All Obstacles During 200-201 Exam Preparation with 200-201 Real Test Questions [Q37-Q60]

March 15, 2026March 15, 2026 examdumpsAll Obstacles During 200-201 Exam Preparation with 200-201 Real Test Questions [Q37-Q60] 0 Comment

5/5 - (1 vote)

All Obstacles During 200-201 Exam Preparation with 200-201 Real Test Questions

Fully Updated Free Actual Cisco 200-201 Exam Questions

200-201 Details

The test has a duration of 120 minutes during which the candidates will have to answer 95 to 105 questions. Applicants can enroll in their exams by using the Pearson VUE platform after having created an account there and selected the “proctored exam” section. Thereafter, you should search the code 200-201 and follow the instructions to fully register. The fee for this test is $300 and it’s available in the English language only.

QUESTION 37
Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

Hypertext Transfer Protocol

SSL Certificate

Tunneling

VPN

SSL Certificate guarantees the integrity and authenticity of all messages transferred to and from a web application. It encrypts the data transferred between the user’s browser and the website, ensuring that all data passed between them remains private and integral. References := Cisco CyberOps Engineer – Module 3:
Secure Communications

QUESTION 38
When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.
Which information is available on the server certificate?

server name, trusted subordinate CA, and private key

trusted subordinate CA, public key, and cipher suites

trusted CA name, cipher suites, and private key

server name, trusted CA, and public key

When communicating via TLS, part of the handshake process involves presenting a certificate containing the server name, the name of the trusted CA that issued the certificate, and the public key of the server. The client can verify the validity of the certificate and use the public key to encrypt the data sent to the server. Reference:= Cisco Cybersecurity Source Documents

QUESTION 39
Which type of data collection requires the largest amount of storage space?

alert data

transaction data

session data

full packet capture

QUESTION 40
What is personally identifiable information that must be safeguarded from unauthorized access?

date of birth

driver’s license number

gender

zip code

Explanation
According to the Executive Office of the President, Office of Management and Budget (OMB), and the U.S.
Department of Commerce, Office of the Chief Information Officer, PII refers to “information which can be used to distinguish or trace an individual’s identity.” The following are a few examples:
– An individual’s name
– Social security number
– Biological or personal characteristics, such as an image of distinguishing features, fingerprints, Xrays, voice signature, retina scan, and the geometry of the face
– Date and place of birth
– Mother’s maiden name
– Credit card numbers
– Bank account numbers
– Driver license number
– Address information, such as email addresses or street addresses, and telephone numbers for businesses or personal use
– Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide Omar Santos

QUESTION 41

Refer to the exhibit A SOC analyst is examining the Auth.log file logs of one the breached systems What is the possible reason for this event log?

password cracking DoS attack on Windows endpoint

brute force attack on Windows from 10.10.10.10

regular Linux log and 10.10.10.10 is legitimate host

brute force attack on Linux from 10.10.10.10

QUESTION 42
Refer to the exhibit.

Refer to the exhibit. Based on the .pcap file, which protocol’s vulnerability has been exploited to establish a session?

SMB

TCP

Negotiate

QUESTION 43
What does cyber attribution identity in an investigation?

cause of an attack

exploit of an attack

vulnerabilities exploited

threat actors of an attack

Explanation/Reference:

QUESTION 44
At a company party a guest asks question:s about the company’s user account format and password complexity. How is this type of conversation classified?

Phishing attack

Password Revelation Strategy

Piggybacking

Social Engineering

QUESTION 45
Which piece of information is part of the chain of custody during investigation?

Method of evidence collection

List of critical assets

Company that was collecting evidence

List of vulnerable assets

QUESTION 46
Refer to the exhibit.

Which type of log is displayed?

proxy

NetFlow

IDS

sys

QUESTION 47
Which two elements are assets in the role of attribution in an investigation? (Choose two.)

threat actor

firewall logs

context

laptop

session

In the context of cybersecurity, an asset is anything that has value to the organization, its business operations and their continuity, including data and physical devices. In the role of attribution in an investigation, which is the process of associating an action or event with a particular individual or entity, certain assets are particularly relevant. A laptop can be an asset because it may contain data or clues that can help trace the origin of a cyber attack. Similarly, identifying the threat actor (E) is crucial for attribution, as it involves understanding who is behind the attack and their motives, which can be essential for preventing future attacks and for legal proceedings.
References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)1.

QUESTION 48
Drag and drop the definition from the left onto the phase on the right to classify intrusion events according to the Cyber Kill Chain model.

QUESTION 49
What is the difference between inline traffic interrogation and traffic mirroring?

Inline interrogation is less complex as traffic mirroring applies additional tags to data.

Traffic mirroring copies the traffic rather than forwarding it directly to the analysis tools

Inline replicates the traffic to preserve integrity rather than modifying packets before sending them to other analysis tools.

Traffic mirroring results in faster traffic analysis and inline is considerably slower due to latency.

QUESTION 50
Drag and drop the data sources from the left onto the corresponding data types on the right.

QUESTION 51
Refer to the exhibit.

What is occurring in this network?

