Reliable Cisco 200-201 Exam Dumps

Question No: 1

What is the purpose of a host-based intrusion detection system (HIDS)?

AA HIDS protects against threats via known denylisted hash databases of malware and ransomware.

BA HIDS filters traffic according to configured firewall access control rules.

CA HIDS detects threats using a combination of signature-based and anomaly-based detection methods.

DA HIDS blocks potential anomalous user activity.

Show Answer

Question No: 2

MultipleChoice

An analyst see that this security alert "Default-Botnet-Communication-Detection-By-Endpoint" has been raised from the IPS. The analyst checks and finds that an endpoint communicates to the C&C. How must an impact from this event be categorized?

Options

Atrue positive

Btrue negative

Cfalse positive

Dfalse negative

Question No: 3

MultipleChoice

Which access control should a chief information security officer Choose to protect extremely sensitive data categorized at various levels of confidentiality?

Options

AMAC; each object owner is responsible to provide access only to authorized users.

BMAC; access control decisions are centrally managed and minimize the human error probability.

CDAC; access control decisions are centrally managed and minimize the human error probability.

DDAC; each object owner is responsible to provide access only to authorized users.

Question No: 4

MultipleChoice

What is the difference between an attack vector and an attack surface?

Options

AAttack vectors are flaws in configuration, and the attack surface is the system or software that has such flaws.

BThe attack vector targets security weaknesses, and the attack surface is where an adversary attempts to gain entry across those weaknesses.

CThe attack surface is tactics, techniques, and procedures used by the threat actor, and the attack vector is the system hardware.

DThe attack surface defines the number of existing vulnerabilities available, and the attack vector determines the difficulty of available exploits.

Question No: 5

MultipleChoice

Refer to the exhibit.

This request was sent to a web application server driven by a database. Which type of web server attack is represented?

Options

Aparameter manipulation

Bheap memory corruption

Ccommand injection

Dblind SQL injection

Question No: 6

MultipleChoice

What is an advantage of symmetric over asymmetric encryption?

Options

AA key is generated on demand according to data type.

BA one-time encryption key is generated for data transmission

CIt is suited for transmitting large amounts of data.

DIt is a faster encryption mechanism for sessions

Question No: 7

MultipleChoice

Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?

Options

AClientStart, ClientKeyExchange, cipher-suites it supports, and suggested compression methods

BClientStart, TLS versions it supports, cipher-suites it supports, and suggested compression methods

CClientHello, TLS versions it supports, cipher-suites it supports, and suggested compression methods

DClientHello, ClientKeyExchange, cipher-suites it supports, and suggested compression methods

Question No: 8

MultipleChoice

A suspicious user opened a connection from a compromised host inside an organization. Traffic was going through a router and the network administrator was able to identify this flow. The admin was following 5-tuple to collect needed dat

a. Which information was gathered based on this approach?

Options

Adirect path

Buser name

Cprotocol

DNAT

Question No: 9

MultipleChoice

Refer to the exhibit. Where is the executable file?

Options

Ainfo

Btags

CMIME

Dname

Question No: 10

MultipleChoice

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?

Options

AWin32.polip.a.exe is an executable file and should be flagged as malicious.

BThe file is clean and does not represent a risk.

CCuckoo cleaned the malicious file and prepared it for usage.

DMD5 of the file was not identified as malicious.

Question No: 11

DragDrop

Refer to the exhibit Drag and drop the element names from the left onto the corresponding pieces of the PCAP file on the right.

Question No: 12

MultipleChoice

Refer to the exhibit.

A workstation downloads a malicious docx file from the Internet and a copy is sent to FTDv. The FTDv sends the file hash to FMC and the tile event is recorded What would have occurred with stronger data visibility?

Options

AThe traffic would have been monitored at any segment in the network.

BMalicious traffic would have been blocked on multiple devices

CAn extra level of security would have been in place

DDetailed information about the data in real time would have been provided

Question No: 13

MultipleChoice

Refer to the exhibit.

A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

Options

Afile header type

Bfile size

Cfile name

Dfile hash value

Question No: 14

MultipleChoice

Refer to the exhibit.

Refer to the exhibit. Where is the executable file?

Options

Ainfo

Btags

CMIME

Dname

Question No: 15

MultipleChoice

Refer to the exhibit.

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?

Options

AWin32.polip.a.exe is an executable file and should be flagged as malicious.

BThe file is clean and does not represent a risk.

CCuckoo cleaned the malicious file and prepared it for usage.

DMD5 of the file was not identified as malicious.

Question No: 16

MultipleChoice

Refer to the exhibit.

Refer to the exhibit. An attacker scanned the server using Nmap. What did the attacker obtain from this scan?

Options

AIdentified a firewall device preventing the pert state from being returned.

BIdentified open SMB ports on the server

CGathered information on processes running on the server

DGathered a list of Active Directory users

Question No: 17

MultipleChoice

Refer to the exhibit.

An engineer received a ticket about a slowdown of a web application, Drug analysis of traffic, the engineer suspects a possible attack on a web server. How should the engineer interpret the Wiresharat traffic capture?

Options

A10.0.0.2 sends GET/ HTTP/1.1 And Post request and the target responds with HTTP/1.1. 200 OC and HTTP/1.1 403 accordingly. This is an HTTP flood attempt.

B10.0.0.2 sends HTTP FORBIDDEN /1.1 And Post request, while the target responds with HTTP/1.1 200 Get and HTTP/1.1 403. This is an HTTP GET flood attack.

C10.128.0.2 sends POST/1.1 And POST requests, and the target responds with HTTP/1.1 200 Ok and HTTP/1.1 403 accordingly. This is an HTTP Reserve Bandwidth flood.

D10.128.0.2 sends HTTP/FORBIDDEN/ 1.1 and Get requests, and the target responds with HTTP/1.1 200 OK and HTTP/1.1 403. This is an HTTP cache bypass attack.

Question No: 18

MultipleChoice

Refer to the exhibit. Where is the executable file?

Options

Ainfo

Btags

CMIME

Dname

Question No: 19

MultipleChoice

Refer to the exhibit. An employee received an email from an unknown sender with an attachment and reported it as a phishing attempt. An engineer uploaded the file to Cuckoo for further analysis. What should an engineer interpret from the provided Cuckoo report?

Options

AWin32.polip.a.exe is an executable file and should be flagged as malicious.

BThe file is clean and does not represent a risk.

CCuckoo cleaned the malicious file and prepared it for usage.

DMD5 of the file was not identified as malicious.

Question No: 20

MultipleChoice

A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

Options

Afile header type

Bfile size

Cfile name

Dfile hash value

Free Cisco 200-201 Exam Dumps October 2026