Cisco 200-201 CCNACBR Exam Questions Instant Access

Question 1

What is a difference between tampered and untampered disk images?

ATampered images have the same stored and computed hash.

BUntampered images are deliberately altered to preserve as evidence.

CTampered images are used as evidence.

DUntampered images are used for forensic investigations.

Answer : D

The difference between tampered and untampered disk images is:

Tampered Images: These are disk images that have beenaltered or modifiedin some way after their initial creation. The stored hash and the computed hash willnot matchif the image has been tampered with.

Untampered Images: These are disk images that havenot been alteredsince their creation. They are consideredauthenticand reliable for forensic investigations. The stored hash and the computed hash willmatch, confirming that the image has remained unchanged.

Therefore, the correct answer is: D. Untampered images are used for forensic investigations.

Question 2

Refer to the exhibit.

Which type of attack is being executed?

ASQL injection

Bcross-site scripting

Ccross-site request forgery

Dcommand injection

Answer : A

The exhibit shows a SQL query that is attempting to bypass login controls by modifying the query to always return true. This is a common tactic used in SQL injection attacks where malicious SQL statements are inserted into an entry field for execution.Reference:=Cisco Cybersecurity Source Documents

Question 3

What are the two differences between vulnerability and exploit? (Choose two.)

AKnown vulnerabilities are assigned special CVE numbers, and exploits are using process to take advantage of vulnerabilities.

BVulnerabilities can be found in hardware and software, and exploits can be used only for software-based vulnerabilities.

CZero-day exploit can be used to take advantage of a vulnerability until the vulnerable software or hardware is patched.

DVulnerabilities are usually populated in the dark web, and exploit tools and methods can be found in the public web.

EZero-day exploit can be used for taking advantage of a known vulnerability, and cyber-attack can be performed on company assets.

Answer : A, C

Question 4

Which security monitoring data type is associated with application server logs?

Atransaction data

Bsession data

Calert data

Dstatistical data

Answer : A

Question 5

Which management concept best describes developing, operating, maintaining, upgrading, and disposing of all resources?

Aconfiguration

Bvulnerability

Casset

Dpatch

Answer : C

Question 6

Refer to the exhibit.

Refer to the exhibit. A communication issue exists between hosts 192.168.0.11 and 34.253.101.190. What is a description of the initial TCP connection?

AHandshake has been established

BFin flag is not set

CReset flag is not set

DAcknowledge is not set

Answer : D

Question 7

A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders After further investigation, the analyst learns that customers claim that they cannot access company servers According to NIST SP800-61, in which phase of the incident response process is the analyst?

Apost-incident activity

Bdetection and analysis

Cpreparation

Dcontainment, eradication, and recovery

Answer : B

The analyst is in the detection and analysis phase of the incident response process according to NIST SP800-61. In this phase, events are detected and analyzed to determine whether they constitute incidents that require a response. It involves monitoring security events or data collection, correlation, and analysis of log entries and network flow data, among others. The goal is to identify incidents quickly so that appropriate actions can be taken.Reference:= NIST SP800-61, Computer Security Incident Handling Guide, Section 3.2: Detection and Analysis

Cisco Understanding Cisco Cybersecurity Operations Fundamentals 200-201 CCNACBR Exam Questions