Online Access Free 200-201 Exam Questions

During a quarterly vulnerability scan, a security analyst discovered unused uncommon ports open and in a listening state. Further investigation showed that the unknown application was communicating with an external IP address on an encrypted channel. A deeper analysis revealed a command and control communication on an infected server. At which step of the Cyber Kill Chain was the attack detected?

• A.Exploitation
• B.Actions on Objectives
• C.Delivery
• D.Weaponization

Which technology should be used to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes?

• A.IIS
• B.AWS
• C.Proxy server
• D.Load balancer

Refer to the exhibit.

Which tool was used to generate this data?

• A.firewall
• B.dnstools
• C.tcpdump
• D.NetFlow

Refer to the exhibit. What type of event is occurring?

• A.Distributed Denial of Service (DDoS) attack
• B.Legitimate web browsing activity
• C.User trying to access a file share
• D.Malware attempting to spread laterally

What is the impact of false positive alerts on business compared to true positive?

• A.False-positive alerts are detected by confusion as potential attacks, while true positives are attack attempts identified appropriately.
• B.True-positive alerts are blocked by mistake as potential attacks, while False-positives are actual attacks Identified as harmless.
• C.True positives affect security as no alarm is raised when an attack has taken place, while false positives are alerts raised appropriately to detect and further mitigate them.
• D.False positives alerts are manually ignored signatures to avoid warnings that are already acknowledged, while true positives are warnings that are not yet acknowledged.