116 free Cisco 200-201 CCNACBR practice questions from the CertStash pack of 462, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 116 free here, all 462 in the pack, and each step includes the one before it.
Get all 462 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which event is user interaction?
Show answer and explanation
Correct answer: D. opening a malicious file
User interaction refers to direct actions taken by a person using a system. Opening a malicious file is a deliberate user action that triggers the infection chain. Gaining root access, executing remote code, and file permissions are technical outcomes or system states rather than user interactions themselves.
Why the other options are wrong
- A. Gaining root access is a technical outcome, not a user interaction event.
- B. Executing remote code is an automated system action, not direct user interaction.
- C. Reading and writing file permissions are system operations, not user interactions.
Question 2
Which security principle requires more than one person is required to perform a critical task?
Show answer and explanation
Correct answer: C. separation of duties
Separation of duties is the security principle requiring that critical tasks be split among multiple people to prevent any single individual from having complete control. This reduces fraud and errors by ensuring checks and balances. Least privilege limits permissions, need to know restricts information access, and due diligence involves thorough investigation, but none require multiple people for task completion.
Why the other options are wrong
- A. Least privilege limits individual permissions but doesn't require multiple people.
- B. Need to know restricts information access based on job requirements, not task distribution.
- D. Due diligence is the process of thorough investigation and assessment.
Question 3
How is attacking a vulnerability categorized?
Show answer and explanation
Correct answer: C. exploitation
Exploitation is the attack phase in the cyber kill chain where an attacker actively leverages a vulnerability to gain access or control. In the kill chain model, action on objectives is the final stage, delivery involves transmitting the payload, and installation means establishing persistence; but exploitation specifically refers to the act of attacking the vulnerability itself.
Why the other options are wrong
- A. Action on objectives occurs after exploitation and refers to achieving the attacker's goals.
- B. Delivery is the phase of transmitting malicious content, not attacking vulnerabilities.
- D. Installation is establishing persistence on a system after initial access.
Question 4
What is a benefit of agent-based protection when compared to agentless protection?
Show answer and explanation
Correct answer: C. It collects and detects all traffic locally
Agent-based protection installs software on each endpoint to detect threats locally, allowing it to collect and analyze all traffic and activities on that specific device without relying on network infrastructure. This local analysis is a key advantage. Higher maintenance costs, centralized platforms, and device management are not inherent benefits of agent-based versus agentless approaches.
Why the other options are wrong
- A. Agent-based systems typically increase maintenance costs due to deployment across numerous endpoints.
- B. Centralized platforms are a feature of agentless solutions, not agent-based ones.
- D. Managing numerous devices simultaneously is a feature better associated with centralized agentless platforms.
Question 5
Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?
Show answer and explanation
Correct answer: D. due diligence
Due diligence is the principle of conducting thorough and systematic investigation to gather relevant facts before making decisions. When an analyst collects information about a security incident to determine the appropriate response, they are following the due diligence principle by ensuring proper investigation precedes action. Decision making follows the investigation, rapid response is speed-oriented rather than investigation-oriented, and data mining is a specific technical technique.
Why the other options are wrong
- A. Decision making is what occurs after due diligence gathering, not the investigation itself.
- B. Rapid response emphasizes speed rather than thorough information gathering.
- C. Data mining is a specific technical method, not the overarching principle of investigation.
Question 6
One of the objectives of information security is to protect the CIA of information and systems. What does CIA mean in this context?
Show answer and explanation
Correct answer: D. confidentiality, integrity, and availability
CIA is the foundational triad of information security comprising Confidentiality (preventing unauthorized disclosure), Integrity (ensuring accuracy and completeness of information), and Availability (ensuring systems and data are accessible when needed). These three principles form the core objectives of protecting information and systems. Identity and authorization are related security concepts but are not part of the CIA triad definition.
Why the other options are wrong
- A. Identity and authorization are security controls, not components of the CIA triad.
- B. Identity is not part of CIA; the triad uses integrity, not identity.
- C. Identity and availability are incorrect; CIA uses confidentiality, integrity, and availability.
Question 7
What is rule-based detection when compared to statistical detection?
Show answer and explanation
Correct answer: B. proof of a user's action
Rule-based detection uses predetermined rules to identify specific patterns or signatures of known malicious behavior, providing definitive proof when a rule is triggered. This contrasts with statistical detection, which calculates the likelihood of an action based on deviation from normal behavior. Rule-based detection establishes whether an action occurred (proof), while statistical detection estimates probability.
Why the other options are wrong
- A. Proof of identity involves authentication, not detection method comparison.
- C. Likelihood of user action is what statistical detection provides, not rule-based detection.
- D. Falsification of identity relates to spoofing, not detection methodologies.
Question 8
An engineer configured regular expression ".*\.([Dd][Oo][Cc]|[Xx][LI][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]" on Cisco ASA firewall. What does this regular expression do?
Show answer and explanation
Correct answer: C. It captures Word, Excel, and PowerPoint files in HTTP v1.0 and v1.1.
The regular expression captures file extensions in a case-insensitive manner: DOC/doc, XLS/xls, and PPT/ppt, matching these files when transferred over HTTP version 1.0 or 1.1. These extensions correspond to Microsoft Word, Excel, and PowerPoint files respectively. The regex specifically looks for .ppt (PowerPoint), not .pdf files, and applies to both HTTP/1.0 and HTTP/1.1 traffic, not just version 1.0.
Why the other options are wrong
- A. The regex captures .ppt files, not .pdf files.
- B. While technically capturing documents, the answer is too vague and doesn't specify the file types.
- D. The regex applies to both HTTP/1.0 and HTTP/1.1 (the [01] means either 0 or 1), not just v1.0.
Question 9
Which process is used when IPS events are removed to improve data integrity?
Show answer and explanation
Correct answer: B. data normalization
Data normalization is the process of standardizing and cleaning IPS (Intrusion Prevention System) event data by removing duplicate, conflicting, or irrelevant events to improve data quality and integrity for analysis. This ensures that security analysts work with consistent, accurate information when investigating alerts.
Why the other options are wrong
- A. Data availability refers to ensuring information is accessible when needed, not about removing events to improve integrity.
- C. Data signature relates to cryptographic or identifying marks on data, not the process of event removal.
- D. Data protection involves safeguarding data from unauthorized access, not the cleanup and standardization process.
Question 10
An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?
Show answer and explanation
Correct answer: C. 5-tuple
A 5-tuple (source IP, destination IP, source port, destination port, and protocol) is the standard method used to uniquely identify and track a network session or conversation within logs. This combination creates a unique fingerprint for each distinct communication flow between two endpoints.
Why the other options are wrong
- A. Sequence numbers identify individual packets within a stream, not entire sessions.
- B. IP identifier is a field within IP headers used for fragment reassembly, not session identification.
- D. Timestamps indicate when events occurred but do not uniquely identify a session across multiple log entries.
What people say about the full 200-201 pack 4.9 from 14
WOW!!! I passed my 200-201 exam earlier this morning. The pdf file is really helpful. I learnt more from the questions and finally, I passed my 200-201 exam successfully.
Excellent question answers for CyberOps Associate exam . Prepared me well for the exam. Scored 92% in the first attempt. Highly recommend Cert Stash to everyone.
Passed 200-201 exam with perfect score. Thanks a lot for your great support.
Question 11
A security engineer notices confidential data being exfiltrated to a domain `Ransome4144-mware73-978` address that is attributed to a known advanced persistent threat group. The engineer discovers that the activity is part of a real attack and not a network misconfiguration. Which category does this event fall under as defined in the Cyber Kill Chain?
Show answer and explanation
Correct answer: C. action on objectives
The Cyber Kill Chain defines phases of a cyberattack progression. Data exfiltration to an attacker-controlled destination represents the final stage where the attacker achieves their objectives by stealing confidential information. This is the 'action on objectives' phase where the attacker has already infiltrated the network, established persistence, and is now conducting the intended attack to accomplish their goals.
Why the other options are wrong
- A. Reconnaissance involves initial information gathering about the target before the attack begins.
- B. Delivery refers to transmitting the malicious payload to the target system.
- D. Weaponization involves preparing the malicious code or tool for use, occurring before delivery.
Question 12
A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor. Which type of evidence is this?
Show answer and explanation
Correct answer: C. indirect evidence
Indirect evidence (circumstantial evidence) establishes facts through inference rather than direct proof. The video showing the suspect in the data center on the same day files were transferred to a competitor creates circumstantial connection between the person and the theft; it does not directly prove the suspect transferred the files. Best evidence refers to the strongest form of evidence available. Prima facie evidence establishes a case unless rebutted. Physical evidence refers to tangible objects.
Why the other options are wrong
- A. This is not the best or strongest form of evidence; it requires inference.
- B. Prima facie evidence establishes facts directly unless contradicted; this requires inference.
- D. Physical evidence refers to tangible objects like hard drives or documents, not video footage of a person.
Question 13
Which action prevents buffer overflow attacks?
Show answer and explanation
Correct answer: C. input validation
Input validation prevents buffer overflow attacks by checking that data conforms to expected formats and lengths before processing it, ensuring that oversized or malformed input cannot overflow memory buffers. Variable randomization addresses ASLR but does not prevent the initial overflow condition. Web-based applications and Linux operating systems do not inherently prevent buffer overflows without proper coding practices.
Why the other options are wrong
- A. Variable randomization (ASLR) makes exploits harder but does not prevent buffer overflows from occurring.
- B. Web-based applications are vulnerable to buffer overflows if input is not properly validated.
- D. Linux operating systems can still suffer buffer overflow vulnerabilities without proper input validation.
Question 14
Which tool provides a full packet capture from network traffic?
Show answer and explanation
Correct answer: D. Wireshark
Wireshark is the industry-standard tool for full packet capture and analysis of network traffic. It captures all packets traversing a network interface in real-time and allows detailed inspection of each packet's headers and payload, making it ideal for comprehensive packet-level analysis.
Why the other options are wrong
- A. Nagios is a network monitoring and alerting platform focused on system availability and performance, not packet capture.
- B. CAINE is a computer forensics distribution and toolkit, not primarily designed for live network packet capture.
- C. Hydra is a password cracking tool, not a packet capture utility.
Question 15
What are the two differences between stateful and deep packet inspection? (Choose two.)
Show answer and explanation
Correct answer: C, D. Deep packet inspection is capable of malware blocking, and stateful inspection is not; Stateful inspection is capable of TCP state tracking, and deep packet filtering checks only TCP source and destination ports.
Deep packet inspection examines the payload and application-layer content of traffic, so it can recognize and block malware, which stateful inspection cannot do. Stateful inspection tracks the state of each TCP connection and permits or denies packets based on that connection context, while a basic packet filter looks only at header fields such as the TCP source and destination ports. Those are the two differences: malware blocking belongs to deep packet inspection, and TCP state tracking belongs to stateful inspection.
