Question 1

What is a difference between SIEM and SOAR?

Accepted Answer

B

Explanation: A Security Information and Event Management (SIEM) system's fundamental role is to aggregate and correlate log and event data from various sources across an organization's infrastructure. Its primary goal is to provide centralized visibility and detect anomalies, potential threats, and security incidents by analyzing this data against predefined rules. In contrast, a Security Orchestration, Automation, and Response (SOAR) platform is designed to ingest alerts (often from a SIEM) and automate the subsequent incident response actions. SOAR uses "playbooks" to orchestrate tasks across different security tools, thereby streamlining security operations and reducing manual intervention.

Question 2

What is the role of indicator of compromise in an investigation?

Accepted Answer

B

Explanation: An Indicator of Compromise (IoC) is a piece of forensic data or an artifact observed on a network or host that indicates, with high confidence, that a security intrusion has occurred. The primary role of an IoC is to act as a clue or sign for security analysts, helping them identify potentially malicious activity that warrants further investigation. IoCs are the fundamental building blocks used in intrusion detection, threat hunting, and incident response to uncover security breaches.

Question 3

Which security model assumes an attacker within and outside of the network and enforces strict verification before connecting to any system or resource within the organization?

Accepted Answer

D

Explanation: The Zero Trust model is a security framework built on the principle of "never trust, always verify." It fundamentally assumes that threats can exist both inside and outside the traditional network perimeter. Consequently, it eliminates the concept of a trusted internal network. Every user, device, and application must be strictly authenticated and authorized before being granted access to any resource, regardless of its location. This continuous verification process is enforced for every access request, directly matching the scenario described in the question.

Question 4

Which of these describes SOC metrics in relation to security incidents?

Accepted Answer

A

Explanation: A primary goal of a Security Operations Center (SOC) is to minimize the impact of security incidents. This is measured using key performance indicators (KPIs), which are often time-based. The "time it takes to detect the incident," commonly known as Mean Time to Detect (MTTD), is a critical SOC metric. It measures the average time elapsed from when a security threat first appears in an environment to when the SOC identifies it. A lower MTTD indicates a more effective and efficient security monitoring and detection capability, which is a core function of any SOC.

Question 5

Which type of data collection requires the largest amount of storage space?

Accepted Answer

D

Explanation: Full packet capture (PCAP) is the process of recording all data packets (headers and payload) that pass through a specific network point. This method provides the most granular data for deep forensic analysis but, as a consequence, requires the largest amount of storage. In contrast, alert, transaction, and session data are all forms of metadata or summaries. They extract specific elements from the traffic, resulting in a significantly smaller data volume. For instance, session data like NetFlow only records conversation metadata (e.g., IPs, ports, byte counts), making it orders of magnitude smaller than a full capture of the same traffic.

Question 6

Which option describes indicators of attack?

Accepted Answer

D

Explanation: Indicators of Attack (IoAs) focus on the behaviors and intent of an attacker, signaling an active intrusion is in progress. Malware that reinfects a system minutes after removal is a definitive sign of a persistence mechanism. This demonstrates that an adversary is actively working to maintain access and control over the compromised system. This focus on the attacker's actions (maintaining persistence) is the core characteristic of an IoA, as opposed to a static artifact left behind after an event.

Question 7

What is the difference between deep packet inspection and stateful inspection?

Accepted Answer

D

Explanation: Stateful inspection, also known as stateful packet inspection, operates primarily at the Network (Layer 3) and Transport (Layer 4) of the OSI model. It maintains a state table to track active connections, making decisions based on the context of the traffic flow (e.g., TCP connection states). Deep Packet Inspection (DPI), a more advanced technology often found in Next-Generation Firewalls (NGFWs), goes further by examining the actual data payload of a packet. This allows it to inspect traffic at the Application Layer (Layer 7), identifying specific applications, services, and potential malicious content that a stateful firewall cannot see.

Question 8

What is a scareware attack?

Accepted Answer

D

Explanation: Scareware is a type of malicious software that uses social engineering tactics to cause shock, anxiety, or the perception of a threat. It manipulates users into buying or downloading unnecessary and potentially malicious software. The attack typically involves malicious code that generates alarming pop-up windows designed to look like legitimate system or antivirus alerts. These pop-ups falsely claim the user's computer is infected with viruses or is otherwise compromised, frightening the user into paying for fake removal software, which is itself often malware.

