Download the 200-201 CBROPS Dumps PDF (V17.02) to Start Your Preparation: Check the 200-201 Free Dumps (Part 1, Q1-Q40) First

1. A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs.

Which technology should be used to accomplish this task?

2. Refer to the exhibit.

Which type of log is displayed?

3. What are the two characteristics of the full packet captures? (Choose two.)

4. What is rule-based detection when compared to statistical detection?

5. At a company party a guest asks questions about the company’s user account format and password complexity.

How is this type of conversation classified?

6. During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

7. An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.

Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)

8. Which metric is used to capture the level of access needed to launch a successful attack?

9. What is a difference between tampered and untampered disk images?

10. Which event artifact is used to identify HTTP GET requests for a specific file?

11. What is the relationship between a vulnerability and a threat?

12. How is attacking a vulnerability categorized?

13. Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

14. Refer to the exhibit.

What does the message indicate?

15. What makes HTTPS traffic difficult to monitor?

16. Refer to the exhibit.

What is occurring in this network?

17. What does cyber attribution identify in an investigation?

18. Refer to the exhibit.

What should be interpreted from this packet capture?

19. What is an example of social engineering attacks?

20. Which evasion technique is a function of ransomware?

21. What is a difference between SOAR and SIEM?

22. Which security principle is violated by running all processes as root or administrator?

23. What should a security analyst consider when comparing inline traffic interrogation with traffic tapping to determine which approach to use in the network?

24. Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

25. An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.

Which testing method did the intruder use?

26. When trying to evade IDS/IPS devices, which mechanism allows the user to make the data incomprehensible without a specific key, certificate, or password?

27. Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

28. A security specialist notices 100 HTTP GET and POST requests for multiple pages on the web servers. The agent in the requests contains PHP code that, if executed, creates and writes to a new PHP file on the webserver.

Which event category is described?

29. What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

30. How is NetFlow different from traffic mirroring?

31. Which security monitoring data type requires the largest storage space?

32. An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network.

What is the impact of this traffic?

33. What specific type of analysis is assigning values to the scenario to see expected outcomes?

34. Which two components reduce the attack surface on an endpoint? (Choose two.)

35. A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.

Which type of evidence is this?

36. What is the difference between an attack vector and attack surface?

37. An analyst is investigating an incident in a SOC environment.

Which method is used to identify a session from a group of logs?

38. What is the virtual address space for a Windows process?

39. DRAG DROP

Drag and drop the uses on the left onto the type of security system on the right.

40. Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?