Why the other options are wrong
- A. Stateful inspection can monitor both TCP and UDP, not just TCP, and deep packet inspection is not limited to TCP.
- B. Both stateful and deep packet inspection are capable of examining packet data; deep packet inspection actually goes deeper into payload analysis.
- E. Both stateful and deep packet inspection operate across multiple OSI layers, including Layer 7 for DPI, not just Layer 3 or 4.
Question 16
What is an advantage of symmetric over asymmetric encryption?
Show answer and explanation
Correct answer: A. It is a faster encryption mechanism for sessions.
Symmetric encryption is computationally faster than asymmetric encryption because both encryption and decryption use the same key and simpler mathematical operations. This speed advantage makes symmetric encryption ideal for encrypting large amounts of data during active sessions.
Why the other options are wrong
- B. One-time keys are a feature of certain protocols, not a defining advantage of symmetric over asymmetric encryption.
- C. Key generation on demand according to data type is not characteristic of symmetric encryption.
- D. While symmetric encryption is well-suited for large data, the primary advantage is speed, not suitability for volume.
Question 17
What is an incident response plan?
Show answer and explanation
Correct answer: A. an organizational approach to events that could lead to asset loss or disruption of operations
An incident response plan is an organizational approach to events that could lead to asset loss or disruption of operations. It is a structured, documented plan that defines procedures, roles, and responsibilities for detecting, responding to, and recovering from security incidents. Option B describes security management and service lifecycle (ITSM/ITIL), Option C describes disaster recovery planning (which is related but distinct), and Option D describes data management and compliance. The incident response plan specifically focuses on addressing security events that threaten organizational assets and operations.
Why the other options are wrong
- B. This describes ITSM/ITIL security management and service lifecycle processes, not incident response planning.
- C. Disaster recovery is related but distinct; it focuses on business continuity and restoration after major events, not incident response procedures.
- D. This describes data management, backup, and archival strategies aligned to regulations, not incident response planning.
Question 18
What is a benefit of using asymmetric cryptography?
Show answer and explanation
Correct answer: C. secure data transfer
Asymmetric cryptography uses a public-private key pair where data encrypted with the public key can only be decrypted with the corresponding private key. This enables secure data transfer because the public key can be freely distributed while the private key remains secret. This fundamental characteristic allows secure communication over untrusted channels and forms the basis for digital signatures and certificate-based authentication, making it ideal for secure data transfer scenarios.
Why the other options are wrong
- A. Asymmetric cryptography uses two different keys, not one key for encryption.
- B. Asymmetric cryptography uses two different keys for encryption and decryption, not the same key.
- D. Asymmetric cryptography is computationally slower than symmetric cryptography due to key size and mathematical complexity requirements.
Question 19
Which type of data consists of connection level, application-specific records generated from network traffic?
Show answer and explanation
Correct answer: A. transaction data
Transaction data consists of connection-level and application-specific records derived from network traffic, capturing the details of network flows and sessions. This metadata-based approach records individual communication transactions with their associated characteristics without capturing full packet payloads.
Why the other options are wrong
- B. Location data refers to geographical information about network nodes or users, not connection-level records.
- C. Statistical data involves aggregated metrics and summaries rather than individual connection records.
- D. Alert data contains security notifications and triggered conditions, not the underlying connection records themselves.
Question 20
What is a difference between SIEM and SOAR?
Show answer and explanation
Correct answer: B. SIEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.
SIEM (Security Information and Event Management) primarily collects security event data from various sources and detects anomalies and threats through analysis and correlation. SOAR (Security Orchestration, Automation and Response) focuses on automating security workflows and orchestrating responses to incidents. SIEM is the detection layer while SOAR is the automation and response layer.
Why the other options are wrong
- A. SIEM does not predict and prevent; it detects. SOAR does not primarily check attack patterns; it automates response actions.
- C. This reverses the actual functions of SIEM and SOAR.
- D. SOAR does not predict and prevent alerts; SIEM does not apply mitigation through attack pattern checking.
Question 21
Which security technology allows only a set of pre-approved applications to run on a system?
Show answer and explanation
Correct answer: C. application-level whitelisting
Application-level whitelisting is the security technology that restricts execution to only pre-approved applications. It operates on an allow-list principle where only authorized applications are permitted to run.
Why the other options are wrong
- A. Blacklisting prevents known malicious applications but allows unknown or unapproved ones.
- B. Host-based IPS detects and prevents intrusion attempts but does not restrict applications.
- D. Antivirus detects and removes malware but does not prevent unapproved applications from running.
Question 22
What is the difference between discretionary access control (DAC) and role-based access control (RBAC)?
Show answer and explanation
Correct answer: A. DAC administrators pass privileges to users and groups, and in RBAC, permissions are applied to specific groups.
DAC allows resource owners to grant access permissions to other users and groups at their discretion. RBAC assigns permissions to predefined roles, and users inherit permissions through group membership. The key difference is that DAC is individual/group-based while RBAC is role-based, where administrators configure permissions once per role rather than per individual user.
Why the other options are wrong
- B. Both DAC and RBAC require authorization, but they differ in how that authorization is structured and assigned, not in the requirement for explicit authorization.
- C. RBAC is not an extended version of DAC; they are distinct access control models with different architectural approaches.
- D. This reverses the actual definitions; RBAC grants access based on roles, not conditions, and DAC applies permissions at the user/group level.
Question 23
How does an attack surface differ from an attack vector?
Show answer and explanation
Correct answer: D. An attack surface identifies vulnerable parts for an attack, and an attack vector specifies which attacks are feasible to those parts.
An attack surface is the total sum of vulnerable points or components in a system that could potentially be exploited. An attack vector is the specific method or path through which an attacker can exploit those vulnerable components. The attack surface identifies what can be attacked; the attack vector specifies how those parts can be attacked.
Why the other options are wrong
- A. Attack vectors do not recognize outcomes; they are methods of attack. Attack surface is not about choosing a method but identifying vulnerable points.
- B. Attack vector does not match components; it specifies the path or method of exploitation against components.
- C. Attack surface does not mitigate vulnerabilities, and attack vector does not identify mitigation techniques; both define aspects of the threat landscape, not defenses.
Question 24
What are the two characteristics of the full packet captures? (Choose two.)
Show answer and explanation
Correct answer: B, E. Troubleshooting the cause of security and performance issues; Providing a historical record of a network transaction.
Full packet captures record every byte of network traffic, including headers and payloads, which makes them extremely valuable for two main purposes: troubleshooting the root cause of security incidents or performance problems by allowing analysts to reconstruct exactly what happened on the wire, and providing a complete historical record of network transactions that can be reviewed after the fact for forensic investigation, compliance, or auditing purposes. Because the data is captured in its entirety and preserved over time, security teams can go back and replay or inspect traffic long after an event occurred, which is central to incident response and network forensics.
Why the other options are wrong
- A. Identifying network loops and collision domains is a Layer 2 network design and topology concern handled by switching protocols and diagnostics, not a function of packet capture analysis.
- C. Reassembling fragmented traffic is a technical capability some tools perform internally, but it is not itself a defining characteristic or purpose of full packet capture.
- D. Detecting hardware faults and faulty assets relates to device health monitoring and hardware diagnostics, which falls outside the scope of packet capture data.
Question 25
How is NetFlow different from traffic mirroring?
Show answer and explanation
Correct answer: A. NetFlow collects metadata and traffic mirroring clones data.
NetFlow collects flow-level metadata about network connections (source, destination, ports, bytes transferred) without capturing the actual packet payload. Traffic mirroring, also called port mirroring or SPAN, creates a complete copy of all data frames traversing the monitored ports. This fundamental difference in collection methodology distinguishes the two approaches.
Why the other options are wrong
- B. While NetFlow has lower resource impact, traffic mirroring's performance impact varies by implementation and is not the defining difference.
- C. Cost comparison depends on specific implementations and deployment scenarios; this is not the core technical difference.
- D. Traffic mirroring generates more data than NetFlow since it captures full payloads, making this statement backwards.
Question 26
A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?
Show answer and explanation
Correct answer: D. process identification number
The process identification number (PID) is the standard Linux identifier that uniquely tracks an active program or process during its execution. The PID is essential for monitoring, managing, and investigating running processes on Linux systems.
Why the other options are wrong
- A. Application identification number is not a standard Linux process tracking mechanism.
- B. Active process identification number is not the correct technical term; the standard term is simply process identification number.
- C. Runtime identification number is not a standard Linux process tracking identifier.
Question 27
An engineer needs to configure network systems to detect command and control communications by decrypting ingress and egress perimeter traffic and allowing network security devices to detect malicious outbound communications Which technology should be used to accomplish the task?
Show answer and explanation
Correct answer: C. digital certificates
Digital certificates enable SSL/TLS inspection at the perimeter, allowing security devices to decrypt encrypted traffic for inspection of command and control communications. The network security appliances use the organization's certificate to establish trust and examine encrypted payloads for malicious signatures and patterns.
Why the other options are wrong
- A. Static IP addresses are network configuration settings that do nothing to enable traffic decryption or inspection.
- B. Cipher suites define encryption algorithms but do not provide the mechanism to decrypt traffic for inspection.
- D. Signatures detect malicious patterns but cannot decrypt encrypted traffic to reveal those patterns in the first place.
Question 28
What specific type of analysis is assigning values to the scenario to see expected outcomes?
Show answer and explanation
Correct answer: A. deterministic
Deterministic analysis assigns specific known values to variables and parameters to calculate exact, predictable outcomes. This approach contrasts with probabilistic analysis, which uses probability distributions and ranges to explore potential outcomes under uncertainty.
Why the other options are wrong
- B. Exploratory analysis examines data to discover patterns without predefined hypotheses; it doesn't involve assigning values for expected outcomes.
- C. Probabilistic analysis uses probability distributions and ranges rather than specific assigned values.
- D. Descriptive analysis summarizes and characterizes existing data rather than assigning values to predict outcomes.
Question 29
Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?
Show answer and explanation
Correct answer: A. Modify the settings of the intrusion detection system.
When an IDS is overwhelmed with false positives and false negatives, the root cause is improper configuration. Modifying the IDS settings, such as adjusting sensitivity thresholds, refining detection rules, and tuning alert parameters, is the primary action to reduce alert noise while maintaining detection accuracy. This addresses the fundamental calibration issue.
Why the other options are wrong
- B. Designing criteria for reviewing alerts is a secondary measure for handling existing alerts rather than preventing their generation in the first place.
