Question 1

Refer to the exhibit. Which two elements in the table are parts of the 5-tuple? (Choose two.)

Accepted Answer

A)  First Packet 
B)  Initiator User 
C)  Ingress Security Zone 
D)  Source Port 
E)  Initiator IP 
A)  First Packet 
B)  Initiator User 
C)  Ingress Security Zone 
D)  Source Port 
E)  Initiator IP D,E

Question 2

What is the difference between statistical detection and rule-based detection models?

Accepted Answer

A)  Rule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time 
B)  Statistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis 
C)  Statistical detection involves the evaluation of an object on its intended actions before it executes that behavior 
D)  Rule-based detection defines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis 
A)  Rule-based detection involves the collection of data in relation to the behavior of legitimate users over a period of time 
B)  Statistical detection defines legitimate data of users over a period of time and rule-based detection defines it on an IF/THEN basis 
C)  Statistical detection involves the evaluation of an object on its intended actions before it executes that behavior 
D)  Rule-based detection defines legitimate data of users over a period of time and statistical detection defines it on an IF/THEN basis B

Question 3

Which metric is used to capture the level of access needed to launch a successful attack?

Accepted Answer

A)  privileges required 
B)  user interaction 
C)  attack complexity 
D)  attack vector 
A)  privileges required 
B)  user interaction 
C)  attack complexity 
D)  attack vector A

Question 4

An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?

Accepted Answer

A)  The threat actor used a dictionary-based password attack to obtain credentials. 
B)  The threat actor gained access to the system by known credentials. 
C)  The threat actor used the teardrop technique to confuse and crash login services. 
D)  The threat actor used an unknown vulnerability of the operating system that went undetected. 
A)  The threat actor used a dictionary-based password attack to obtain credentials. 
B)  The threat actor gained access to the system by known credentials. 
C)  The threat actor used the teardrop technique to confuse and crash login services. 
D)  The threat actor used an unknown vulnerability of the operating system that went undetected.

Question 5

What makes HTTPS traffic difficult to monitor?

Accepted Answer

A)  SSL interception 
B)  packet header size 
C)  signature detection time 
D)  encryption 
A)  SSL interception 
B)  packet header size 
C)  signature detection time 
D)  encryption

Question 6

What is personally identifiable information that must be safeguarded from unauthorized access?

Accepted Answer

A)  date of birth 
B)  driver's license number 
C)  gender 
D)  zip code 
A)  date of birth 
B)  driver's license number 
C)  gender 
D)  zip code

Question 7

An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise. Which kind of evidence is this IP address?

Accepted Answer

A)  best evidence 
B)  corroborative evidence 
C)  indirect evidence 
D)  forensic evidence 
A)  best evidence 
B)  corroborative evidence 
C)  indirect evidence 
D)  forensic evidence

Question 8

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

Accepted Answer

A)  UDP port to which the traffic is destined 
B)  TCP port from which the traffic was sourced 
C)  source IP address of the packet 
D)  destination IP address of the packet 
E)  UDP port from which the traffic is sourced 
A)  UDP port to which the traffic is destined 
B)  TCP port from which the traffic was sourced 
C)  source IP address of the packet 
D)  destination IP address of the packet 
E)  UDP port from which the traffic is sourced

Question 9

Which incidence response step includes identifying all hosts affected by an attack?

Accepted Answer

A)  detection and analysis 
B)  post-incident activity 
C)  preparation 
D)  containment, eradication, and recovery 
A)  detection and analysis 
B)  post-incident activity 
C)  preparation 
D)  containment, eradication, and recovery

Question 10

A user received a malicious attachment but did not run it. Which category classifies the intrusion?

Accepted Answer

A)  weaponization 
B)  reconnaissance 
C)  installation 
D)  delivery 
A)  weaponization 
B)  reconnaissance 
C)  installation 
D)  delivery

Question 11

Which HTTP header field is used in forensics to identify the type of browser used?

Accepted Answer

A)  referrer 
B)  host 
C)  user-agent 
D)  accept-language 
A)  referrer 
B)  host 
C)  user-agent 
D)  accept-language

Question 12

Refer to the exhibit. What does this output indicate?

