Question 1

What are two denial of service attacks? (Choose two.)

Accepted Answer

A)  MITM 
B)  TCP connections 
C)  ping of death 
D)  UDP flooding 
E)  code red 
A)  MITM 
B)  TCP connections 
C)  ping of death 
D)  UDP flooding 
E)  code red

Question 2

A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?

Accepted Answer

A)  company assets that are threatened 
B)  customer assets that are threatened 
C)  perpetrators of the attack 
D)  victims of the attack 
A)  company assets that are threatened 
B)  customer assets that are threatened 
C)  perpetrators of the attack 
D)  victims of the attack

Question 3

Refer to the exhibit. What should be interpreted from this packet capture?

Accepted Answer

A)  81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol. 
B)  192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol. 
C)  192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol. 
D)  81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol. 
A)  81.179.179.69 is sending a packet from port 80 to port 50272 of IP address 192.168.122.100 using UDP protocol. 
B)  192.168.122.100 is sending a packet from port 50272 to port 80 of IP address 81.179.179.69 using TCP protocol. 
C)  192.168.122.100 is sending a packet from port 80 to port 50272 of IP address 81.179.179.69 using UDP protocol. 
D)  81.179.179.69 is sending a packet from port 50272 to port 80 of IP address 192.168.122.100 using TCP UDP protocol.

Question 4

Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

Accepted Answer

A)  resource exhaustion 
B)  tunneling 
C)  traffic fragmentation 
D)  timing attack 
A)  resource exhaustion 
B)  tunneling 
C)  traffic fragmentation 
D)  timing attack

Question 5

Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

Accepted Answer

A)  NetScout 
B)  tcpdump 
C)  SolarWinds 
D)  netsh 
A)  NetScout 
B)  tcpdump 
C)  SolarWinds 
D)  netsh

Question 6

Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

Accepted Answer

A)  decision making 
B)  rapid response 
C)  data mining 
D)  due diligence 
A)  decision making 
B)  rapid response 
C)  data mining 
D)  due diligence

Question 7

Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

Accepted Answer

A)  insert TCP subdissectors 
B)  extract a file from a packet capture 
C)  disable TCP streams 
D)  unfragment TCP 
A)  insert TCP subdissectors 
B)  extract a file from a packet capture 
C)  disable TCP streams 
D)  unfragment TCP

Question 8

What is a sandbox interprocess communication service?

Accepted Answer

A)  A collection of rules within the sandbox that prevent the communication between sandboxes. 
B)  A collection of network services that are activated on an interface, allowing for inter-port communication. 
C)  A collection of interfaces that allow for coordination of activities among processes. 
D)  A collection of host services that allow for communication between sandboxes. 
A)  A collection of rules within the sandbox that prevent the communication between sandboxes. 
B)  A collection of network services that are activated on an interface, allowing for inter-port communication. 
C)  A collection of interfaces that allow for coordination of activities among processes. 
D)  A collection of host services that allow for communication between sandboxes.

Question 9

An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

Accepted Answer

A)  true negative 
B)  false negative 
C)  false positive 
D)  true positive 
A)  true negative 
B)  false negative 
C)  false positive 
D)  true positive

Question 10

What are two social engineering techniques? (Choose two.)

Accepted Answer

A)  privilege escalation 
B)  DDoS attack 
C)  phishing 
D)  man-in-the-middle 
E)  pharming 
A)  privilege escalation 
B)  DDoS attack 
C)  phishing 
D)  man-in-the-middle 
E)  pharming

Question 11

An engineer discovered a breach, identified the threat's entry point, and removed access. The engineer was able to identify the host, the IP address of the threat actor, and the application the threat actor targeted. What is the next step the engineer should take according to the NIST SP 800-61 Incident handling guide?

Accepted Answer

A)  Recover from the threat. 
B)  Analyze the threat. 
C)  Identify lessons learned from the threat. 
D)  Reduce the probability of similar threats. 
A)  Recover from the threat. 
B)  Analyze the threat. 
C)  Identify lessons learned from the threat. 
D)  Reduce the probability of similar threats.

Question 12

What is an attack surface as compared to a vulnerability?

Accepted Answer

A)  any potential danger to an asset 
B)  the sum of all paths for data into and out of the application 
C)  an exploitable weakness in a system or its design 
D)  the individuals who perform an attack 
A)  any potential danger to an asset 
B)  the sum of all paths for data into and out of the application 
C)  an exploitable weakness in a system or its design 
D)  the individuals who perform an attack

Question 13

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

Accepted Answer

A)  Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443. 
B)  Host 152.46.6.91 is being identified as a watchlist country for data transfer. 
C)  Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy. 
D)  Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91. 
A)  Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443. 
B)  Host 152.46.6.91 is being identified as a watchlist country for data transfer. 
C)  Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy. 
D)  Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.

Question 14

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

Accepted Answer

A)  CSIRT 
B)  PSIRT 
C)  public affairs 
D)  management 
A)  CSIRT 
B)  PSIRT 
C)  public affairs 
D)  management

Question 15

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?

Accepted Answer

A)  parameter manipulation 
B)  heap memory corruption 
C)  command injection 
D)  blind SQL injection 
A)  parameter manipulation 
B)  heap memory corruption 
C)  command injection 
D)  blind SQL injection

Question 16

A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

Accepted Answer

A)  CD data copy prepared in Windows 
B)  CD data copy prepared in Mac-based system 
C)  CD data copy prepared in Linux system 
D)  CD data copy prepared in Android-based system 
A)  CD data copy prepared in Windows 
B)  CD data copy prepared in Mac-based system 
C)  CD data copy prepared in Linux system 
D)  CD data copy prepared in Android-based system

Question 17

Which step in the incident response process researches an attacking host through logs in a SIEM?