- C. Redefining signature rules is a subset of modifying IDS settings and is less comprehensive than adjusting overall system settings.
- D. Adjusting the alert schedule does not address the underlying false positive and false negative problem; it only changes when alerts are delivered.
Question 30
Which attack method intercepts traffic on a switched network?
Show answer and explanation
Correct answer: B. ARP cache poisoning
ARP cache poisoning is an attack method that exploits the Address Resolution Protocol to intercept network traffic on a switched network. By sending falsified ARP messages, an attacker can redirect traffic destined for legitimate hosts to the attacker's machine, allowing interception and monitoring of communications. This technique bypasses the switching infrastructure's normal traffic segmentation.
Why the other options are wrong
- A. Denial of service attacks disrupt service availability but do not intercept traffic.
- C. DHCP snooping is a defense mechanism against DHCP attacks, not a traffic interception method.
- D. Command and control is a malware communication infrastructure, not a traffic interception technique.
Question 31
Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?
Show answer and explanation
Correct answer: B. tcpdump
tcpdump is an open-source command-line packet capture utility that runs natively on Linux and macOS systems. NetScout is commercial software, SolarWinds is an enterprise network management suite, and netsh is a Windows command-line utility for network configuration.
Why the other options are wrong
- A. NetScout is a commercial (not open-source) network monitoring solution.
- C. SolarWinds is a commercial (not open-source) network management platform.
- D. netsh is a Windows-only command-line tool for network configuration, not a packet capture tool.
Question 32
A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?
Show answer and explanation
Correct answer: D. exploitation
Exploitation refers to the active attack phase where an attacker leverages vulnerabilities to execute malicious code. The scenario describes PHP code being sent in HTTP requests with the intent to execute and create files on the webserver, which constitutes active exploitation of a vulnerability.
Why the other options are wrong
- A. Reconnaissance is the initial information gathering phase before attacks; sending exploit code is beyond passive reconnaissance.
- B. Action on Objectives occurs after successful compromise when the attacker achieves their goals; the execution phase comes before this.
- C. Installation refers to establishing persistence mechanisms; the exploit execution phase typically precedes installation.
Question 33
What is the difference between deep packet inspection and stateful inspection?
Show answer and explanation
Correct answer: C. Deep packet inspection gives insights up to Layer 7, and stateful inspection gives insights only up to Layer 4.
Deep packet inspection examines data up to Layer 7 (application layer) of the OSI model, allowing inspection of application-level content, while stateful inspection operates at Layer 4 (transport layer), tracking connection states and validating whether packets are part of established connections. This distinction defines the fundamental difference in their inspection depth and capabilities.
Why the other options are wrong
- A. This reverses the security characteristics and human intervention requirements; deep packet inspection actually requires more complex analysis, not less intervention.
- B. This also incorrectly characterizes the relative security and intervention requirements of both methods.
- D. While both statements about layers appear similar to the correct answer, this phrasing reverses which method operates at which layer.
Question 34
A developer is working on a project using a Linux tool that enables writing processes to obtain these required results: • If the process is unsuccessful, a negative value is returned. • If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process. Which component results from this operation?
Show answer and explanation
Correct answer: D. new process created by parent process
This describes the behavior of the fork() system call in Linux, which creates a new process by duplicating the parent process. The child process receives a return value of 0 while the parent receives the child's process ID, resulting in a new process created by the parent process.
Why the other options are wrong
- A. Parent directory name is a file system concept unrelated to process creation return values.
- B. Process spawn scheduled refers to scheduling operations, not the immediate creation result of the described operation.
- C. Macros for managing CPU sets relate to processor affinity, not the basic process creation mechanism described.
Question 35
A security analyst notices a sudden surge of incoming traffic and detects unknown packets from unknown senders. After further investigation, the analyst learns that customers claim that they cannot access company servers. According to NIST SP 800-61, in which phase of the incident response process is the analyst?
Show answer and explanation
Correct answer: D. detection and analysis
The analyst is observing unusual network traffic, unknown packets, and customer service disruptions; these are signs that an incident has been detected. According to NIST SP 800-61, detection and analysis is the phase where organizations identify and confirm security incidents through indicators like abnormal traffic patterns and their impact. Containment and recovery follow after analysis confirms the incident.
Why the other options are wrong
- A. Preparation occurs before incidents happen, focusing on tools, processes, and readiness rather than incident detection.
- B. Post-incident activity occurs after the incident is resolved and involves lessons learned and process improvement.
- C. Containment, eradication, and recovery come after detection and analysis is complete; the analyst is still in the detection phase.
Question 36
An engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Application Visibility and Control should the engineer use to accomplish this goal? (Choose two.)
Show answer and explanation
Correct answer: D, E. metrics collection and exporting; application recognition
Metrics collection and exporting provides the TCP bandwidth usage, response time, and latency visibility required. Application recognition performs deep packet inspection to identify unknown software by analyzing network traffic flows. Management and reporting are administrative functions, traffic filtering restricts traffic, and adaptive AVC optimizes performance; none of these directly provide the visibility and identification capabilities described.
Why the other options are wrong
- A. Management and reporting are administrative tools but do not provide the specific metrics collection or deep packet inspection needed.
- B. Traffic filtering restricts data flows but does not provide visibility into bandwidth, latency, or application identification.
- C. Adaptive AVC optimizes application performance but does not provide the visibility metrics or deep inspection required.
Question 37
Which information must an organization use to understand the threats currently targeting the organization?
Show answer and explanation
Correct answer: B. threat intelligence
Threat intelligence provides current, actionable information about threats actively targeting an organization, including adversary tactics, techniques, and indicators of compromise. This is the primary resource organizations use to understand the specific threats they face.
Why the other options are wrong
- A. Vendor suggestions are generic and not tailored to current threats targeting the specific organization.
- C. Risk scores measure severity of known vulnerabilities but do not identify current threats targeting the organization.
- D. Vulnerability exposure catalogs weaknesses but does not describe threats currently active against the organization.
Question 38
What is an attack surface as compared to a vulnerability?
Show answer and explanation
Correct answer: B. the sum of all paths for data into and out of the environment
An attack surface represents the total collection of all possible entry and exit points for data within a system or environment, encompassing all vectors through which an attacker could potentially access or exfiltrate information. A vulnerability is a specific weakness that can be exploited, making attack surface a broader concept. Generic danger to assets is too vague, and individuals performing attacks are threat actors, not components of attack surface.
Why the other options are wrong
- A. While this describes a general security concern, it does not specifically define attack surface as a measurable concept.
- C. This defines a vulnerability, which is distinct from attack surface; vulnerabilities are weaknesses within the attack surface.
- D. Individuals performing attacks are threat actors or adversaries, not part of the attack surface definition.
Question 39
What is the difference between the ACK flag and the RST flag in the NetFlow log session?
Show answer and explanation
Correct answer: D. The ACK flag confirms the receipt of the prior segment, and the RST flag allows for the spontaneous termination of a connection
The ACK flag is used in TCP to confirm receipt of data from the prior segment, acknowledging successful transmission. The RST flag forcibly terminates a TCP connection immediately without the normal graceful close sequence, allowing for spontaneous termination. This is the correct distinction between these two critical TCP control flags.
Why the other options are wrong
- A. Reverses the actual functions of both flags; SYN flag confirms connection beginning, not RST.
- B. Reverses the actual functions of both flags; SYN flag confirms connection beginning, not ACK.
- C. RST does not allow for termination through ACK's function; RST itself is the termination mechanism.
Question 40
Which event is a vishing attack?
Show answer and explanation
Correct answer: C. impersonating a tech support agent during a phone call
Vishing (voice phishing) is a social engineering attack conducted over the telephone where an attacker impersonates a trusted entity, such as a tech support agent, to manipulate victims into divulging sensitive information or performing actions that compromise security. This is exactly what option C describes.
Why the other options are wrong
- A. Obtaining disposed documents is dumpster diving, not vishing.
- B. Using a vulnerability scanner is a legitimate security assessment tool, not a vishing attack.
- D. Setting up a rogue access point is an evil twin attack, not vishing.
Question 41
In a SOC environment, what is a vulnerability management metric?
Show answer and explanation
Correct answer: C. internet exposed devices
Internet exposed devices is a key vulnerability management metric that measures the number and scope of organizational assets exposed to the internet, indicating potential attack surface and security risk exposure that needs monitoring and remediation.
Why the other options are wrong
- A. Code signing enforcement is a security control implementation measure, not a vulnerability management metric.
- B. Full assets scan is an operational activity but serves as an input to metrics rather than being a metric itself.
- D. Single factor authentication is a security configuration issue, not a vulnerability management metric used to evaluate organizational risk.
Question 42
Which technology prevents end-device to end-device IP traceability?
Show answer and explanation
Correct answer: D. NAT/PAT
NAT/PAT (Network Address Translation/Port Address Translation) prevents end-device to end-device IP traceability by translating private IP addresses to public addresses at network boundaries, obscuring the true source IP from external systems and making devices non-traceable by their actual IP addresses.
Why the other options are wrong
- A. Encryption protects data content but does not prevent IP address traceability at the network layer.
- B. Tunneling encapsulates traffic but does not eliminate IP traceability; the tunnel endpoints are still traceable.
- C. Load balancing distributes traffic across multiple servers but does not prevent IP address traceability.
Question 43
An automotive company provides new types of engines and special brakes for rally sports cars. The company has a database of inventions and patents for their engines and technical information. Customers can acces the database through the company's website after they register and identify themselves. Which type of protected data is accessed by customers?
Show answer and explanation
Correct answer: A. IP data
IP (Intellectual Property) data refers to proprietary information such as patents, inventions, trade secrets, and technical specifications. The automotive company's database of engine patents and technical information is classic intellectual property that provides competitive advantage and must be protected from unauthorized access.
Why the other options are wrong
- B. PII (Personally Identifiable Information) refers to data about individuals such as names, addresses, and social security numbers, not technical patents.
- C. PSI (Personally Sensitive Information) is not a standard data classification category used in security frameworks.
- D. PHI (Protected Health Information) refers to medical and health-related data regulated by standards like HIPAA, not automotive technical specifications.
Question 44
An engineer is working with the compliance teams to identify the data passing through the network. During analysis, the engineer informs the compliance team that external perimeter data flows contain records, writings, and artwork. Internal segregated network flows contain the customer choices by gender, addresses, and product preferences by age? The engineer must identify protected data. Which two types of data must be identified? (Choose two.)
Show answer and explanation
Correct answer: B, E. PII; copyright
External perimeter data flows containing records, writings, and artwork represent copyrighted intellectual property protected by copyright law. Internal segregated flows containing customer gender, addresses, and product preferences constitute Personally Identifiable Information (PII) that identifies or can be linked to individuals. SOX applies to financial controls, PCI applies to payment cards, and PHI applies to healthcare records, none of which match the described data.