Question 9

How does agentless monitoring differ from agent-based monitoring?

Accepted Answer

D

Explanation: Agent-based monitoring utilizes a software agent installed directly on the monitored host. This agent can perform local data processing, aggregation, and filtering. By analyzing data at the source, it can be configured to transmit only the most critical or relevant events to the central monitoring server. This pre-processing significantly reduces the amount of data sent over the network. In contrast, agentless monitoring typically polls devices remotely using standard protocols (e.g., SNMP, WMI). This process often involves transferring larger, unfiltered datasets, which can result in higher network bandwidth consumption compared to the optimized transmissions from an agent.

Question 10

Refer to the exhibit. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/200-201/page_154_img_1.jpg An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

Accepted Answer

A

Explanation: The Nmap scan output explicitly states, "Not shown: 997 filtered ports." In Nmap terminology, a port state of 'filtered' means that a firewall, router access control list (ACL), or another network filtering device is blocking the port. This prevents Nmap's probes from reaching the port, making it impossible to determine if the port is truly open or closed. The presence of a large number of filtered ports is a classic and strong indication that a firewall is actively protecting the target host by dropping unsolicited packets.

Question 11

What is the difference between the rule-based detection when compared to behavioral detection?

Accepted Answer

B

Explanation: Rule-based detection, also known as signature-based detection, operates using a static set of predefined rules or patterns that correspond to known malicious activities. These rules do not change unless manually updated by an administrator or vendor. In contrast, behavioral detection, or anomaly-based detection, first establishes a baseline of normal network or system activity. It then monitors for deviations from this established baseline. This baseline can adapt and change over time as the system "learns" new normal patterns, making it a dynamic detection method capable of identifying previously unseen threats.

Question 12

How is NetFlow different from traffic mirroring?

Accepted Answer

A

Explanation: The fundamental difference between NetFlow and traffic mirroring lies in the type of data they provide. NetFlow is a telemetry protocol that collects metadata about IP traffic flows. It creates summary records that include details like source/destination IP addresses, ports, protocol, packet/byte counts, and timestamps, but not the actual packet payload. Conversely, traffic mirroring, implemented via features like Cisco's Switched Port Analyzer (SPAN), creates a bit-for-bit copy (clone) of the entire data packet, including the payload. This allows for deep packet inspection and content analysis, whereas NetFlow is used for traffic accounting, security analysis based on communication patterns, and network performance monitoring.

Question 13

An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?

Accepted Answer

C

Explanation: In network security analysis, a session or flow is a unique communication stream between two endpoints. This stream is uniquely identified by the 5-tuple, which consists of five key elements: source IP address, destination IP address, source port number, destination port number, and the transport layer protocol (e.g., TCP, UDP). When a Security Operations Center (SOC) analyst examines logs from firewalls, NetFlow, or intrusion detection systems, they use the 5-tuple to isolate and track a specific conversation from potentially millions of other log entries, enabling precise incident investigation.

Question 14

Why is HTTPS traffic difficult to screen?

Accepted Answer

B

Explanation: HTTPS (Hypertext Transfer Protocol Secure) uses Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL), to create a secure communication channel. The primary function of TLS/SSL is to encrypt the data exchanged between a client and a server. This encryption ensures confidentiality, meaning the payload of the traffic is unreadable to any intermediary device, such as a firewall, proxy, or Intrusion Detection System (IDS). Because the content is scrambled, these security devices cannot inspect it for malware, data exfiltration, or other policy violations without performing complex and resource-intensive decryption procedures.

Question 15

What is an advantage of symmetric over asymmetric encryption?

Accepted Answer

D

Explanation: The primary advantage of symmetric encryption over asymmetric encryption is its computational efficiency, which translates to significantly higher speed. Symmetric algorithms, such as AES, use simpler mathematical operations, allowing them to process large volumes of data much faster than asymmetric algorithms like RSA. This speed makes symmetric encryption ideal for encrypting the bulk of data transmitted during a communication session (e.g., in TLS or IPsec), after a shared key has been securely established, often using a slower asymmetric method.

Free Cisco 200-201 Actual Exam Questions