Question 1

Refer to the exhibit. What should be interpreted from this packet capture?

Accepted Answer

A)  IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 80 of IP address 192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6. 
B)  IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 50272 of IP address 192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6. 
C)  IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 80 of IP address 192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6. 
D)  IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 50272 of IP address 192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6. 
A)  IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 80 of IP address 192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6. 
B)  IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 50272 of IP address 192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6. 
C)  IP address 192.168.122.100/50272/81.179.179.69/80/6 is sending a packet from port 80 of IP address 192.168.122.100 that is going to port 50272 of IP address 81.179.179.69 using IP protocol 6. 
D)  IP address 179.179.69/50272/192.168.122.100/80/6 is sending a packet from port 50272 of IP address 192.168.122.100 that is going to port 80 of IP address 81.179.179.69 using IP protocol 6.

Question 2

A developer is working on a project using a Linux tool that enables writing processes to obtain these required results: If the process is unsuccessful, a negative value is returned. If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process. Which component results from this operation?

Accepted Answer

A)  parent directory name of a file pathname 
B)  process spawn scheduled 
C)  macros for managing CPU sets 
D)  new process created by parent process 
A)  parent directory name of a file pathname 
B)  process spawn scheduled 
C)  macros for managing CPU sets 
D)  new process created by parent process

Question 3

Refer to the exhibit. Which type of log is displayed?

Accepted Answer

A)  IDS 
B)  proxy 
C)  NetFlow 
D)  sys 
A)  IDS 
B)  proxy 
C)  NetFlow 
D)  sys

Question 4

How does certificate authority impact a security system?

Accepted Answer

A)  It authenticates client identity when requesting SSL certificate 
B)  It validates domain identity of a SSL certificate 
C)  It authenticates domain identity when requesting SSL certificate 
D)  It validates client identity when communicating with the server 
A)  It authenticates client identity when requesting SSL certificate 
B)  It validates domain identity of a SSL certificate 
C)  It authenticates domain identity when requesting SSL certificate 
D)  It validates client identity when communicating with the server

Question 5

An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

Accepted Answer

A)  tagged protocols being used on the network 
B)  all firewall alerts and resulting mitigations 
C)  tagged ports being used on the network 
D)  all information and data within the datagram 
A)  tagged protocols being used on the network 
B)  all firewall alerts and resulting mitigations 
C)  tagged ports being used on the network 
D)  all information and data within the datagram

Question 6

When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

Accepted Answer

A)  fragmentation 
B)  pivoting 
C)  encryption 
D)  stenography 
A)  fragmentation 
B)  pivoting 
C)  encryption 
D)  stenography

Question 7

Which two elements are assets in the role of attribution in an investigation? (Choose two.)

Accepted Answer

A)  context 
B)  session 
C)  laptop 
D)  firewall logs 
E)  threat actor 
A)  context 
B)  session 
C)  laptop 
D)  firewall logs 
E)  threat actor

Question 8

An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture the analyst cannot determine the technique and payload used for the communication. Which obfuscation technique is the attacker using?

Accepted Answer

A)  Base64 encoding 
B)  transport layer security encryption 
C)  SHA-256 hashing 
D)  ROT13 encryption 
A)  Base64 encoding 
B)  transport layer security encryption 
C)  SHA-256 hashing 
D)  ROT13 encryption

Question 9

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

Accepted Answer

A)  Modify the settings of the intrusion detection system. 
B)  Design criteria for reviewing alerts. 
C)  Redefine signature rules. 
D)  Adjust the alerts schedule. 
A)  Modify the settings of the intrusion detection system. 
B)  Design criteria for reviewing alerts. 
C)  Redefine signature rules. 
D)  Adjust the alerts schedule.

Question 10

What is a difference between tampered and untampered disk images?

Accepted Answer

A)  Tampered images have the same stored and computed hash. 
B)  Untampered images are deliberately altered to preserve as evidence. 
C)  Tampered images are used as evidence. 
D)  Untampered images are used for forensic investigations. 
A)  Tampered images have the same stored and computed hash. 
B)  Untampered images are deliberately altered to preserve as evidence. 
C)  Tampered images are used as evidence. 
D)  Untampered images are used for forensic investigations.

Question 11

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

Accepted Answer

A)  examination 
B)  investigation 
C)  collection 
D)  reporting 
A)  examination 
B)  investigation 
C)  collection 
D)  reporting

Question 12

Which category relates to improper use or disclosure of PII data?

