Cisco CyberOps Review 2

Multiple Choice

One of the objectives of information security is to protect the

CIA of information and systems. What does CIA mean in this

context?

• Confidentiality, integrity, and availability

• Confidentiality, identity, and availability

• Confidentiality, integrity, and authorization

• Confidentiality, identity, and authorization

Multiple Choice

According to RFC

1035, which transport protocol is

recommended for use with DNS queries?

• Transmission Control Protocol

• Reliable Data Protocol

• Hypertext Transfer Protocol

• User Datagram Protocol

Multiple Choice

Which term represents the chronological record of how

evidence was collected, analyzed, preserved, and transferred?

• Chain of evidence

• Evidence chronology

• Chain of custody

• Record of safekeeping

Multiple Choice

In computer security, what information does PHI describe?

• Private host information

• Protected health information

• Personal health information

• Protected host information

Multiple Choice

Which protocol maps IP network addresses to MAC hardware

addresses so that IP packets can be sent across networks?

• Internet Control Message Protocol

• Address Resolution Protocol

• Session Initiation Protocol

• Transmission Control Protocol/Internet Protocol

Multiple Choice

Which term represents a weakness in a system that could lead

to a system compromise?

• Vulnerability

• Threat

• Exploit

• Risk

Multiple Select

Which two tasks can be performed by analyzing the logs

of a traditional stateful firewall? (Choose two.)

• Confirm the timing of network connections differentiated by

  the TCP 5 tuple.

• Audit applications used on a social networking website.

• Determine user IDs involved in an instant message exchange.

• Map internal private IP addresses to dynamically translated

  external public IP addresses.

• Identify a malware variant carried over an SMTP connection.

Multiple Choice

Based on which statement does the discretionary access control

security model grant or restrict access?

• Discretion of the system administrator

• Security policy defined by the owner of an object

• Security policy defined by the system administrator

• Role of a user within an organization

Multiple Choice

Which security monitoring data type is associated with

application server logs?

• Alert data

• Statistical data

• Session data

• Transaction data

Multiple Choice

Which activity may be an example of social engineering?

• Receiving a call from the IT department asking you to verify

  your username/password to maintain your account

• Receiving an invitation to your department s weekly WebEx

  meeting

• Sending a verbal request to an administrator to change the

  password of an account the administrator recognizes

• Receiving an email from MR requesting that you visit the

  secure HR website and update your contract information

Multiple Choice

Which of the following describes the Zero Trust model?

• A unique trust model that establishes an encrypted

  connection between devices in a private network

• A model designed to protect systems by requiring

  authentication for any device or person trying to access

  the network

• A model that creates a blacklist that includes all devices

  that are not allowed to access resources

• None of the above

Multiple Choice

Which of the following is not related to SIEM system activity?

• Monitoring

• Service privileges

• Incident response and log auditing

• Total traffic encryption

Multiple Choice

In security terms, which of the following describes the

principle of least privilege (POLP)?

• Maintains regular network traffic to avoid overloads

• Enterprise data management system

• Restricts user permissions to the minimum required

  for their work

• Keeps computing systems up to date to improve

  protection

Multiple Choice

Which of the following is the correct definition of threat

actors in cybersecurity?

• A person or group of people trying to perform malicious

  acts against organizations, whether unintentionally or

  intentionally

• A very strong hacking tool that helps commit malicious

  acts against organizations

• Any malicious activity that occurs on mobile devices

• Offensive security professionals who are experts in

  attacking systems and breaking through defenses

Multiple Choice

Which of the following describes the run book automation (RBA)?

• A system designed to enrich the IT department s knowledge

  of innovations in the field

• External hardware designed to protect enterprise computing

  systems by alerting the IT department about changes

• Maps internal private IP addresses to dynamically translated

  external public IP addresses

• A technology used to automate IT operations management

Multiple Choice

Which of the following describes the Threat Intelligence

Platform (TIP)?

• A platform that provides testing environments for

  unknown threats

• Hardware that is installed on enterprise computers to

  provide updates about security threats

• A platform that gathers raw data to produce useable

  information for automated security control systems

• A unique trust platform that creates an encrypted

  connection between devices in a private network

Multiple Choice

Which of the following describes SOAR?

• Helps improve enterprise networking processes by speeding

  up network traffic

• Collects data on security threats from a variety of sources and

  responds to security incidents without human assistance

• Collects data about user activity in the organization and

  provides remote help for errors

• A cybersecurity teamwork method for responding to events

Multiple Choice

Which of the following represents the use of a vulnerability

in a system that can help hackers breach a system?

• Exploit

• Threat

• Zero trust

• Vulnerability

Multiple Choice

Which of the following describes Defense in Depth (

DiD )?

• A c ertification valued by cybersecurity professionals

• Software designed to help a cybersecurity department

  receive updates on the organization s security systems

• A platform that provides testing environments for unknown

  threats

• A series of layered protection mechanisms used to protect

  important data and information

Multiple Choice

Which of the following represents an access control model that

enables users to perform activities based on the permissions

assigned to their roles?

• Nondiscretionary access control

• Role-based access control

• Time-based access control

• Rule-based access control

Multiple Choice

Which of the following describes a type of security access

control that grants or restricts object access via policies

determined by the object s owner?

• Rule based access control

• Nondiscretionary access control

• Discretionary access control

• Mandatory access control

Multiple Choice

For which of the following access control models is the

main purpose preserving the confidentiality of data?

• Mandatory access control

• Role-based access control

• Nondiscretionary access control

• Time-based access control

Multiple Choice

Which of the following refers to disassembling an object to see

how it works and to study its structure and behavior?

• Threat actor

• Threat hunting

• Reverse engineering

• Malware analysis

Multiple Select

Stateful and traditional firewalls can analyze packets and judge them

against a set of predetermined rules called access control lists (ACLs).

Which of the following elements do they inspect within a packet?

(Choose two.)

• Session headers

• NetFlow flow information

• Source and destination ports and IP addresses

• Protocol information

Multiple Select

Which of the following are Layer

2 network attacks?

(Choose three.)

• ARP attack

• Brute force attack

• Spoofing attack

• DDoS attack

• VLAN hopping

Multiple Choice

Which definition of Windows Registry is correct?

• A set of pages that currently reside in physical memory

• A basic unit to which the operating system allocates

  processor time

• A set of virtual memory addresses

• A database that stores low-level settings for the operating

  system

Multiple Choice

While viewing packet capture data, you notice that an IP is

sending and receiving traffic for multiple devices by modifying

the IP header. Which of the following makes this behavior

possible?

• TOR

• NAT

• Encapsulation

• Tunneling

Multiple Choice

Which is the correct definition of an antivirus program?

• A program used to detect and remove unwanted malicious

  software from the system

• A program that provides real-time analysis of security alerts

  generated by network hardware and applications

• A program that scans a running application for vulnerabilities

• Rules that allow network traffic to pass in and out

Multiple Choice

Which type of attack occurs when a botnet is used to transmit

requests from an NTP server to overwhelm the target?

• On-Path

• Denial of Service

• Distributed Denial of Service

• Replay

Multiple Choice

In NetFlow records, which flags indicate that an HTTP connection

was stopped by a security appliance, such as a firewall, before it

could be fully established?

• ACK

• SYN ACK

• RST

• PSH, ACK

Multiple Select

Which of the following terms represent types of cross-site

scripting attacks? (Choose two.)

• Directed

• Encoded

• Stored

• Reflected

• Cascaded

Multiple Choice

If a router has four interfaces and each interface is connected to four

switches, how many broadcast domains are present on the router?

• 1

• 2

• 4

• 8

Multiple Choice

Which cryptographic key is contained in an X.

509 certificate?

• Symmetric

• Public

• Private

• Asymmetric

Multiple Choice

Which of the following is the correct definition of

tcpdump

• A program used for sniffing and filtering network traffic

• A program used to detect and remove unwanted malicious

  software from the system

• A program used to ensure the privacy of a certificate

• Technology used to automate IT operation management

Multiple Select

Which of the following does NetFlow use to determine if

traffic belongs to the same flow? (Select three.)

• Port numbers

• MAC address

• IP address

• Interface name

Multiple Choice

Which of the following is an advantage of NGFW over a firewall?

• Dynamic packet filtering

• Filtering packets based on applications

• Static packet filtering

• VPN support

Multiple Choice

Which type of attack can a traditional firewall protect

a system against?

• Dumpster diving

• Denial of Service (DoS)

• Phishing

• Shoulder surfing

Multiple Choice

Which of the following describes the advantages of application

visibility and control?

• Applications and traffic in the network are controlled to

  protect assets against attacks and manage bandwidth.

• All documents are encrypted with a private key.

• Establishes a platform to test environments for unknown

  threats

• Provides a database that stores low level settings for the

  operating system

Multiple Choice

Which of the following refers to data that web content

filtering provides?

• Information about the volume of computer storage usage

• Data about existing threats on the network

• Reports providing visibility of actual blocks and web usage

• Reports pertaining to additional tools running online

Multiple Choice

Which of the following refers to data that email content

filtering provides?

• In-depth analysis of information traffic

• A report on the remaining storage volume for email use

• Information about contacts frequently communicated with

  via email

• Probability that messages are legitimate or spam

Multiple Choice

Which of the following describes the effect of encryption on data?

• Optimizes data traffic

• Scrambles a message or information so that only authorized

  parties can access it

• Ensures that information is not lost along the way and data is

  transferred more efficiently and securely

• Compresses information and saves storage space

Multiple Choice

Which of the following describes the effect of encapsulation on data?

• Hides an object from unwanted access

• Ensures that sent or received information is correct

• Ensures that no information leakage can occur

• Checks if invalid characters are used

Multiple Choice

Which of the following describes the benefit of using a load balancer?

• In depth analysis of information traffic

• Encrypts all data with a private key

• Improves service availability and helps prevent downtime

• Stores low level settings for the operating system

Multiple Choice

Which of the following is a code injection technique that launches

malicious statements via input fields?

• DDoS

• SQLi

• Brute-force

• SSRF

Multiple Choice

Which of the following is an attack in which the attacker secretly

relays and possibly alters communication between two parties?

• XSS

• SQLi

• Brute-force

• MITM

Multiple Choice

Which of the following is an attack in which multiple systems flood

the bandwidth?

• Brute-force

• SQLi

• DDoS

• XSS

Multiple Choice

Which of the following allows you to create a secure connection to

another network over the internet?

• VPN

• Proxy server

• Proxy chains

• None of the above

Multiple Choice

Which of the following is a technique used by cybercrooks to trick

users into revealing confidential information?

• SQLi

• Social engineering

• MITM

• DDoS

Multiple Choice

Which of the following represents a mechanism that allows

users to protect their privacy against a common form of

internet surveillance known as traffic analysis?

• Access control list

• TOR

• tcpdump

• NetFlow

Multiple Choice

Which of the following is an attack that exploits a vulnerable

application and executes commands on a remote host?

• MITM

• Command injection

• SQLi

• XSS

Multiple Choice

Which of the following is

most commonly used in PPTP,

L 2 TP/IPsec, SSTP, and OpenVPN?

• Tunneling

• STP

• P2P

• PAT

Multiple Choice

Which of the following uses a set of rules that filter network traffic

and can be configured on network devices with packet filtering

capabilities, such as routers and firewalls?

• Next-gen firewall

• NetFlow

• Web content filtering

• Access control list

Multiple Select

Which of the following are elements of X.509 certificates?

(Choose two.)

• Last name sign

• Signature algorithm ID

• Serial name

• Version number

Multiple Choice

Which of the following is a process that allows two computers

to use the same cryptographic algorithm?

• X.509

• Cipher suite

• Key exchange

• PKCS

Multiple Choice

Which of the following is an IDS that monitors and analyzes

data while logging malicious behavior?

• Host based intrusion detection

• Windows Defender

• Wireshark

• Network based intrusion detection

Multiple Choice

Which of the following is software that runs on an individual

computer to protect it from viruses and malware and to control the

spread of harmful infections throughout the network?

• Host-based intrusion detection

• Host-based firewall

• Application-level allow/deny listing

• System-based sandboxing

Multiple Choice

Which of the following is a safe, isolated environment that

replicates an end-user operating environment within which code

can be run, observed, and rated based on activity rather than

attributes?

• Application-level allow/deny listing

• Host-based firewall

• Host-based intrusion detection

• Systems-based sandboxing

Multiple Choice

Which of the following is the practice of specifying an index of

approved software applications or executable files that are

permitted to be present and active on a computer system?

• Application-level deny listing

• Systems-based sandboxing

• Application-level allow listing

• Host-based firewall

Multiple Choice

Which of the following describes a situation in which an attacker

can use injected scripts to change the content of a website or even

redirect the browser to another webpage that, for example,

contains malicious code?

• Cross-site scripting

• SQL Injection

• DDoS

• Command injection

Multiple Choice

Which of the following occurs when data exceeds its limits

and overwrites memory locations?

• MITM

• Command injection

• Buffer overflow

• DDoS

Multiple Choice

Which of the following describes a computer program designed to

infiltrate and damage a computer without user interaction?

• Malware

• Cross-site scripting

• Buffer overflow

• MITM

Multiple Choice

Which of the following describes malware in which rogue software

code effectively holds a user s computer hostage until a fee is paid?

• DDoS

• Ransomware

• SQL injection

• Command injection

Multiple Choice

A user reports difficulty accessing certain external web pages. When

examining traffic to and from the external domain in full packet

captures, you notice many SYNs that have the same sequence

number, source, and destination IP address but different payloads.

Which of the following could possibly explain the situation?

• Insufficient network resources

• Failure of full packet capture solution

• Misconfiguration of a web filter

• TCP injection

Multiple Choice

Which tool is commonly used by threat actors on a webpage to

take advantage of software vulnerabilities on a system and spread

malware?

• Exploit kit

• Rootkit

• Vulnerability kit

• Script kiddie kit

Multiple Choice

Which of the following represents the practice of giving employees

only permissions necessary to perform their specific role within an

organization?

• Integrity validation

• Due diligence

• Need to know

• Least privilege

Multiple Choice

What may be responsible for making security monitoring

for HTTPS traffic difficult?

• Encryption

• Large packet headers

• Signature detection takes longer

• SSL interception

Multiple Choice

Which directory is commonly used in Linux systems to store log

files, including syslog and Apache access logs?

• /etc/log

• /root/log

• /lib/log

• /var/log

Multiple Choice

Which definition of the IIS log parser tool is correct?

• A module for IIS that allows you to log into a database

• A data source control to connect to your data source

• A powerful, versatile tool that makes it possible to run

  SQL like queries in log files

• A powerful, versatile tool that verifies the integrity of

  log files

Multiple Choice

Which definition of the virtual address space for a

Windows process is true?

• Actual physical location of an object in memory

• A set of virtual memory addresses the process can use

• A set of pages that currently reside in physical memory

• A system level memory protection feature built into the

  operating system

Multiple Choice

Which situation indicates application-level allow listing

• Allow everything and deny specific executable files

• Allow specific executable files and deny other executable files

• Daily writing of application-based attacks on a whiteboard

• Allow specific files and deny everything else

Multiple Choice

If a web server accepts input from the user and passes it

to a Bash shell, to which attack method is it vulnerable?

• Input validation

• Hash collision

• Command injection

• Integer overflow

Multiple Choice

Where is a host

based intrusion detection system located?

• On a particular endpoint as an agent or desktop application

• On a dedicated proxy server monitoring egress traffic

• On a span switch port

• On a tap switch port

Multiple Choice

Which of the following describes a situation in which a virus

scanner identifies a file as a virus, when it isn t really a virus,

and then tries to delete it?

• True positive

• False negative

• True negative

• False positive

Multiple Choice

Which of the following is true if the IDS identifies activity as

an attack and the activity is actually an attack?

• True positive

• False negative

• True negative

• False positive

Multiple Choice

Which of the following is the case when an IDS does not

identify an actual attack?

• True positive

• False negative

• True negative

• False positive

Multiple Select

Which of the following are Cisco cloud security solutions?

(Choose two.)

• CloudDLP

• OpenDNS

• CloudLock

• CloudSLS

Multiple Select

What are the advantages of full

duplex transmission mode,

as opposed to half duplex mode? (Select all correct answers.)

• Each station can transmit and receive at the same time.

• It avoids collisions.

• It makes use of backoff time.

• It uses a collision avoidance algorithm to transmit data.

Multiple Choice

Which of the following metrics can measure the effectiveness of a

runbook?

• Mean time to repair (MTTR)

• Mean time between failures (MTBF)

• Mean time to discover a security incident

• All of the above

Multiple Choice

Which technology allows

a large number of private IP addresses

to be represented by a smaller number of public IP addresses?

