Cisco 200-201 Exam - Topic 1 Question 5 Discussion

Actual exam question for Cisco's 200-201 exam

Question #: 5
Topic #: 1

[All 200-201 Questions]

Which piece of information is needed for attribution in an investigation?

Aproxy logs showing the source RFC 1918 IP addresses

BRDP allowed from the Internet

Cknown threat actor behavior

D802.1x RADIUS authentication pass arid fail logs

Show Suggested Answer

Suggested Answer: C

by Tammara at May 04, 2022, 01:36 AM

Limited Time Offer

25%

Off

Get Premium 200-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Janessa

10 months ago

I disagree, 802.1x logs are crucial for understanding access points.

upvoted 0 times

...

Tracey

10 months ago

Surprised that people think RFC 1918 IPs are helpful for this.

upvoted 0 times

...

Leoma

11 months ago

Proxy logs are useful, but not the main thing for attribution.

upvoted 0 times

...

Kerry

11 months ago

I think RDP from the Internet is a big red flag too!

upvoted 0 times

...

Joni

11 months ago

Definitely need known threat actor behavior for attribution.

upvoted 0 times

...

Donette

11 months ago

Hmm, I'm a bit unsure about this one. I know Deming and Juran were influential in quality management, but I'm not as familiar with the other names. I'll have to think this through carefully.

upvoted 0 times

...

Nada

11 months ago

Hmm, there are a lot of details in the passage. I'll need to make sure I really understand how CCC demonstrates each of the attributes before selecting my answers.

upvoted 0 times

...

Tennie

11 months ago

Hmm, the wording is a bit tricky. I'll need to carefully read through the options to determine the valid reason.

upvoted 0 times

...

Tori

11 months ago

I'm a bit confused by the wording of this question. Can a Tools Release really be a database format change or third party fixes? I'll have to read through the options again.

upvoted 0 times

...