Accepted Answer

A)  legal 
B)  compliance 
C)  regulated 
D)  contractual 
A)  legal 
B)  compliance 
C)  regulated 
D)  contractual

Question 13

What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

Accepted Answer

A)  Tapping interrogation replicates signals to a separate port for analyzing traffic 
B)  Tapping interrogations detect and block malicious traffic 
C)  Inline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies 
D)  Inline interrogation detects malicious traffic but does not block the traffic 
A)  Tapping interrogation replicates signals to a separate port for analyzing traffic 
B)  Tapping interrogations detect and block malicious traffic 
C)  Inline interrogation enables viewing a copy of traffic to ensure traffic is in compliance with security policies 
D)  Inline interrogation detects malicious traffic but does not block the traffic

Question 14

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

Accepted Answer

A)  A policy violation is active for host 10.10.101.24. 
B)  A host on the network is sending a DDoS attack to another inside host. 
C)  There are two active data exfiltration alerts. 
D)  A policy violation is active for host 10.201.3.149. 
A)  A policy violation is active for host 10.10.101.24. 
B)  A host on the network is sending a DDoS attack to another inside host. 
C)  There are two active data exfiltration alerts. 
D)  A policy violation is active for host 10.201.3.149.

Question 15

Refer to the exhibit. Which event is occurring?

Accepted Answer

A)  A binary named "submit" is running on VM cuckoo1. 
B)  A binary is being submitted to run on VM cuckoo1 
C)  A binary on VM cuckoo1 is being submitted for evaluation 
D)  A URL is being evaluated to see if it has a malicious binary 
A)  A binary named "submit" is running on VM cuckoo1. 
B)  A binary is being submitted to run on VM cuckoo1 
C)  A binary on VM cuckoo1 is being submitted for evaluation 
D)  A URL is being evaluated to see if it has a malicious binary

Question 16

Which security technology allows only a set of pre-approved applications to run on a system?

Accepted Answer

A)  application-level blacklisting 
B)  host-based IPS 
C)  application-level whitelisting 
D)  antivirus 
A)  application-level blacklisting 
B)  host-based IPS 
C)  application-level whitelisting 
D)  antivirus

Question 17

What does cyber attribution identify in an investigation?

Accepted Answer

A)  cause of an attack 
B)  exploit of an attack 
C)  vulnerabilities exploited 
D)  threat actors of an attack 
A)  cause of an attack 
B)  exploit of an attack 
C)  vulnerabilities exploited 
D)  threat actors of an attack

Question 18

What is a benefit of agent-based protection when compared to agentless protection?

Accepted Answer

A)  It lowers maintenance costs 
B)  It provides a centralized platform 
C)  It collects and detects all traffic locally 
D)  It manages numerous devices simultaneously 
A)  It lowers maintenance costs 
B)  It provides a centralized platform 
C)  It collects and detects all traffic locally 
D)  It manages numerous devices simultaneously

Question 19

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

Accepted Answer

A)  application identification number 
B)  active process identification number 
C)  runtime identification number 
D)  process identification number 
A)  application identification number 
B)  active process identification number 
C)  runtime identification number 
D)  process identification number

Question 20

What is the difference between deep packet inspection and stateful inspection?

Accepted Answer

A)  Deep packet inspection is more secure than stateful inspection on Layer 4 
B)  Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7 
C)  Stateful inspection is more secure than deep packet inspection on Layer 7 
D)  Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4 
A)  Deep packet inspection is more secure than stateful inspection on Layer 4 
B)  Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies connection at Layer 7 
C)  Stateful inspection is more secure than deep packet inspection on Layer 7 
D)  Deep packet inspection allows visibility on Layer 7 and stateful inspection allows visibility on Layer 4

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Refer to the exhibit. What should be interpreted from this packet capture?

Refer to the exhibit. Which type of log is displayed?

How does certificate authority impact a security system?

An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

Which two elements are assets in the role of attribution in an investigation? (Choose two.)

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

What is a difference between tampered and untampered disk images?

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

Which category relates to improper use or disclosure of PII data?

What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

Refer to the exhibit. Which event is occurring?

Which security technology allows only a set of pre-approved applications to run on a system?

What does cyber attribution identify in an investigation?

What is a benefit of agent-based protection when compared to agentless protection?

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

What is the difference between deep packet inspection and stateful inspection?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters