Prepare for Your 200-201 CBROPS Exam by Using the Most Current Dumps: 200-201 Dumps (V16.02) Are Available with 200-201 Free Dumps (Part 3, Q81-Q100)

1. Which step in the incident response process researches an attacking host through logs in a SIEM?

2. A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?

3. Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

4. Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

5. Which security technology allows only a set of pre-approved applications to run on a system?

6. An investigator is examining a copy of an ISO file that is stored in CDFS format.

What type of evidence is this file?

7. Which piece of information is needed for attribution in an investigation?

8. What does cyber attribution identify in an investigation?

9. A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.

Which type of evidence is this?

10. Refer to the exhibit.

Which event is occurring?

11. Refer to the exhibit.

In which Linux log file is this output found?

12. An engineer runs a suspicious file in a sandbox analysis tool to see the outcome. The analysis report shows that outbound callouts were made post infection.

Which two pieces of information from the analysis report are needed to investigate the callouts? (Choose two.)

13. An analyst is exploring the functionality of different operating systems.

What is a feature of Windows Management Instrumentation that must be considered when deciding on an operating system?

14. What causes events on a Windows system to show Event Code 4625 in the log messages?

15. Refer to the exhibit.

What does the message indicate?

16. Refer to the exhibit.

This request was sent to a web application server driven by a database.

Which type of web server attack is represented?

17. A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions.

Which identifier tracks an active program?

18. An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.

Which kind of evidence is this IP address?

19. Which system monitors local system operation and local network access for violations of a security policy?

20. An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack.

What is the reason for this discrepancy?