Why the other options are wrong
- A. SOX (Sarbanes-Oxley) governs financial controls and reporting, not the customer demographic and preference data described.
- C. PCI-DSS applies specifically to payment card data, which is not mentioned in the network flows described.
- D. PHI (Protected Health Information) applies to healthcare data; the described data does not indicate medical information.
Question 45
What causes events on a Windows system to show Event Code 4625 in the log messages?
Show answer and explanation
Correct answer: B. Someone is trying a brute force attack on the network
Event Code 4625 in Windows Security logs specifically indicates failed logon attempts. Multiple occurrences of this event code typically indicate brute force attack attempts, where an attacker is trying numerous credential combinations against a target account.
Why the other options are wrong
- A. XSS attacks occur at the application layer and are not logged as Windows Security Event Code 4625.
- C. Root access gaining is a Linux/Unix concept; Windows uses administrator privileges and would generate different event codes.
- D. Successful privileged logins are logged as Event Code 4672 (special privileges assigned), not 4625.
Question 46
An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?
Show answer and explanation
Correct answer: C. The computer has a HIDS installed on it.
A host-based intrusion detection system (HIDS) detects and alerts on attacks but does not take mitigation action. The alert was received because HIDS identified the attack, but no mitigation occurred because HIDS is detection-only. Host-based intrusion prevention systems (HIPS) would actively block or stop attacks, whereas HIDS only identifies and reports them. The discrepancy between the alert and lack of mitigation indicates the system can detect but cannot prevent.
Why the other options are wrong
- A. HIPS would have taken mitigation action to prevent or stop the attack, so this would not explain why no mitigation occurred despite the alert.
- B. NIPS (network-based intrusion prevention) operates at the network level and is not installed on individual desktop computers; it would also actively prevent attacks rather than just alert.
- D. NIDS (network-based intrusion detection) operates at the network level and does not monitor local desktop computers, and alerts without mitigation action are normal for detection-only systems.
Question 47
Which security principle is violated by running all processes as root or administrator?
Show answer and explanation
Correct answer: A. principle of least privilege
Running all processes as root or administrator directly violates the principle of least privilege, which requires that users and processes operate with only the minimum permissions necessary. Unrestricted administrative access increases the potential impact of any compromise or error.
Why the other options are wrong
- B. Role-based access control is related but is a specific implementation model; the principle violated is least privilege.
- C. Separation of duties involves dividing responsibilities among multiple parties; this situation involves excessive centralized privilege.
- D. Trusted computing base refers to the core security mechanisms of a system, not the principle governing user and process permissions.
Question 48
How does statistical detection differ from rule-based detection?
Show answer and explanation
Correct answer: C. Statistical detection defines legitimate data over time, and rule-based detection works on a predefined set of rules.
Statistical detection operates by establishing a baseline of normal behavior patterns over time and identifying deviations from this baseline as potential anomalies or threats. Rule-based detection works by comparing network events and system activities against a predefined set of known attack patterns or security rules. Statistical detection requires historical data to establish what is normal, while rule-based detection requires predetermined rules to function effectively.
Why the other options are wrong
- A. This reverses the relationship and incorrectly describes how both detection methods work.
- B. This also reverses the correct relationship between the two detection types.
- D. This inverts the definitions, incorrectly stating that rule-based detection requires data evaluation over time.
Question 49
Which evasion technique is a function of ransomware?
Show answer and explanation
Correct answer: B. encryption
Encryption is a primary function of ransomware, serving both as an evasion technique and as the core mechanism of the attack itself. Ransomware encrypts victim files to render them inaccessible, making it both a technical capability and an evasion method that helps obscure the malware's operations and the stolen data. This distinguishes encryption as a fundamental ransomware characteristic rather than merely a detection avoidance tactic.
Why the other options are wrong
- A. Extended sleep calls are an evasion technique but not a primary function unique to ransomware.
- C. Resource exhaustion is not a characteristic evasion technique of ransomware.
- D. Encoding is a general obfuscation technique used by many malware types, not a defining function of ransomware.
Question 50
What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?
Show answer and explanation
Correct answer: A. least privilege
The principle of least privilege is the security practice of granting users, applications, and processes only the minimum permissions necessary to perform their assigned tasks or functions, reducing the attack surface and limiting potential damage from compromised accounts.
Why the other options are wrong
- B. Need to know is a related concept but refers specifically to information access, not the broader permission assignment principle.
- C. Integrity validation refers to verifying data has not been altered, not about permission assignment.
- D. Due diligence is a broader risk management practice, not the specific principle of minimal permission granting.
Question 51
Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?
Show answer and explanation
Correct answer: D. man-in-the-middle
A man-in-the-middle (MITM) attack occurs when an attacker eavesdrops on communications between two parties, intercepting and potentially modifying the conversation between two IP phones. Known-plaintext and dictionary attacks are cryptographic attacks, while replay attacks involve retransmitting captured messages rather than live eavesdropping.
Why the other options are wrong
- A. Known-plaintext attacks are cryptographic attacks involving plaintext and ciphertext pairs, not eavesdropping.
- B. Replay attacks involve resending captured messages, not live eavesdropping on ongoing conversations.
- C. Dictionary attacks are password-cracking attacks, not related to eavesdropping on IP phone conversations.
Question 52
While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?
Show answer and explanation
Correct answer: D. NAT
NAT (Network Address Translation) allows a single IP address to represent multiple devices by modifying IP headers in transit. The analyzer observes one IP sending and receiving traffic on behalf of multiple devices; a characteristic behavior of NAT, where internal private IPs are translated to a single public IP for outbound traffic and translated back for inbound traffic.
Why the other options are wrong
- A. Encapsulation wraps data in additional headers but does not modify source/destination IP addresses to represent multiple devices.
- B. TOR is an anonymity network that routes traffic through multiple relays but does not translate IPs to represent multiple devices from a single IP.
- C. Tunneling creates an encrypted passage for traffic but does not modify IP headers to multiplex multiple devices under one IP address.
Question 53
The SOC team has confirmed a potential indicator of compromise on an endpoint. The team has narrowed the executable file's type to a new trojan family. According to the NIST Computer Security Incident Handling Guide, what is the next step in handling this event?
Show answer and explanation
Correct answer: B. Isolate the infected endpoint from the network
According to NIST Computer Security Incident Handling Guide, after an indicator of compromise is confirmed and the threat is identified (a new trojan), the immediate next step is containment. Isolating the infected endpoint from the network prevents lateral movement, limits damage, and stops the threat from spreading to other systems. This containment action takes priority over detailed forensics, malware research, or impact assessment. While these activities are important, isolation must occur first to prevent further compromise and protect the network infrastructure.
Why the other options are wrong
- A. Forensics analysis is part of the detailed investigation phase but should occur after the immediate threat is contained.
- C. Prioritization is done during the preparation and detection phases; with a confirmed trojan, containment is the immediate action.
- D. Collecting public information on malware behavior is useful for analysis but does not address the active threat on the network.
Question 54
Which metric is used to capture the level of access needed to launch a successful attack?
Show answer and explanation
Correct answer: A. privileges required
Privileges Required is a CVSS metric that measures the level of privileges an attacker must possess before launching a successful attack against a target system. This directly captures how elevated an attacker's access must be.
Why the other options are wrong
- B. User Interaction measures whether the vulnerability requires user action to exploit it, not the attacker's privilege level.
- C. Attack Complexity measures the conditions beyond privilege level that affect exploitation likelihood, not the privilege requirement itself.
- D. Attack Vector describes how the attack is delivered, not the privilege level needed for success.
Question 55
Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?
Show answer and explanation
Correct answer: B. ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16
Wireshark uses the syntax 'ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16' for display filters. The double equals (==) operator specifies comparison, and 'ip.src' and 'ip.dst' are the correct field names for source and destination IP addresses. This filter shows only traffic with both source and destination within the 10.11.0.0/16 subnet, excluding internet traffic.
Why the other options are wrong
- A. Single equals (=) is assignment syntax, not comparison syntax used in Wireshark display filters.
- C. Uses single equals (=) which is incorrect for Wireshark comparison operators.
- D. Uses double equals without the 'ip.' field prefix, which is incorrect Wireshark filter syntax.
Question 56
Which regular expression is needed to capture the IP address 192.168.20.232?
Show answer and explanation
Correct answer: A. ^(?:[0-9]{1,3}\.){3}[0-9]{1,3}
The regex pattern ^(?:[0-9]{1,3}\.){3}[0-9]{1,3} correctly matches IP addresses by requiring exactly three groups of 1-3 digits followed by a dot, then a final group of 1-3 digits. This pattern matches 192.168.20.232 and other valid IP address formats. The caret (^) anchors to the start, the non-capturing group (?:...) repeats three times for the first three octets, and the final [0-9]{1,3} captures the last octet.
Why the other options are wrong
- B. The pattern ^(?:[0-9]{1,3}\.)* uses a wildcard quantifier (*) allowing zero or more occurrences, which does not enforce the specific structure of four octets required for IP addresses.
- C. This option contains invalid regex syntax with an unmatched closing parenthesis and incorrect grouping structure.
- D. The pattern ^([0-9].{3}) only matches four characters starting with a digit, not the full IP address format with proper octet separation.
Question 57
Which two elements are assets in the role of attribution in an investigation? (Choose two.)
Show answer and explanation
Correct answer: C, D. laptop; firewall logs
In attribution investigations, a laptop and firewall logs are both assets that can be analyzed to identify threat actors. Firewall logs provide network activity records that reveal communication patterns, while laptops contain artifacts, logs, and evidence of attacker activities. Both serve as tangible sources of investigative data.
Why the other options are wrong
- A. Context is a supporting element but not an asset itself in the technical sense of attribution investigation.
- B. Session refers to connection states but is not typically classified as a primary asset for attribution purposes.
- E. Threat actor is the subject being investigated, not an asset used during the investigation.
Question 58
What is the impact of encryption?
Show answer and explanation
Correct answer: D. Data is secure and unreadable without decrypting it.
Encryption's primary impact is to render data unreadable without the proper decryption key, ensuring that even if data is intercepted or accessed by unauthorized parties, it cannot be understood or used. This directly addresses the confidentiality aspect of the CIA triad by making data secure and inaccessible to anyone without decryption capability.
Why the other options are wrong
- A. Encryption does not preserve data integrity; integrity is addressed through hashing and digital signatures, not encryption alone.
- B. Encryption actually restricts accessibility to only those with decryption keys, not making data accessible to permitted individuals.
- C. While encryption does protect confidentiality, it does not validate permissions; access control mechanisms handle permission validation separately.