Accepted Answer

A)  HTTPS ports are open on the server. 
B)  SMB ports are closed on the server. 
C)  FTP ports are open on the server. 
D)  Email ports are closed on the server. 
A)  HTTPS ports are open on the server. 
B)  SMB ports are closed on the server. 
C)  FTP ports are open on the server. 
D)  Email ports are closed on the server.

Question 13

What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

Accepted Answer

A)  least privilege 
B)  need to know 
C)  integrity validation 
D)  due diligence 
A)  least privilege 
B)  need to know 
C)  integrity validation 
D)  due diligence

Question 14

Refer to the exhibit. In which Linux log file is this output found?

Accepted Answer

A)  /var/log/authorization.log 
B)  /var/log/dmesg 
C)  var/log/var.log 
D)  /var/log/auth.log 
A)  /var/log/authorization.log 
B)  /var/log/dmesg 
C)  var/log/var.log 
D)  /var/log/auth.log

Question 15

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

Accepted Answer

A)  Untampered images are used in the security investigation process 
B)  Tampered images are used in the security investigation process 
C)  The image is tampered if the stored hash and the computed hash match 
D)  Tampered images are used in the incident recovery process 
E)  The image is untampered if the stored hash and the computed hash match 
A)  Untampered images are used in the security investigation process 
B)  Tampered images are used in the security investigation process 
C)  The image is tampered if the stored hash and the computed hash match 
D)  Tampered images are used in the incident recovery process 
E)  The image is untampered if the stored hash and the computed hash match

Question 16

How does an attacker observe network traffic exchanged between two users?

Accepted Answer

A)  port scanning 
B)  man-in-the-middle 
C)  command injection 
D)  denial of service 
A)  port scanning 
B)  man-in-the-middle 
C)  command injection 
D)  denial of service

Question 17

Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

Accepted Answer

A)  forgery attack 
B)  plaintext-only attack 
C)  ciphertext-only attack 
D)  meet-in-the-middle attack 
A)  forgery attack 
B)  plaintext-only attack 
C)  ciphertext-only attack 
D)  meet-in-the-middle attack

Question 18

An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task?

Accepted Answer

A)  Firepower 
B)  Email Security Appliance 
C)  Web Security Appliance 
D)  Stealthwatch 
A)  Firepower 
B)  Email Security Appliance 
C)  Web Security Appliance 
D)  Stealthwatch

Question 19

Which artifact is used to uniquely identify a detected file?

Accepted Answer

A)  file timestamp 
B)  file extension 
C)  file size 
D)  file hash 
A)  file timestamp 
B)  file extension 
C)  file size 
D)  file hash

Question 20

What is the relationship between a vulnerability and a threat?

Accepted Answer

A)  A threat exploits a vulnerability 
B)  A vulnerability is a calculation of the potential loss caused by a threat 
C)  A vulnerability exploits a threat 
D)  A threat is a calculation of the potential loss caused by a vulnerability 
A)  A threat exploits a vulnerability 
B)  A vulnerability is a calculation of the potential loss caused by a threat 
C)  A vulnerability exploits a threat 
D)  A threat is a calculation of the potential loss caused by a vulnerability

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Refer to the exhibit. Which two elements in the table are parts of the 5-tuple? (Choose two.)

What is the difference between statistical detection and rule-based detection models?

Which metric is used to capture the level of access needed to launch a successful attack?

What makes HTTPS traffic difficult to monitor?

What is personally identifiable information that must be safeguarded from unauthorized access?

An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise. Which kind of evidence is this IP address?

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

Which incidence response step includes identifying all hosts affected by an attack?

A user received a malicious attachment but did not run it. Which category classifies the intrusion?

Which HTTP header field is used in forensics to identify the type of browser used?

Refer to the exhibit. What does this output indicate?

What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

Refer to the exhibit. In which Linux log file is this output found?

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

How does an attacker observe network traffic exchanged between two users?

Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task?

Which artifact is used to uniquely identify a detected file?

What is the relationship between a vulnerability and a threat?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters