Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network. Which testing method did the intruder use?

An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection. Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

What is the difference between the ACK flag and the RST flag in the NetFlow log session?

Which process is used when IPS events are removed to improve data integrity?

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?

Which security monitoring data type requires the largest storage space?

Why is encryption challenging to security monitoring?

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

What is rule-based detection when compared to statistical detection?

Which regex matches only on all lowercase letters?

A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property. What is the threat agent in this situation?

Refer to the exhibit. What does the message indicate?

Refer to the exhibit. Which kind of attack method is depicted in this string?

Which type of evidence supports a theory or an assumption that results from initial evidence?

A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor. Which type of evidence is this?

Which attack method intercepts traffic on a switched network?

An engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Application Visibility and Control should the engineer use to accomplish this goal? (Choose two.)

A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver. Which event category is described?

Which security principle requires more than one person is required to perform a critical task?