200-201 Practice Exam Tests Latest Updated on Jun-2022 [Q61-Q76] : Top Exam Collection : http://blog.topexamcollection.com

NO.61 Which security technology allows only a set of pre-approved applications to run on a system?

application-level blacklisting

host-based IPS

application-level whitelisting

antivirus

NO.62 Which two elements are used for profiling a network? (Choose two.)

session duration

total throughput

running processes

listening ports

OS fingerprint

NO.63 Which type of data consists of connection level, application-specific records generated from network traffic?

transaction data

location data

statistical data

alert data

NO.64 You have identified a malicious file in a sandbox analysis tool. Which piece of file information from the analysis is needed to search for additional downloads of this file by other hosts?

file name

file hash value

file type

file size

NO.65 What makes HTTPS traffic difficult to monitor?

SSL interception

packet header size

signature detection time

encryption

NO.66 What is personally identifiable information that must be safeguarded from unauthorized access?

date of birth

driver’s license number

gender

zip code

NO.67

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

A policy violation is active for host 10.10.101.24.

A host on the network is sending a DDoS attack to another inside host.

There are two active data exfiltration alerts.

A policy violation is active for host 10.201.3.149.

NO.68 How does an attack surface differ from an attack vector?

An attack vector recognizes the potential outcomes of an attack, and the attack surface is choosing a method of an attack.

An attack surface identifies vulnerable parts for an attack, and an attack vector specifies which attacks are feasible to those parts.

An attack surface mitigates external vulnerabilities, and an attack vector identifies mitigation techniques and possible workarounds.

An attack vector matches components that can be exploited, and an attack surface classifies the potential path for exploitation

NO.69 A security incident occurred with the potential of impacting business services. Who performs the attack?

malware author

threat actor

bug bounty hunter

direct competitor

NO.70 An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group.
What is the initial event called in the NIST SP800-61?

online assault

precursor

trigger

instigator

NO.71 One of the objectives of information security is to protect the CIA of information and systems.
What does CIA mean in this context?

confidentiality, identity, and authorization

confidentiality, integrity, and authorization

confidentiality, identity, and availability

confidentiality, integrity, and availability

NO.72 A malicious file has been identified in a sandbox analysis tool.
Which piece of information is needed to search for additional downloads of this file by other hosts?

file type

file size

file name

file hash value

NO.73 What is the practice of giving an employee access to only the resources needed to accomplish their job?

principle of least privilege

organizational separation

separation of duties

need to know principle

NO.74 What is a difference between SIEM and SOAR?

SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

SlEM’s primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

SOAR’s primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

NO.75 Refer to the exhibit.

Which technology generates this log?

NetFlow

IDS

web proxy

firewall

NO.76 An analyst is exploring the functionality of different operating systems.
What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?

queries Linux devices that have Microsoft Services for Linux installed

deploys Windows Operating Systems in an automated fashion

is an efficient tool for working with Active Directory

has a Common Information Model, which describes installed hardware and software