ARP cache poisoning

DNS cache poisoning

MAC address table overflow

MAC flooding attack

The exhibit shows a network diagram with a switch, a router, and two hosts. The switch has a MAC address table that maps the MAC addresses of the connected devices to the corresponding ports. A MAC flooding attack is a type of attack that aims to overload the switch’s MAC address table by sending a large number of frames with spoofed source MAC addresses. This causes the switch to enter a fail-open mode, where it broadcasts all incoming frames to all ports, effectively turning it into a hub. This allows the attacker tosniff the traffic between the hosts and the router, or launch other attacks such as ARP spoofing or man-in-the- middle

QUESTION 52
An engineer is addressing a connectivity issue between two servers where the remote server is unable to establish a successful session. Initial checks show that the remote server is not receiving an SYN-ACK while establishing a session by sending the first SYN. What is causing this issue?

incorrect TCP handshake

incorrect UDP handshake

incorrect OSI configuration

incorrect snaplen configuration

A TCP handshake is a three-way exchange of messages between a client and a server to establish a TCP connection. The client initiates the handshake by sending a SYN packet with a sequence number to the server. The server responds with a SYN-ACK packet with its own sequence number and an acknowledgment number that is the client’s sequence number plus one. The client completes the handshake by sending an ACK packet with an acknowledgment number that is the server’s sequence number plus one. If the remote server is not receiving an SYN-ACK packet from the local server, it means that the TCP handshake is not completed and the connection is not established. This could be caused by various factors, such as network congestion, firewall rules, packet filtering, or misconfiguration of the TCP parameters on either end. Reference:= Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) – Cisco, page 177; TCP 3-Way Handshake Process – GeeksforGeeks

QUESTION 53
What is the function of a command and control server?

It enumerates open ports on a network device

It drops secondary payload into malware

It is used to regain control of the network after a compromise

It sends instruction to a compromised system

A command and control server (C2 or C&C) is a server that is used by attackers to communicate with and control compromised systems, such as bots, zombies, or backdoors. The C2 server can send instructions to the compromised systems, such as executing commands, downloading files, uploading data, or launching attacks.
The C2 server can alsoreceive information from the compromised systems, such as system information, keystrokes, screenshots, or credentials. References:
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 3: Network Intrusion Analysis, Lesson 3.4: Malware Cisco Certified CyberOps Associate Overview, Exam Topics, 3.4 Compare and contrast types of malware

QUESTION 54
Refer to the exhibit.

What is depicted in the exhibit?

Windows Event logs

Apache logs

IIS logs

UNIX-based syslog

The exhibit shows a UNIX command being used to filter data from an Apache access log file. The use of
“cat” to display the content of the log file, “grep” to filter specific IP addresses, and “cut” to organize the output are all indicative of operations performed on a UNIX-based system. Additionally, the structure of the logs (GET requests) aligns with the format typically found in Apache server logs. References := The Cisco Cybersecurity source documents or study guide are not directly referenced here as I need to search for specific content related to this question.

QUESTION 55
A security expert is working on a copy of the evidence, an ISO file that is saved in CDFS format. Which type of evidence is this file?

CD data copy prepared in Windows

CD data copy prepared in Mac-based system

CD data copy prepared in Linux system

CD data copy prepared in Android-based system

QUESTION 56
Which type of data consists of connection level, application-specific records generated from network traffic?

transaction data

location data

statistical data

alert data

Transaction data consists of connection level, application-specific records generated from network traffic. It provides information about the source, destination, protocol, and application of each network connection. Transaction data can be used to identify anomalies, malicious activities, and user behaviors on the network. Reference:= Cisco CyberOps Engineer

QUESTION 57
An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

nmap –top-ports 192.168.1.0/24

nmap -sP 192.168.1.0/24

nmap -sL 192.168.1.0/24

nmap -sV 192.168.1.0/24

The -sP option in Nmap is used for host discovery without port scanning, which helps in identifying live hosts without triggering portscan alerts on IDS devices. It sends an ICMP echo request, a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request to each target IP address and waits for a response. Any responses are considered as indications of a live host. Reference:= Cisco Cybersecurity Operations Fundamentals – Module 5: Endpoint Threat Analysis and Computer Forensics

QUESTION 58
Refer to the exhibit.

This request was sent to a web application server driven by a database. Which type of web server attack is represented?

parameter manipulation

heap memory corruption

command injection

blind SQL injection

QUESTION 59
Refer to the exhibit. A security analyst received a ticket about suspicious traffic from one of the workstations. During the investigation, the analyst discovered that the workstation was communicating with an external IP. The analyst could not investigate further and escalated the case to a T2 security analyst. What are the two data visibility challenges that the security analyst should identify? (Choose two.)

A default user agent is present in the headers.

Traffic is not encrypted.

HTTP requests and responses are sent in plaintext.

POST requests have a “Microsoft-IIS/7.5” server header.

Encrypted data is being transmitted.

QUESTION 60
A malicious file has been identified in a sandbox analysis tool.

Which piece of information is needed to search for additional downloads of this file by other hosts?