Question 59
What makes HTTPS traffic difficult to monitor?
Show answer and explanation
Correct answer: D. encryption
HTTPS uses encryption to protect data in transit, which obscures the content of network traffic from monitoring tools that attempt to inspect packet payloads. Without decryption capabilities or a trusted certificate, monitoring systems cannot see the actual application-layer data or perform deep packet inspection on encrypted sessions, making it the primary difficulty in monitoring HTTPS traffic.
Why the other options are wrong
- A. SSL interception is a technique used to monitor encrypted traffic, not a problem that makes monitoring difficult.
- B. Packet header size does not inherently make HTTPS difficult to monitor; headers remain visible regardless of encryption.
- C. Signature detection time is a performance consideration, not a fundamental challenge specific to HTTPS monitoring.
Question 60
Which data type is necessary to get information about source/destination ports?
Show answer and explanation
Correct answer: B. session data
Session data contains detailed information about network sessions, including source and destination IP addresses, source and destination ports, protocol information, and session duration. This data is essential for understanding communication flows and identifying which services and ports are being used in network traffic.
Why the other options are wrong
- A. Statistical data provides aggregated summaries and metrics but lacks the granular detail about individual source and destination ports.
- C. Alert data records security events and warnings but does not primarily focus on capturing port-level communication details.
- D. Connectivity data describes whether connections exist but does not specifically provide the port-level information needed for detailed network analysis.
Question 61
Which signature impacts network traffic by causing legitimate traffic to be blocked?
Show answer and explanation
Correct answer: D. false positive
A false positive occurs when a security signature incorrectly identifies legitimate traffic as malicious and blocks it. In this scenario, the signature impacts network traffic by blocking legitimate connections. A false positive is the incorrect flagging of benign activity as a threat. A false negative misses actual attacks. A true positive correctly identifies genuine threats. A true negative correctly permits legitimate traffic.
Why the other options are wrong
- A. A false negative means missing an actual attack, not blocking legitimate traffic
- B. A true positive means correctly detecting an actual attack, but legitimate traffic being blocked indicates incorrect detection
- C. A true negative means correctly allowing legitimate traffic, which contradicts the blocking described in the question
Question 62
Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?
Show answer and explanation
Correct answer: D. management
Management is the NIST IR stakeholder category responsible for coordinating incident response activities across various business units, making decisions to minimize damage, and ensuring reporting to regulatory agencies and other external parties. Management provides the organizational authority and oversight needed to coordinate a comprehensive incident response across different departments.
Why the other options are wrong
- A. CSIRT (Computer Security Incident Response Team) executes technical incident response tasks but does not hold the organizational authority for cross-unit coordination and regulatory reporting.
- B. PSIRT (Product Security Incident Response Team) focuses on product-specific vulnerabilities and patches, not organizational incident coordination.
- C. Public affairs handles external communications but is not responsible for coordinating technical response across business units or reporting to regulatory agencies.
Question 63
An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?
Show answer and explanation
Correct answer: B. nmap -sP 192.168.1.0/24
The -sP flag performs a ping scan that discovers active hosts without conducting a full port scan, making it minimally intrusive and unlikely to trigger IDS alerts. The option -sL performs a DNS resolution only without sending any packets, -sV performs aggressive service version detection which is highly intrusive, and --top-ports scans specific ports which would trigger alerts.
Why the other options are wrong
- A. The --top-ports option scans the most common ports, which generates network traffic and IDS alerts.
- C. The -sL option only performs DNS resolution and does not actually discover live hosts on the network.
- D. The -sV option performs service version detection, which is an intrusive scan that sends many probes and packets.
Question 64
What is indicated by an increase in IPv4 traffic carrying protocol 41?
Show answer and explanation
Correct answer: B. attempts to tunnel IPv6 traffic through an IPv4 network
Protocol 41 is IPv6 encapsulation, used to tunnel IPv6 traffic through IPv4 networks. An increase in this protocol indicates systems are tunneling IPv6 packets inside IPv4 datagrams, often to bypass IPv4-only network controls or policies.
Why the other options are wrong
- A. GRE uses protocol 47, not protocol 41.
- C. Peer-to-peer traffic uses application-layer protocols, not protocol 41 encapsulation.
- D. PPTP uses protocol 47 (GRE) for tunneling, not protocol 41.
Question 65
What is a difference between signature-based and behavior-based detection?
Show answer and explanation
Correct answer: B. Behavior-based identifies behaviors that may be linked to attacks, while signature-based has a predefined set of rules to match before an alert.
Behavior-based detection identifies suspicious activities and patterns of behavior that may be associated with attacks, operating without needing predetermined signatures. Signature-based detection relies on a predefined set of rules or patterns (signatures) that must match before triggering an alert, making it dependent on known threat definitions.
Why the other options are wrong
- A. This reverses the actual definitions of signature-based and behavior-based detection.
- C. Signature-based detection uses known threat signatures, not a vulnerability database specifically. Behavior-based detection uses intelligent analysis, not database lookup.
- D. Behavior-based does not use a vulnerability database; signature-based does not intelligently summarize data. It matches predefined patterns.
Question 66
What are two categories of DDoS attacks? (Choose two.)
Show answer and explanation
Correct answer: A, B. direct; reflected
DDoS (Distributed Denial of Service) attacks are categorized into two main types: direct attacks and reflected attacks. Direct DDoS attacks involve the attacker sending traffic directly to the target from multiple sources. Reflected DDoS attacks involve the attacker sending requests to third-party servers that then reflect traffic toward the actual target, obscuring the attack's origin. Split brain, scanning, and phishing are not categories of DDoS attacks; split brain relates to cluster systems, scanning is reconnaissance, and phishing is a social engineering attack vector.
Why the other options are wrong
- C. Split brain is a clustering and high-availability systems concept, not a DDoS attack category.
- D. Scanning is a reconnaissance technique used to identify targets and vulnerabilities, not a DDoS attack category.
- E. Phishing is a social engineering attack method, not a DDoS attack category.
Question 67
A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?
Show answer and explanation
Correct answer: A. application whitelisting/blacklisting
Application whitelisting and blacklisting is the technology designed to control which applications can or cannot run on hosts. Whitelisting allows only approved applications; blacklisting blocks specific applications. This host-based endpoint technology directly addresses the requirement to block selected applications across corporate PCs. A network firewall operates at network level, not host application level. A host-based IDS detects intrusions but does not block applications. Antivirus focuses on malware detection rather than application blocking.
Why the other options are wrong
- B. Network NGFW operates at the network perimeter and cannot control which applications run on individual hosts
- C. Host-based IDS detects suspicious activity but does not block application execution
- D. Antivirus/antispyware prevents malware but is not designed to block legitimate applications selected by management
Question 68
What is a difference between data obtained from Tap and SPAN ports?
Show answer and explanation
Correct answer: D. Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination.
A network TAP is a hardware device placed on the link itself, so it passes everything from the physical layer, including errored frames, straight to the monitoring device. SPAN (Switched Port Analyzer) is a switch feature that copies traffic from chosen source ports or VLANs to a destination port, so the monitoring device receives the switch's copy of the traffic. That is the difference option D describes.
Why the other options are wrong
- A. This reverses the two: it is a TAP that sits on the link and passes traffic through unaltered, and a TAP does not change response times.
- B. Mirroring traffic from specified ports is what SPAN does, not a TAP, and SPAN delivers the same raw frames rather than more structured data.
- C. SPAN is the weaker option for media errors because the switch drops errored frames before copying, while a TAP sees them and gives more visibility, not less.
Question 69
An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, `File: Clean.` Which regex must the analyst import?
Show answer and explanation
Correct answer: C. File: Clean
The regex pattern `File: Clean` is the correct literal string match for extracting the exact phrase from Cisco device logs. This simple pattern matches the exact text without requiring anchors or capturing groups for a straightforward extraction task.
Why the other options are wrong
- A. The `(.*)` at the end creates an unnecessary capturing group and captures content after the phrase rather than just matching it.
- B. The `^Parent File: Clean$` includes 'Parent' which is not part of the target phrase and uses unnecessary anchors.
- D. The anchors `^` and `$` restrict matching to entire lines, which is overly restrictive for extracting a phrase within log content.
Question 70
Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?
Show answer and explanation
Correct answer: A. integrity
Integrity in CVSS measures unauthorized modification or destruction of data. The scenario describes replacing one bank account number with another, which is a direct modification of data without authorization, making it an integrity violation.
Why the other options are wrong
- B. Confidentiality measures unauthorized disclosure of information; the scenario involves modification, not disclosure.
- C. Availability measures disruption of service or access; the account number replacement doesn't prevent system access or availability.
- D. Scope measures whether a vulnerability impacts components beyond the vulnerable component itself; it's not the primary impact metric here.
Question 71
An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?
Show answer and explanation
Correct answer: B. Run "ps -ef" to understand which processes are taking a high amount of resources
The command ps -ef displays all running processes with extended format including user, PID, CPU usage, memory usage, and command line details. This comprehensive output allows the engineer to identify which specific processes are consuming excessive CPU and memory resources on the server. The -e flag shows all processes and -f provides the full listing format needed for resource analysis.
Why the other options are wrong
- A. The ps -u flag shows processes for a specific user but does not provide the resource consumption details needed to identify high-load processes.
- C. The ps -d flag is not a standard option for decreasing process priority; priority management is done with tools like nice or renice, not ps.
- D. The ps -m flag does not exist as a standard option; it would not map daemons to required processes or show the information needed for this investigation.
Question 72
Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?
Show answer and explanation
Correct answer: C. NetFlow
NetFlow provides flow-level summaries with efficient metadata collection designed specifically for building and analyzing network behavior patterns over time. Its compact format, aggregation capabilities, and low overhead make it ideal for establishing baselines of traffic behavior across extended periods without the volume issues of full packet capture.
Why the other options are wrong
- A. Syslog messages contain event logs but are not optimized for network traffic pattern analysis and baseline building.
- B. Full packet capture generates enormous data volumes impractical for extended period analysis and baseline creation.
- D. Firewall event logs focus on security events and policy violations rather than comprehensive traffic pattern baselining.
Question 73
What is the difference between a threat and an exploit?
Show answer and explanation
Correct answer: C. A threat is a potential attack on an asset, and an exploit takes advantage of the vulnerability of the asset.
A threat is any potential danger to an asset, representing the possibility of harm. An exploit is the actual mechanism or action taken to attack an asset by leveraging a vulnerability. The threat exists as a potential risk, while the exploit is the concrete technique that materializes that threat by taking advantage of a weakness.
Why the other options are wrong
- A. An exploit is not simply an attack path; it is a specific technique or code that leverages a vulnerability, and a threat is more fundamental than just a potential vulnerability.
- B. While exploit and threat relate to attack vectors and paths, this answer conflates the concepts incorrectly rather than distinguishing their fundamental difference.
- D. Neither term is specifically defined as results of system flows or control; they relate to attack methodology and risk respectively.
Question 74
Why is encryption challenging to security monitoring?
Show answer and explanation
Correct answer: B. Encryption is used by threat actors as a method of evasion and obfuscation.
Encryption is challenging for security monitoring because threat actors use it as an evasion and obfuscation technique, preventing security tools from inspecting packet contents and detecting malicious activity within encrypted traffic. This creates blind spots in visibility.
Why the other options are wrong
- A. Encryption analysis is not used by attackers to monitor VPN tunnels; this mischaracterizes the relationship between attackers and encryption.
- C. While encryption does increase CPU processing, this is a performance consideration rather than the primary security monitoring challenge.
- D. Encryption does not introduce larger packet sizes; it typically maintains similar or smaller sizes while rendering content unreadable.
Question 75
Which two components reduce the attack surface on an endpoint? (Choose two.)
Show answer and explanation
Correct answer: A, D. secure boot; restricting USB ports
Secure boot protects the boot process by verifying firmware and bootloader integrity, preventing malicious code from loading at startup, while restricting USB ports removes a physical attack vector and data exfiltration path. Load balancing distributes network traffic rather than reducing endpoint attack surface, audit log levels increase visibility but don't reduce surface, and packet captures are forensic tools that don't reduce surface.
Why the other options are wrong
- B. Load balancing distributes traffic across servers and is a network architecture component, not an endpoint security control.
- C. Increasing audit log levels provides more security visibility and logging but does not reduce the attack surface.
- E. Full packet captures are forensic and monitoring tools; they record activity but do not reduce the attack surface.
Question 76
How does TOR alter data content during transit?
Show answer and explanation
Correct answer: A. It encrypts content and destination information over multiple layers.
Tor encrypts data in multiple layers (onion encryption) and routes traffic through multiple relays, with each layer decrypted at successive nodes. This multi-layered encryption approach protects both the content and destination information as the data transits through the Tor network.
Why the other options are wrong
- B. This describes routing behavior but misses the critical encryption component that protects data.
- C. This incorrectly characterizes Tor as routing through multiple sources rather than multiple relays with layered encryption.
- D. Tor does not spoof destination and source information; it encrypts them through multiple layers instead.
Question 77
Which type of evidence supports a theory or an assumption that results from initial evidence?
Show answer and explanation
Correct answer: D. corroborative
Corroborative evidence supports or confirms a theory or assumption that has already been suggested by initial evidence. It strengthens an existing hypothesis by providing additional supporting information, making it the evidence type that directly results from and validates initial findings.
Why the other options are wrong
- A. Probabilistic evidence deals with probability and statistical likelihood rather than supporting existing theories.
- B. Indirect evidence is circumstantial and requires inference, but doesn't specifically describe evidence that validates an initial theory.
- C. Best evidence refers to the most reliable or original form of evidence available, not corroborating evidence.
Question 78
How does agentless monitoring differ from agent-based monitoring?
Show answer and explanation
Correct answer: D. Agent-based has a possibility to locally filter and transmit only valuable data, while agentless has much higher network utilization.
Agent-based monitoring installs software agents on systems that can perform local data filtering and intelligent preprocessing, allowing them to transmit only relevant or valuable data to the collection point, thereby reducing network overhead. Agentless monitoring must retrieve all data via APIs or other remote methods without local filtering, resulting in substantially higher network utilization since more unfiltered data must be transmitted. This fundamental difference in data processing location directly impacts network bandwidth consumption.
Why the other options are wrong
- A. While API access is a method used in agentless monitoring, WMI is actually used by some agent-based solutions; this oversimplifies the distinction.
- B. Agent-based monitoring typically requires significant deployment overhead to install agents, while agentless is simpler initially; this reverses the actual relationship.
- C. Agent-based monitoring is actually more intrusive as it requires installing software on each system; agentless is less intrusive but requires network access and open ports.
Question 79
Which piece of information is needed for attribution in an investigation?
Show answer and explanation
Correct answer: C. known threat actor behavior
Attribution requires identifying who conducted the attack. Known threat actor behavior is essential for attribution because it allows investigators to match observed tactics, techniques, and procedures (TTPs) to previously documented threat actors. RFC 1918 addresses are private and cannot identify external actors. RDP exposure is a vulnerability, not attribution evidence. RADIUS logs show authentication activity but not threat actor identity.
Why the other options are wrong
- A. Private RFC 1918 addresses cannot be attributed to external threat actors.
- B. RDP exposure describes a vulnerability or misconfiguration, not threat actor identity.
- D. Authentication logs show access patterns but not who the threat actor is.
Question 80
An engineer is analyzing a recent breach where confidential documents were altered and stolen by the receptionist. Further analysis shows that the threat actor connected an external USB device to bypass security restrictions and steal data. The engineer could not find an external USB device. Which piece of information must an engineer use for attribution in an investigation?
Show answer and explanation
Correct answer: A. receptionist and the actions performed
Attribution in an investigation requires identifying who performed the malicious actions and what they did. The receptionist's identity and the actions performed (data alteration and theft) directly establish attribution; they identify the threat actor and their behavioral pattern. Since the USB device cannot be recovered, the analyst must rely on human accountability and action logs rather than physical evidence.
Why the other options are wrong
- B. While stolen data and criticality help assess impact, they do not establish who committed the breach or provide attribution.
- C. The external USB device was not recovered and cannot be used as evidence for attribution in the investigation.
- D. Security restrictions and privilege boundaries document the system design but do not identify who the threat actor is or what they specifically did.
Question 81
At a company party a guest asks questions about the company's user account format and password complexity. How is this type of conversation classified?
Show answer and explanation
Correct answer: D. Social Engineering
Social engineering is the practice of manipulating people into divulging confidential information or performing security-compromising actions. A guest casually asking about user account format and password complexity at a company party is using social engineering to gather sensitive security information in an informal, low-pressure setting. Phishing is email-based deception, password revelation strategy is not a standard attack classification, and piggybacking refers to unauthorized physical access by following authorized personnel.
Why the other options are wrong
- A. Phishing is specifically email-based deception, not casual conversation at a social event.
- B. Password Revelation Strategy is not a recognized attack classification in security frameworks.
- C. Piggybacking involves gaining physical access by following authorized personnel, not gathering information through conversation.
Question 82
What is the difference between the ACK flag and the RST flag?
Show answer and explanation
Correct answer: D. The ACK flag confirms the received segment, and the RST flag terminates the connection.
The ACK (acknowledgment) flag confirms receipt of a data segment by the receiver, while the RST (reset) flag abruptly terminates an existing TCP connection. These are distinct control mechanisms: ACK maintains reliable ordered delivery, while RST forcibly closes the connection.
Why the other options are wrong
- A. The RST flag does not approve connections; it terminates them. The ACK flag does not indicate resend requirements. That is handled by timeout and retransmission logic.
- B. The ACK flag does not mark connections as reliable in isolation, and the RST flag does not specifically indicate TCP Handshake failure.
- C. The RST flag does not approve connections, and the ACK flag does not terminate spontaneous connections.
Question 83
What is obtained using NetFlow?
Show answer and explanation
Correct answer: B. session data
NetFlow is a network monitoring protocol that collects and analyzes flow data: information about conversations between hosts on a network. It captures session-level data including source/destination IP addresses, ports, protocol types, and traffic volume, but does not perform full packet capture. This aggregated session data allows network administrators to understand traffic patterns and network behavior without the overhead of capturing complete packets.
Why the other options are wrong
- A. Full packet capture requires tools like tcpdump or Wireshark, not NetFlow, which works at the flow summary level.
- C. Application logs are generated by applications themselves, not extracted by NetFlow.
- D. NetFlow monitors active traffic flows, not downtime; downtime reports require separate availability monitoring systems.
Question 84
Which regular expression matches "color" and "colour"?
Show answer and explanation
Correct answer: C. colou?r
The ? quantifier makes the single character in front of it optional, matching it zero or one time. In colou?r the optional character is the u, so the pattern matches both 'color' (no u) and 'colour' (one u). The other patterns fail on at least one of the two spellings: colo?ur makes the o optional instead, and the two bracket patterns require at least one digit between 'col' and 'our'.
Why the other options are wrong
- A. colo?ur makes the 'o' optional, not the 'u', so it matches 'colur' and 'colour' but not 'color'.
- B. col[0-8]+our requires one or more digits from 0 to 8 between 'col' and 'our', so it matches neither 'color' nor 'colour'.
- D. col[0-9]+our requires one or more digits between 'col' and 'our', so it matches neither 'color' nor 'colour'.
Question 85
What describes the defense-in-depth principle?
Show answer and explanation
Correct answer: D. isolating guest Wi-Fi from the local network
Defense in depth is a layered security strategy in which multiple, independent controls are placed throughout a network so that if one layer fails, others still provide protection. Isolating guest Wi-Fi from the local network is a classic example of this principle: it creates a segmentation layer that prevents untrusted guest traffic from directly reaching internal, trusted resources, adding an additional barrier beyond perimeter defenses like firewalls. This kind of network segmentation embodies the core idea of defense in depth; using multiple, overlapping layers of protection rather than relying on a single control point.
Why the other options are wrong
- A. Defining workstation installation guidelines relates to configuration management and standardization, not layered security defenses.
- B. Implementing alerts for asset malfunctions is part of monitoring and incident detection, not the layering concept of defense-in-depth.
- C. Categorizing critical assets pertains to asset management and risk prioritization, not the implementation of multiple security layers.
Question 86
Which event artifact is used to identify HTTP GET requests for a specific file?
Show answer and explanation
Correct answer: D. URI
The URI (Uniform Resource Identifier) uniquely identifies the specific file being requested in an HTTP GET request. It contains the path and filename of the resource requested. The destination IP identifies the server, TCP ACK is a protocol mechanism unrelated to request identification, and HTTP status codes are responses, not request identifiers.
Why the other options are wrong
- A. Destination IP identifies the server but not the specific file requested.
- B. TCP ACK is a network protocol acknowledgment, not related to identifying requested files.
- C. HTTP status codes are server responses, not identifiers of which file was requested.
Question 87
What is the difference between inline traffic interrogation and traffic mirroring?
Show answer and explanation
Correct answer: D. Traffic mirroring copies the traffic rather than forwarding it directly to the analysis tools.
Traffic mirroring (also called SPAN or port mirroring) copies traffic to analysis tools without modifying the original traffic flow, allowing non-intrusive inspection. Inline interrogation intercepts and forwards traffic through analysis tools in the data path, potentially modifying or blocking packets.
