A Review Of Simulation 200-201 Prep

NEW QUESTION 1
Refer to the exhibit.

What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

• A. insert TCP subdissectors
• B. extract a file from a packet capture
• C. disable TCP streams
• D. unfragment TCP

Answer: D

NEW QUESTION 2
Which type of evidence supports a theory or an assumption that results from initial evidence?

• A. probabilistic
• B. indirect
• C. best
• D. corroborative

Answer: D

NEW QUESTION 3
Which event artifact is used to identity HTTP GET requests for a specific file?

• A. destination IP address
• B. TCP ACK
• C. HTTP status code
• D. URI

Answer: D

NEW QUESTION 4
Which two elements are used for profiling a network? (Choose two.)

• A. total throughout
• B. session duration
• C. running processes
• D. OS fingerprint
• E. listening ports

Answer: DE

NEW QUESTION 5
When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

• A. fragmentation
• B. pivoting
• C. encryption
• D. stenography

Answer: D

NEW QUESTION 6
Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

• A. NetScout
• B. tcpdump
• C. SolarWinds
• D. netsh

Answer: B

NEW QUESTION 7
Which two components reduce the attack surface on an endpoint? (Choose two.)

• A. secure boot
• B. load balancing
• C. increased audit log levels
• D. restricting USB ports
• E. full packet captures at the endpoint

Answer: AD

NEW QUESTION 8
Which process is used when IPS events are removed to improve data integrity?

• A. data availability
• B. data normalization
• C. data signature
• D. data protection

Answer: B

NEW QUESTION 9
Which IETF standard technology is useful to detect and analyze a potential security incident by recording session flows that occurs between hosts?

• A. SFlow
• B. NetFlow
• C. NFlow
• D. IPFIX

Answer: D

NEW QUESTION 10
In a SOC environment, what is a vulnerability management metric?

• A. code signing enforcement
• B. full assets scan
• C. internet exposed devices
• D. single factor authentication

Answer: D

NEW QUESTION 11
While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header.
Which technology makes this behavior possible?

• A. encapsulation
• B. TOR
• C. tunneling
• D. NAT

Answer: D

NEW QUESTION 12
Which two elements are assets in the role of attribution in an investigation? (Choose two.)

• A. context
• B. session
• C. laptop
• D. firewall logs
• E. threat actor

Answer: AE

NEW QUESTION 13
What is an attack surface as compared to a vulnerability?

• A. any potential danger to an asset
• B. the sum of all paths for data into and out of the application
• C. an exploitable weakness in a system or its design
• D. the individuals who perform an attack

Answer: B

NEW QUESTION 14
Which metric is used to capture the level of access needed to launch a successful attack?

• A. privileges required
• B. user interaction
• C. attack complexity
• D. attack vector

Answer: A

NEW QUESTION 15
What is a difference between SOAR and SIEM?

• A. SOAR platforms are used for threat and vulnerability management, but SIEM applications are not
• B. SIEM applications are used for threat and vulnerability management, but SOAR platforms are not
• C. SOAR receives information from a single platform and delivers it to a SIEM
• D. SIEM receives information from a single platform and delivers it to a SOAR

Answer: A

NEW QUESTION 16
Which event artifact is used to identify HTTP GET requests for a specific file?

• A. destination IP address
• B. URI
• C. HTTP status code
• D. TCP ACK

Answer: B

NEW QUESTION 17
......