• NAT

• NTP

• RFC 1631

• RFC 1918

Multiple Select

Which features must a next

generation firewall include?

(Choose two.)

• Data mining

• Host-based antivirus

• Application visibility and control

• Security information and event management

• Intrusion detection system

Multiple Choice

Which type of attack occurs when an attacker is successful in

eavesdropping on a conversation between two IPS phones?

• Replay

• On-Path

• Dictionary

• Known plaintext

Multiple Choice

Which network device is used to separate broadcast domains?

• Router

• Repeater

• Switch

• Bridge

Multiple Choice

Which identifier is used to describe the application or process

that submits a log message?

• Action

• Selector

• Facility

• Priority

Multiple Choice

Which security monitoring data type requires the most storage space?

• Full packet capture

• Transaction data

• Statistical data

• Session data

Multiple Select

Which of the following protocols are used for email?

(Choose two.)

• NTP

• DNS

• HTTP

• IMAP

• SMTP

Multiple Choice

Which of the following is the maximum size of an IPv4 header?

• 32 bytes

• 60 bytes

• 64 bytes

• 20 bytes

Multiple Choice

Which of the following is a disadvantage of a

Brute force attack?

• Most passwords today are complex.

• The password may not be in the list or dictionary.

• The attack requires a lot of time and resources to succeed.

• Brute force can only occur online.

Multiple Choice

While analyzing the network, we notice aggressive traffic

in the ICMP protocol. Which of the following attacks could

be the cause?

• Ping Flood

• Brute force

• SQLi

• XSS

Multiple Choice

As an SOC analyst, Tom is suspicious that an On Path attack is

underway. Which of the following traffic protocols should Tom

investigate?

• ICMP

• POP3

• ARP

• IPv6

Multiple Choice

Which of the following refers to a situation in which computers

in an organization are redirected to false websites?

• SQLi

• XSS

• DDoS

• DNS Spoofing

Multiple Choice

Which property of information security does encryption support?

• Sustainability

• Integrity

• Confidentiality

• Availability

Multiple Choice

Which of the following encryption algorithms is the strongest?

• AES

• CES

• DES

• 3DES

Multiple Choice

Which statement about digitally signing a document is true?

• The document is hashed, and then the document is encrypted

  with a private key.

• The document is hashed, and then the hash is encrypted with

  a private key.

• The document is encrypted, and then the document is hashed

  with a public key.

• The document is hashed, and then the document is encrypted

  with a public key.

Multiple Choice

Which of the following hash algorithms is the weakest?

• SHA-512

• RSA 4096

• SHA-1

• SHA-256

Multiple Choice

Which definition of a fork in Linux is true?

• Daemon to execute scheduled commands

• Parent directory name of a file path name

• Macros for manipulating CPU sets

• New process created by a parent process

Multiple Select

Which two actions are valid uses of public key infrastructure?

(Choose two.)

• Ensuring the privacy of a certificate

• Revoking the validation of a certificate

• Validating the authenticity of a certificate

• Creating duplicate copies of a certificate

• Changing ownership of a certificate

Multiple Choice

In which of the following cases should an employee

return his laptop to the organization?

• When changing to a different role

• Upon termination of employment

• As described in the asset return policy

• When the lease for the laptop expires

Multiple Choice

What is a trunk link used for?

• To transfer traffic of multiple virtual LANs

• To connect more than two switches

• To enable the Spanning Tree Protocol

• To encapsulate Layer 2 frames

Multiple Choice

At which OSI layer does a router typically operate?

• Transport

• Network

• Data link

• Application

Multiple Choice

Cisco pxGrid has a unified framework with an open API designed in

a hub and spoke architecture. pxGrid is used to enable the sharing

of contextual-based information from which devices?

• From a Cisco ASA to the Cisco OpenDNS service

• From a Cisco ASA to the Cisco WSA

• From a Cisco ASA to the Cisco FMC

• From a Cisco ISE session directory to other policy network

  systems, such as Cisco IOS devices and the Cisco ASA

Multiple Select

Which of the following answers relate to the preparation phase?

(Choose more than one.)

• Smartphones that are available for emergency communication

• Communication and coordination mechanisms in case of the

  failure of one mechanism

• A secure storage facility

• None of the above