Why the other options are wrong
- A. This is backwards; mirroring copies traffic, while inline modifies packets before sending them forward.
- B. Inline interrogation typically introduces latency, not faster analysis; the relationship described is inverted.
- C. Inline is actually more complex due to its position in the data path; mirroring is simpler as it operates passively.
Question 88
An engineer received a flood of phishing emails from HR with the source address HRjacobrn@company.com. What is the threat actor in this scenario?
Show answer and explanation
Correct answer: A. sender
The threat actor is the entity performing the attack. In this scenario, someone has spoofed or compromised the HR email account (HRjacobrn@company.com) to send phishing emails. The sender, the entity conducting the attack and sending malicious emails, is the threat actor. The phishing email is the attack vector or tool used by the threat actor, not the threat actor itself.
Why the other options are wrong
- B. The phishing email is the attack mechanism or payload, not the threat actor conducting the attack.
- C. The receiver is the target of the attack, not the threat actor.
- D. HR is the spoofed or compromised identity, but the actual threat actor is the one sending the emails from that address.
Question 89
What is personally identifiable information that must be safeguarded from unauthorized access?
Show answer and explanation
Correct answer: B. driver's license number
A driver's license number is highly sensitive personally identifiable information that uniquely identifies an individual and can be used for identity theft or fraud. It must be strictly safeguarded and is regulated under privacy laws.
Why the other options are wrong
- A. Date of birth alone, while sensitive, is often considered supplementary PII and is less immediately actionable for unauthorized access.
- C. Gender is demographic information but not typically classified as sensitive PII requiring safeguarding from unauthorized access.
- D. Zip code is considered non-sensitive demographic data that may be publicly available and is not strictly regulated as protected PII.
Question 90
A security incident occurred with the potential of impacting business services. Who performs the attack?
Show answer and explanation
Correct answer: A. threat actor
A threat actor is any entity, individual, group, or organization, that performs a security attack with the potential to impact business services. This is the standard terminology used in security to describe whoever conducts the attack, regardless of their motivation or sophistication level.
Why the other options are wrong
- B. A malware author creates malicious code but is not necessarily the one executing attacks against this specific business.
- C. A direct competitor may be a threat actor, but the term is broader and not limited to competitors specifically.
- D. A bug bounty hunter participates in authorized security testing, not in incidents that impact business services without authorization.
Question 91
What is an example of social engineering attacks?
Show answer and explanation
Correct answer: B. receiving an email from human resources requesting a visit to their secure website to update contact information
Social engineering via phishing presents a fabricated request appearing to come from a trusted entity (human resources) directing the target to a fraudulent website to steal credentials or sensitive information. This manipulates human trust and behavior rather than exploiting technical vulnerabilities, exemplifying classic social engineering.
Why the other options are wrong
- A. An unexpected email with an attachment could represent phishing, but without pretexting or impersonation details, it is less clearly social engineering.
- C. A verbal request to someone who knows how to complete a task does not involve deception or manipulation characteristic of social engineering.
- D. A legitimate meeting invitation is normal business communication, not a social engineering attack.
Question 92
What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?
Show answer and explanation
Correct answer: B. MAC is the strictest of all levels of control and DAC is object-based access
MAC (Mandatory Access Control) is the strictest access control model where the system enforces permissions based on labels and clearance levels, while DAC (Discretionary Access Control) is object-based where resource owners have discretion over who can access their objects. MAC provides stronger security guarantees than DAC.
Why the other options are wrong
- A. DAC is controlled by the owner's discretion (correct concept), but MAC is controlled by the system/administrator, making this statement backwards.
- C. DAC is owner-controlled; MAC is administrator/system-controlled, opposite of what this states.
- D. DAC is less strict than MAC; this reverses the relationship between the two models.
Question 93
When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification. Which information is available on the server certificate?
Show answer and explanation
Correct answer: D. server name, trusted CA, and public key
An SSL/TLS server certificate contains the server name (subject), the trusted Certificate Authority that issued it, and the server's public key. The private key is never included in a certificate; it remains secret on the server. Cipher suites are negotiated during the handshake, not stored on the certificate itself.
Why the other options are wrong
- A. The private key is never included in a certificate; it must remain secret on the server.
- B. Cipher suites are negotiated during the TLS handshake, not contained within the certificate.
- C. The certificate does not contain the private key, and cipher suites are not part of the certificate structure.
Question 94
An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide?
Show answer and explanation
Correct answer: A. Recover from the threat.
According to NIST SP 800-61, the incident handling process follows four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activities. The engineer has completed the Detection and Analysis phase by identifying the breach, entry point, threat actor IP, and targeted application. The logical next step is the Containment, Eradication, and Recovery phase, which begins with recovering from the threat by removing the threat actor's access and restoring systems to normal operations. Analysis has already been performed, lessons learned occur later in post-incident activities, and probability reduction is part of the preparation phase.
Why the other options are wrong
- B. Analysis has already been completed; the engineer identified the host, IP address, entry point, and targeted application.
- C. Lessons learned are part of the post-incident phase, which occurs after recovery and eradication are complete.
- D. Reducing probability of similar threats is a preparation phase activity for future incidents, not the next step after containment.
Question 95
An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network. What is the impact of this traffic?
Show answer and explanation
Correct answer: D. user circumvention of the firewall
Traffic from a known TOR exit node indicates a user is actively routing their communications through the TOR network, which allows them to anonymously bypass network security controls and firewall policies. This represents a user circumventing the organization's firewall and security architecture to hide their traffic origin and destination.
Why the other options are wrong
- A. Ransomware communication after infection is one possible consequence, but detecting a TOR exit node does not inherently indicate infection.
- B. Downloading copyrighted content is not the defining characteristic or primary concern of TOR exit node traffic.
- C. While data exfiltration could occur over TOR, the alert specifically indicates circumvention of security controls.
Question 96
What is the difference between a threat and a risk?
Show answer and explanation
Correct answer: A. Threat represents a potential danger that could take advantage of a weakness, while the risk is the likelihood of a compromise or damage of an asset.
A threat is any potential danger or malicious actor that could exploit a weakness or vulnerability in a system. Risk is the likelihood and impact of that threat actually materializing and causing damage to an asset. Threat represents the possibility of harm, while risk quantifies the probability and consequence of that harm occurring. Understanding this distinction is essential for effective security planning and resource allocation.
Why the other options are wrong
- B. Risk is not necessarily 'known and identified' while threats are 'non-identified'; both can be identified or unknown.
- C. Threats are not necessarily intentional, and the characterization of risk as 'unintentional' is imprecise.
- D. This conflates the definitions; threat is not specifically about exposure, and risk is more than just calculation of potential loss.
Question 97
An analyst received a ticket regarding a degraded processing capability for one of the HR department's servers. On the same day an engineer noticed a disabled antivirus software and was not able to determine when or why it occurred. According to the NIST Incident Handling Guide, what is the next phase of this investigation?
Show answer and explanation
Correct answer: A. Analysis
According to NIST SP 800-61, after Detection (discovering indicators like degraded performance and disabled antivirus), the next phase is Analysis. The analyst must investigate and determine what occurred, examine the scope of the incident, and establish whether a confirmed incident exists. Analysis involves deep investigation into the timeline, root causes, extent of compromise, and affected systems. Eradication comes after analysis confirms an incident, Recovery restores systems after eradication, and Detection is the phase that already occurred when the ticket was received.
Why the other options are wrong
- B. Eradication occurs after Analysis confirms an incident; it is premature without thorough investigation.
- C. Detection already occurred when the analyst received the ticket and the engineer noticed the antivirus was disabled.
- D. Recovery is the final phase and only follows after Analysis determines what happened and Eradication removes the threat.
Question 98
An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise. Which kind of evidence is this IP address?
Show answer and explanation
Correct answer: B. corroborative evidence
An IP address from an offline audit log is corroborative evidence because it supports or confirms other evidence about the suspected compromise but is not direct proof by itself. It corroborates the investigation by providing supporting details (the source of the session) that help establish the attack occurred, but cannot independently prove the vulnerability was exploited. Direct evidence would be captured exploit payloads or code execution logs, while this IP address serves to reinforce and validate other findings.
Why the other options are wrong
- A. Best evidence is the most reliable and direct form of evidence; an IP address alone is insufficient and requires corroboration from other sources.
- C. Indirect evidence is circumstantial and inferred; an IP address directly identifies a source location rather than inferring it through logical deduction.
- D. Forensic evidence refers to evidence collected and handled according to forensic procedures; classification by type of evidence (corroborative, direct, etc.) is distinct from forensic handling requirements.
Question 99
Which artifact is used to uniquely identify a detected file?
Show answer and explanation
Correct answer: D. file hash
A file hash (such as MD5, SHA-1, or SHA-256) provides a unique cryptographic fingerprint of a file's contents. Hashes are deterministic and collision-resistant, making them the standard method for uniquely identifying files in security contexts. File timestamps, extensions, and sizes can all change or be duplicated across different files, making them unreliable for unique identification.
Why the other options are wrong
- A. File timestamps can be modified and are not unique identifiers
- B. File extensions can be spoofed or changed and do not uniquely identify content
- C. Multiple different files can have the same size, so size alone does not provide unique identification
Question 100
What is threat hunting?
Show answer and explanation
Correct answer: A. Focusing on proactively detecting possible signs of intrusion and compromise.
Threat hunting is a proactive cybersecurity practice focused on actively searching for, identifying, and detecting signs of intrusion, compromise, or malicious activity that may have already occurred within an organization's networks and systems. Unlike reactive incident response, threat hunting anticipates potential breaches and seeks evidence of sophisticated threats that automated detection systems may have missed. This forward-looking approach aims to discover compromises before they cause significant damage.
Why the other options are wrong
- B. Managing vulnerability assessment reports is part of vulnerability management, a separate defensive function from threat hunting.
- C. Deliberately disrupting servers describes a malicious attack or denial-of-service action, not a defensive threat hunting activity.
- D. Pursuing competitors to infiltrate their systems is corporate espionage or illegal hacking, not legitimate threat hunting within one's own organization.
Question 101
What does cyber attribution identify in an investigation?
Show answer and explanation
Correct answer: D. threat actors of an attack
Cyber attribution is the process of identifying and assigning responsibility for a cyber attack to specific threat actors, groups, or nation-states. The primary purpose of attribution is determining who conducted the attack. The cause addresses why an attack occurred, the exploit addresses the technical method, and vulnerabilities address weaknesses; none of these identify the threat actors themselves.
Why the other options are wrong
- A. Identifying the cause addresses the motivation or origin, not the actor.
- B. Identifying exploits addresses the technical method used, not the actor.