Accepted Answer

A)  detection and analysis 
B)  preparation 
C)  eradication 
D)  containment 
A)  detection and analysis 
B)  preparation 
C)  eradication 
D)  containment

Question 18

Refer to the exhibit. What information is depicted?

Accepted Answer

A)  IIS data 
B)  NetFlow data 
C)  network discovery event 
D)  IPS event data 
A)  IIS data 
B)  NetFlow data 
C)  network discovery event 
D)  IPS event data

Question 19

Which piece of information is needed for attribution in an investigation?

Accepted Answer

A)  proxy logs showing the source RFC 1918 IP addresses 
B)  RDP allowed from the Internet 
C)  known threat actor behavior 
D)  802.1x RADIUS authentication pass arid fail logs 
A)  proxy logs showing the source RFC 1918 IP addresses 
B)  RDP allowed from the Internet 
C)  known threat actor behavior 
D)  802.1x RADIUS authentication pass arid fail logs

Question 20

An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network. What is the impact of this traffic?

Accepted Answer

A)  ransomware communicating after infection 
B)  users downloading copyrighted content 
C)  data exfiltration 
D)  user circumvention of the firewall 
A)  ransomware communicating after infection 
B)  users downloading copyrighted content 
C)  data exfiltration 
D)  user circumvention of the firewall

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

What are two denial of service attacks? (Choose two.)

A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?

Refer to the exhibit. What should be interpreted from this packet capture?

Which evasion technique is indicated when an intrusion detection system begins receiving an abnormally high volume of scanning from numerous sources?

Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?

Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

What is a sandbox interprocess communication service?

An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

What are two social engineering techniques? (Choose two.)

What is an attack surface as compared to a vulnerability?

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?

A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

Which step in the incident response process researches an attacking host through logs in a SIEM?

Refer to the exhibit. What information is depicted?

Which piece of information is needed for attribution in an investigation?

An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network. What is the impact of this traffic?

Supporting Cisco Data Center System Devices (DCTECH)

Cisco Certified Technician Routing & Switching (RSTECH)

Cisco Certified Network Associate (CCNA)

Managing Industrial Networks with Cisco Networking Technologies (IMINS)

DevNet Associate (DEVASC)

Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)

Implementing Cisco Enterprise Advanced Routing and Services (ENARSI)

Implementing Cisco SD-WAN Solutions (ENSDWI)

Designing Cisco Enterprise Networks (ENSLD)

Designing Cisco Enterprise Wireless Networks (300-425 ENWLSD)

Implementing Cisco Enterprise Wireless Networks (300-430 ENWLSI)

Automating Cisco Enterprise Solutions (ENAUTO)

Implementing Cisco Service Provider Advanced Routing Solutions (SPRI)

Implementing Cisco Service Provider VPN Services (SPVI)

Designing Cisco Data Center Infrastructure (DCID)

Troubleshooting Cisco Data Center Infrastructure (DCIT)

Implementing Cisco Application Centric Infrastructure (DCACI)

Configuring Cisco MDS 9000 Series Switches (DCSAN)

Implementing Cisco Application Centric Infrastructure - Advanced

Automating Cisco Data Center Solutions (DCAUTO)

Securing Networks with Cisco Firepower (300-710 SNCF)

Implementing and Configuring Cisco Identity Services Engine (300-715 SISE)

Securing Email with Cisco Email Security Appliance (300-720 SESA)

Securing the Web with Cisco Web Security Appliance (300-725 SWSA)

Implementing Secure Solutions with Virtual Private Networks (SVPN 300-730)

Automating Cisco Security Solutions (SAUTO)

Implementing Cisco Collaboration Applications (CLICA)

Implementing Cisco Advanced Call Control and Mobility Services (CLASSM)

Implementing Cisco Collaboration Cloud and Edge Solutions

Implementing Cisco Collaboration Conferencing

Automating Cisco Collaboration Solutions (CLAUTO)

Implementing DevOps Solutions and Practices using Cisco Platforms (DEVOPS)

Developing Solutions Using Cisco IoT and Edge Platforms (DEVIOT)

Developing Applications for Cisco Webex and Webex Devices (DEVWBX)

Performing CyberOps Using Core Security Technologies (CBRCOR)

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR)

Implementing and Operating Cisco Data Center Core Technologies (DCCOR)

Implementing and Operating Cisco Security Core Technologies

Implementing Cisco Collaboration Core Technologies (CLCOR)

Developing Applications using Cisco Core Platforms and APIs (DEVCOR)

CCDE Design Written

Deploying Cisco Unified Contact Center Express

Cisco Meraki Solutions Specialist

Securing Cisco Networks with Sourcefire FireAMP Endpoints

Designing Cisco Unified Contact Center Enterprise (UCCED)

Implementing and Supporting Cisco Unified Contact Center Enterprise (UCCEIS)

Cisco Collaboration SaaS Authorization Exam

Cisco Security Architecture for System Engineers

Adopting The Cisco Business Architecture Approach (DTBAA)

Cisco Customer Success Manager (CSM)

Mastering The Cisco Business Architecture Discipline (DTBAD)

Filters