[Q124-Q147] Ensure Success With Updated Verified 200-201 Exam Dumps [2023] : Actual Test Materials : http://blog.actualtests4sure.com

NEW QUESTION 124
Which are two denial-of-service attacks? (Choose two.)

TCP connections

ping of death

man-in-the-middle

code-red

UDP flooding

NEW QUESTION 125
What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

least privilege

need to know

integrity validation

due diligence

NEW QUESTION 126
Refer to the exhibit.

What should be interpreted from this packet capture?

81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol.

192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol.

192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol.

81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.

NEW QUESTION 127
Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

forgery attack

plaintext-only attack

ciphertext-only attack

meet-in-the-middle attack

NEW QUESTION 128
Refer to the exhibit.

Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.

NEW QUESTION 129
In a SOC environment, what is a vulnerability management metric?

code signing enforcement

full assets scan

internet exposed devices

single factor authentication

NEW QUESTION 130
Refer to the exhibit.

An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server Which display filters should the analyst use to filter the FTP traffic?

dstport == FTP

tcp.port==21

tcpport = FTP

dstport = 21

NEW QUESTION 131
What is a difference between SIEM and SOAR?

SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

SlEM’s primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

SOAR’s primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

NEW QUESTION 132
What is a benefit of agent-based protection when compared to agentless protection?

It lowers maintenance costs

It provides a centralized platform

It collects and detects all traffic locally

It manages numerous devices simultaneously

NEW QUESTION 133
A threat actor penetrated an organization’s network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?

event name, log source, time, source IP, and host name

protocol, source IP, source port, destination IP, and destination port

event name, log source, time, source IP, and username

protocol, log source, source IP, destination IP, and host name

NEW QUESTION 134
Refer to the exhibit.

Which type of log is displayed?

IDS

proxy

NetFlow

sys

NEW QUESTION 135
What is a difference between inline traffic interrogation and traffic mirroring?

Inline inspection acts on the original traffic data flow

Traffic mirroring passes live traffic to a tool for blocking

Traffic mirroring inspects live traffic for analysis and mitigation

Inline traffic copies packets for analysis and security

NEW QUESTION 136
One of the objectives of information security is to protect the CIA of information and systems.
What does CIA mean in this context?

confidentiality, identity, and authorization

confidentiality, integrity, and authorization

confidentiality, identity, and availability

confidentiality, integrity, and availability

NEW QUESTION 137
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

NEW QUESTION 138
Syslog collecting software is installed on the server For the log containment, a disk with FAT type partition is used An engineer determined that log files are being corrupted when the 4 GB tile size is exceeded. Which action resolves the issue?

Add space to the existing partition and lower the retention penod.

Use FAT32 to exceed the limit of 4 GB.

Use the Ext4 partition because it can hold files up to 16 TB.

Use NTFS partition for log file containment

NEW QUESTION 139
Drag and drop the uses on the left onto the type of security system on the right.

NEW QUESTION 140
Which HTTP header field is used in forensics to identify the type of browser used?

referrer

host

user-agent

accept-language

NEW QUESTION 141
What ate two categories of DDoS attacks? (Choose two.)

split brain

scanning

phishing

reflected

direct

NEW QUESTION 142
Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

NetScout

tcpdump

SolarWinds

netsh

NEW QUESTION 143
A user received a malicious attachment but did not run it.
Which category classifies the intrusion?

weaponization

reconnaissance

installation

delivery

NEW QUESTION 144
What is a difference between data obtained from Tap and SPAN ports?

Tap mirrors existing traffic from specified ports, while SPAN presents more structured data for deeper analysis.

SPAN passively splits traffic between a network device and the network without altering it, while Tap alters response times.

SPAN improves the detection of media errors, while Tap provides direct access to traffic with lowered data visibility.

Tap sends traffic from physical layers to the monitoring device, while SPAN provides a copy of network traffic from switch to destination

NEW QUESTION 145
An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.
Which kind of evidence is this IP address?

best evidence

corroborative evidence

indirect evidence

forensic evidence

NEW QUESTION 146
At which layer is deep packet inspection investigated on a firewall?

internet

transport

application

data link

NEW QUESTION 147
What does cyber attribution identify in an investigation?

exploit of an attack

threat actors of an attack

vulnerabilities exploited

cause of an attack

[Q124-Q147] Ensure Success With Updated Verified 200-201 Exam Dumps [2023]

200-201 Details