- C. Identifying vulnerabilities addresses system weaknesses, not the actor.
Question 102
Which regex matches only on all lowercase letters?
Show answer and explanation
Correct answer: A. [a-z]+
The regex [a-z]+ matches one or more lowercase letters. The character class [a-z] defines the range from lowercase 'a' to lowercase 'z', and the + quantifier requires one or more characters from that class. Option B uses negation (^) to match anything except lowercase letters. Option C lacks proper regex syntax with the hyphen. Option D uses asterisk and plus quantifiers that would match 'a' zero or more times followed by 'z' one or more times, not a continuous string of lowercase letters.
Why the other options are wrong
- B. The caret [^a-z] negates the match, selecting anything except lowercase letters.
- C. This lacks proper character class syntax and does not form a valid lowercase-only pattern.
- D. This pattern matches 'a' repeated, then 'z' repeated, not a string of lowercase letters.
Question 103
Which two elements are used for profiling a network? (Choose two.)
Show answer and explanation
Correct answer: A, B. session duration; total throughput
Session duration and total throughput are used to profile a network's behavior and characteristics. Session duration reveals traffic patterns and application usage, while total throughput indicates bandwidth utilization and network capacity usage. These metrics provide insight into normal network baselines and help identify anomalies during incident analysis and monitoring.
Why the other options are wrong
- C. Running processes are host-specific attributes, not network profiling elements; they relate to individual system analysis rather than network behavior.
- D. Listening ports are host characteristics that identify services, not network-level profiling metrics.
- E. OS fingerprint identifies the operating system of individual hosts, not network-wide profiling characteristics.
Question 104
What is a difference between an inline and a tap mode traffic monitoring?
Show answer and explanation
Correct answer: C. Inline mode monitors traffic path, examining any traffic at a wire speed, while a tap mode monitors traffic as it crosses the network.
Tap mode monitors traffic as a passive copy sent to monitoring devices, observing traffic as it crosses the network. Inline mode actively sits within the traffic path and examines packets at wire speed, allowing for both monitoring and intervention. Option C correctly contrasts these approaches: tap mode observes the network path passively while inline mode examines traffic actively at wire speed.
Why the other options are wrong
- A. Tap mode does not monitor at highest speed; inline mode does not draw packet paths.
- B. Inline mode monitors traffic continuously including from other devices; tap does not tag traffic.
- D. It is inline mode, not tap mode, that sits in the traffic path, and a tap does not merely track direction; it passes a full copy of the traffic to the monitoring device.
Question 105
Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?
Show answer and explanation
Correct answer: B. SSL Certificate
SSL certificates establish secure HTTPS connections that guarantee both integrity and authenticity of messages through encryption and digital signatures, so that messages cannot be modified in transit without detection and can be verified as coming from a trusted source. Hypertext Transfer Protocol is unencrypted and provides no security. Tunneling and VPNs provide network-level encryption but are not specifically designed for web application message integrity and authenticity.
Why the other options are wrong
- A. HTTP is unencrypted and provides no integrity or authenticity guarantees.
- C. Tunneling alone does not guarantee message integrity and authenticity at the application level.
- D. VPNs provide network-level encryption but are not the standard technology for guaranteeing web application message security.
Question 106
Which HTTP header field is used in forensics to identify the type of browser used?
Show answer and explanation
Correct answer: C. user-agent
The User-Agent HTTP header field contains information about the browser type, version, and operating system used by the client. This is the standard header examined in forensic investigations to identify which browser accessed a resource. The referrer identifies the previous page, host identifies the server, and accept-language indicates language preferences, none of which identify the browser type.
Why the other options are wrong
- A. The referrer header indicates the source page, not the browser type.
- B. The host header specifies the domain name, not browser identification.
- D. The accept-language header reflects language preferences, not browser identification.
Question 107
An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP 800-61?
Show answer and explanation
Correct answer: B. precursor
In NIST SP 800-61 (Computer Security Incident Handling Guide), a precursor is defined as an initial event or indicator that an incident may occur in the future. When the organization receives online threats from a hacktivist group, this constitutes a precursor event that prompts the adjustment of security stance in response to a potential future attack.
Why the other options are wrong
- A. Online assault is not a standard NIST SP 800-61 terminology for classifying incident events.
- C. Trigger refers to the event that activates the incident response process, typically when an actual incident is detected, not a warning of future threats.
- D. Instigator is not a recognized term in NIST SP 800-61 incident classification framework.
Question 108
What is the virtual address space for a Windows process?
Show answer and explanation
Correct answer: D. set of virtual memory addresses that can be used
Virtual address space for a Windows process is the complete set of virtual memory addresses available to that process, which the operating system maps to physical memory as needed. This abstraction allows each process to have its own isolated memory space regardless of actual physical RAM configuration.
Why the other options are wrong
- A. Physical location refers to actual RAM addresses, which is distinct from virtual address space.
- B. Pages residing in physical memory describes resident memory, not the complete virtual address space which includes paged memory.
- C. This describes memory protection features like ASLR or DEP, not virtual address space itself.
Question 109
A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?
Show answer and explanation
Correct answer: A. CD data copy prepared in Windows
CDFS is the CD File System driver used by Windows for optical CD media. An ISO evidence copy saved in CDFS format therefore points to a CD data copy prepared on a Windows system.
Why the other options are wrong
- B. Mac-based systems use HFS or APFS and their own optical drivers, not CDFS.
- C. Linux uses its ISO 9660 driver for CDs, so CDFS does not identify a Linux-prepared copy.
- D. Android does not use CDFS and is not used to prepare CD image evidence.
Question 110
A threat actor penetrated an organization's network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?
Show answer and explanation
Correct answer: D. protocol, source IP, source port destination IP, and destination port
The 5-tuple approach uses five specific network flow identifiers: source IP address, source port, destination IP address, destination port, and protocol. These five elements uniquely identify a network conversation and are the standard way to isolate and group network traffic in logs. Event names, log sources, usernames, and hostnames are metadata but not part of the 5-tuple definition.
Why the other options are wrong
- A. Event name, log source, and username are metadata fields, not part of the 5-tuple network identifier.
- B. Event name and log source are metadata; hostname is not part of the 5-tuple.
- C. Log source and hostname are not part of the 5-tuple; it consists of network flow elements only.
Question 111
What is the relationship between a vulnerability and a threat?
Show answer and explanation
Correct answer: A. A threat exploits a vulnerability
A vulnerability is a weakness or gap in security defenses, while a threat is a potential danger or malicious action. The fundamental relationship is that a threat actor exploits a vulnerability to carry out an attack. Vulnerabilities are the necessary conditions that threats need in order to succeed. This is the core principle underlying risk management and security remediation strategies.
Why the other options are wrong
- B. A vulnerability is not a calculation; vulnerability assessment produces measurements like CVSS scores, but the vulnerability itself is a weakness, not a calculation of loss.
- C. Vulnerabilities do not exploit threats; the relationship works in the opposite direction.
- D. A threat is not a calculation of potential loss; that definition describes risk, not threat.
Question 112
Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?
Show answer and explanation
Correct answer: C. ciphertext-only attack
When a stream cipher like RC4 is reused with the same key, an attacker who possesses two ciphertexts encrypted with that key can XOR them together to eliminate the keystream, leaving only the XOR of the two plaintexts. This allows a ciphertext-only attack where the attacker can recover information about the plaintexts without knowing the key, exploiting the keystream reuse vulnerability.
Why the other options are wrong
- A. Forgery attacks involve creating false messages, not exploiting keystream reuse.
- B. Plaintext-only attacks require known plaintext; this vulnerability works with ciphertext alone.
- D. Meet-in-the-middle attacks are used against certain encryption algorithms with specific key structures, not stream cipher keystream reuse.
Question 113
What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?
Show answer and explanation
Correct answer: A. Tapping interrogation replicates signals to a separate port for analyzing traffic
Traffic tapping replicates signals to a separate monitoring port for analysis without altering the original traffic flow or blocking anything. Inline interrogation sits in-line with traffic and can both detect and block malicious traffic, but tapping is passive and non-blocking. Option A correctly describes tapping as signal replication to a separate port.
Why the other options are wrong
- B. Tapping does not detect or block traffic; it passively copies it for analysis elsewhere.
- C. This describes inline interrogation capabilities, not tapping.
- D. Inline interrogation can block malicious traffic, but this describes only detection without blocking.
Question 114
What is a purpose of a vulnerability management framework?
Show answer and explanation
Correct answer: A. identifies, removes, and mitigates system vulnerabilities
A vulnerability management framework provides a structured, comprehensive approach to identifying vulnerabilities across the organization, removing or patching them, and implementing mitigations to reduce risk. It encompasses the entire lifecycle of vulnerability handling, from discovery through remediation and verification, rather than focusing on a single aspect like scanning or documentation.
Why the other options are wrong
- B. While vulnerability management includes source code review, this describes only one component of a broader framework.
- C. Conducting vulnerability scans is one activity within the framework, not its overarching purpose.
- D. Managing a list of vulnerabilities is a documentation function, not the comprehensive purpose of a framework.
Question 115
What are two social engineering techniques? (Choose two.)
Show answer and explanation
Correct answer: C, E. phishing; pharming
Phishing uses fraudulent emails or messages to trick users into revealing sensitive information or performing harmful actions, while pharming redirects users to fake websites through DNS manipulation or malware to harvest credentials. Privilege escalation is an exploitation technique once access is gained, DDoS is a network-based denial of service attack, and MITM is a network interception technique; none of these are social engineering methods that manipulate human behavior.
Why the other options are wrong
- A. Privilege escalation is a post-exploitation technique to gain higher access levels, not a social engineering method.
- B. DDoS attacks are network-based attacks that overwhelm systems with traffic, not social engineering techniques.
- D. Man-in-the-middle is a network interception attack that captures communications between parties, not a social engineering attack.
Question 116
An organization's security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning. How should the analyst collect the traffic to isolate the suspicious host?
Show answer and explanation
Correct answer: B. by most active source IP
To isolate a suspicious host conducting network scanning, the analyst should collect and filter traffic by the most active source IP address. Network scanning generates high volumes of outbound traffic from a single source to multiple destinations. Identifying the source IP with the most activity directly reveals the scanning host. Application usage, ports, and protocols may vary across different scanning tools and techniques.
Why the other options are wrong
- A. Scanning activity is protocol-agnostic and not tied to specific applications.
- C. Scanners can use multiple ports; filtering by port would not isolate the source host.
- D. Scanners employ various protocols; filtering by protocol alone would not isolate the source.
That was 116 of 462.
The full Cisco 200-201 CCNACBR pack has all 462 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 231 free as one PDF by email. Get the Half Pack →