Question 1

Which two components reduce the attack surface on an endpoint? (Choose two.)

Accepted Answer

A)  secure boot 
B)  load balancing 
C)  increased audit log levels 
D)  restricting USB ports 
E)  full packet captures at the endpoint 
A)  secure boot 
B)  load balancing 
C)  increased audit log levels 
D)  restricting USB ports 
E)  full packet captures at the endpoint

Question 2

Which event is user interaction?

Accepted Answer

A)  gaining root access 
B)  executing remote code 
C)  reading and writing file permission 
D)  opening a malicious file 
A)  gaining root access 
B)  executing remote code 
C)  reading and writing file permission 
D)  opening a malicious file

Question 3

An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

Accepted Answer

A)  nmap --top-ports 192.168.1.0/24 
B)  nmap -sP 192.168.1.0/24 
C)  nmap -sL 192.168.1.0/24 
D)  nmap -sV 192.168.1.0/24 
A)  nmap --top-ports 192.168.1.0/24 
B)  nmap -sP 192.168.1.0/24 
C)  nmap -sL 192.168.1.0/24 
D)  nmap -sV 192.168.1.0/24

Question 4

When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification. Which information is available on the server certificate?

Accepted Answer

A)  server name, trusted subordinate CA, and private key 
B)  trusted subordinate CA, public key, and cipher suites 
C)  trusted CA name, cipher suites, and private key 
D)  server name, trusted CA, and public key 
A)  server name, trusted subordinate CA, and private key 
B)  trusted subordinate CA, public key, and cipher suites 
C)  trusted CA name, cipher suites, and private key 
D)  server name, trusted CA, and public key

Question 5

Which evasion technique is a function of ransomware?

Accepted Answer

A)  extended sleep calls 
B)  encryption 
C)  resource exhaustion 
D)  encoding 
A)  extended sleep calls 
B)  encryption 
C)  resource exhaustion 
D)  encoding

Question 6

Refer to the exhibit. Which technology generates this log?

Accepted Answer

A)  NetFlow 
B)  IDS 
C)  web proxy 
D)  firewall 
A)  NetFlow 
B)  IDS 
C)  web proxy 
D)  firewall

Question 7

Which technology should be used to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes?

Accepted Answer

A)  AWS 
B)  IIS 
C)  Load balancer 
D)  Proxy server 
A)  AWS 
B)  IIS 
C)  Load balancer 
D)  Proxy server

Question 8

How is attacking a vulnerability categorized?

Accepted Answer

A)  action on objectives 
B)  delivery 
C)  exploitation 
D)  installation 
A)  action on objectives 
B)  delivery 
C)  exploitation 
D)  installation

Question 9

Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?

Accepted Answer

A)  2317 
B)  1986 
C)  2318 
D)  2542 
A)  2317 
B)  1986 
C)  2318 
D)  2542

Question 10

What does an attacker use to determine which network ports are listening on a potential target device?

Accepted Answer

A)  man-in-the-middle 
B)  port scanning 
C)  SQL injection 
D)  ping sweep 
A)  man-in-the-middle 
B)  port scanning 
C)  SQL injection 
D)  ping sweep

Question 11

At which layer is deep packet inspection investigated on a firewall?

Accepted Answer

A)  internet 
B)  transport 
C)  application 
D)  data link 
A)  internet 
B)  transport 
C)  application 
D)  data link

Question 12

Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

Accepted Answer

A)  src=10.11.0.0/16 and dst=10.11.0.0/16 
B)  ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16 
C)  ip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16 
D)  src==10.11.0.0/16 and dst==10.11.0.0/16 
A)  src=10.11.0.0/16 and dst=10.11.0.0/16 
B)  ip.src==10.11.0.0/16 and ip.dst==10.11.0.0/16 
C)  ip.src=10.11.0.0/16 and ip.dst=10.11.0.0/16 
D)  src==10.11.0.0/16 and dst==10.11.0.0/16

Question 13

Refer to the exhibit. What is depicted in the exhibit?

Accepted Answer

A)  Windows Event logs 
B)  Apache logs 
C)  IIS logs 
D)  UNIX-based syslog 
A)  Windows Event logs 
B)  Apache logs 
C)  IIS logs 
D)  UNIX-based syslog

Question 14

Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

Accepted Answer

A)  detection and analysis 
B)  post-incident activity 
C)  vulnerability management 
D)  risk assessment 
E)  vulnerability scoring 
A)  detection and analysis 
B)  post-incident activity 
C)  vulnerability management 
D)  risk assessment 
E)  vulnerability scoring

Question 15

What is the virtual address space for a Windows process?

Accepted Answer

A)  physical location of an object in memory 
B)  set of pages that reside in the physical memory 
C)  system-level memory protection feature built into the operating system 
D)  set of virtual memory addresses that can be used 
A)  physical location of an object in memory 
B)  set of pages that reside in the physical memory 
C)  system-level memory protection feature built into the operating system 
D)  set of virtual memory addresses that can be used

Question 16

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

Accepted Answer

A)  The computer has a HIPS installed on it. 
B)  The computer has a NIPS installed on it. 
C)  The computer has a HIDS installed on it. 
D)  The computer has a NIDS installed on it. 
A)  The computer has a HIPS installed on it. 
B)  The computer has a NIPS installed on it. 
C)  The computer has a HIDS installed on it. 
D)  The computer has a NIDS installed on it.

Question 17

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

Accepted Answer

A)  known-plaintext 
B)  replay 
C)  dictionary 
D)  man-in-the-middle 
A)  known-plaintext 
B)  replay 
C)  dictionary 
D)  man-in-the-middle

Question 18

Refer to the exhibit. Which type of log is displayed?

Accepted Answer

A)  proxy 
B)  NetFlow 
C)  IDS 
D)  sys 
A)  proxy 
B)  NetFlow 
C)  IDS 
D)  sys

Question 19

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?

Accepted Answer

A)  application whitelisting/blacklisting 
B)  network NGFW 
C)  host-based IDS 
D)  antivirus/antispyware software 
A)  application whitelisting/blacklisting 
B)  network NGFW 
C)  host-based IDS 
D)  antivirus/antispyware software

Question 20

What is a difference between inline traffic interrogation and traffic mirroring?

Accepted Answer

A)  Inline inspection acts on the original traffic data flow 
B)  Traffic mirroring passes live traffic to a tool for blocking 
C)  Traffic mirroring inspects live traffic for analysis and mitigation 
D)  Inline traffic copies packets for analysis and security 
A)  Inline inspection acts on the original traffic data flow 
B)  Traffic mirroring passes live traffic to a tool for blocking 
C)  Traffic mirroring inspects live traffic for analysis and mitigation 
D)  Inline traffic copies packets for analysis and security

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Which two components reduce the attack surface on an endpoint? (Choose two.)

Which event is user interaction?

An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification. Which information is available on the server certificate?

Which evasion technique is a function of ransomware?

Refer to the exhibit. Which technology generates this log?

Which technology should be used to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes?

How is attacking a vulnerability categorized?

Refer to the exhibit. Which packet contains a file that is extractable within Wireshark?

What does an attacker use to determine which network ports are listening on a potential target device?

At which layer is deep packet inspection investigated on a firewall?

Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

Refer to the exhibit. What is depicted in the exhibit?

Which two elements of the incident response process are stated in NIST Special Publication 800-61 r2? (Choose two.)

What is the virtual address space for a Windows process?

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

Refer to the exhibit. Which type of log is displayed?

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?

What is a difference between inline traffic interrogation and traffic mirroring?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters