable server.

B. Construct a trojan and deliver it to the victim.

C. Match a known script to a vulnerability.

D. Scan open services and ports on a server.

The SOC team detected an ongoing port scan. After investigation, the team concluded that the scan was targeting the company servers. According to the Cyber Kill Chain model, which step must be assigned to this type of event?

A. delivery

B. exploitation

C. reconnaissance

D. actions on objectives