Free Cisco 200-201 Practice Exam with Questions & Answers | Set: 6

Threat intelligence is crucial for organizations to understand the threats they are currently facing. It involves collecting, evaluating, and disseminating information about current or potential attacks that could affect an organization. This intelligence can help organizations prioritize their security measures based on the likelihood and potential impact of different threats. By using threat intelligence, organizations can be more proactive in their defense strategies and respond more effectively to cyber threats.

References: The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course emphasizes the importance of threat intelligence in monitoring security incidents and responding to them

 To investigate the callouts made post infection, it’s essential to know where the callouts were made to (domain names) and from which host IP addresses they originated. This information can help trace back the source and destination, aiding in understanding the nature of the callouts. References: https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Working_with_Indicators_of_Compromise.html

Integrity is a metric in CVSS that measures the impact of a vulnerability on the trustworthiness and veracity of the data or information in a system. A vulnerability that affects the integrity of a system can allow an attacker to modify, delete, or corrupt the data or information without authorization. An example of such a vulnerability is a bank account number tampering attack, where an attacker changes the destination bank account number of a transaction to redirect the funds to their own account. References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 2-17; 200-201 CBROPS - Cisco, exam topic 1.3.c

Ransomware is a type of malware that encrypts the victim’s data and demands a ransom for the decryption key. The attacker may also threaten to publish or delete the data if the ransom is not paid. In this case, the Egregor malware is distributed through a Cobalt Strike, which is a penetration testing tool that can be used to deploy payloads on compromised systems. The malware exfiltrates the victim’s data to a command and control server and uses it as leverage to extort money from the victim. References := Cisco Cybersecurity Operations Fundamentals, Module 1: Security Concepts, Lesson 1.3: Common Network Application Operations and Attacks, Topic 1.3.3: Malware Attacks

Session data is the data type that is necessary to get information about source/destination ports. Session data is the information about connections between hosts, such as IP addresses, ports, protocols, and duration. Session data can be used to identify the services and applications that are being used on the network, as well as the direction and volume of the traffic. Session data can also help to detect anomalous or malicious behavior, such as port scanning, brute force attacks, or data exfiltration. Session data can be collected from various sources, such as firewalls, routers, switches, or network monitoring tools. References:

• Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) v1.0, Module 2: Security Monitoring, Lesson 2.2: Data Sources, Topic 2.2.2: Session Data (https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html)
• Cisco Certified CyberOps Associate Certification Guide, Chapter 3: Data Sources, Section 3.2: Session Data (https://www.ciscopress.com/store/cisco-certified-cyberops-associate-certification-guide-9780136807834)

• The event where a breached workstation is trying to connect to a known malicious domain suggests that the attacker is moving towards their end goals, which typically involves actions on objectives.
• In the Cyber Kill Chain framework, "Action on objectives" refers to the steps taken by an attacker to achieve their intended outcomes, such as data exfiltration, destruction, or ransom demands.
• This phase involves the attacker executing their final mission within the target environment, leveraging access gained in earlier stages of the attack.

References

• Lockheed Martin Cyber Kill Chain
• Understanding the Stages of Cyber Attacks
• Incident Response and the Cyber Kill Chain

Delivery is the fourth phase of the cyber kill chain, which is a model to describe the stages of a cyberattack. Delivery refers to the transmission of the weaponized payload to the target system, such as via email attachments, web links, USB drives, or network connections. Delivery does not necessarily imply successful installation or execution of the payload, which are subsequent phases of the kill chain. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 31.

Rule-based detection involves identifying malicious activities based on predefined rules or patterns of known attacks; it does not adapt or change with new data. In contrast, behavioral detection adapts over time by learning from new data; it identifies malicious activities based on deviations from established norms or behaviors. References: Cisco Certified CyberOps Associate Overview, Section 1.0: Security Concepts, Subsection 1.1: Compare and contrast the characteristics of data obtained from taps, NetFlow, and packet capture)

An SSL certificate enables the establishment of a secure connection between the client and the server using the TLS protocol. The client and the server exchange keys and agree on a cipher suite to encrypt and decrypt the data transmitted over the network. References := Cisco Cybersecurity Source Documents

In this scenario, the threat actor refers to the individuals or entities responsible for the attack that resulted in a breach of assets and sensitive information. The receptionist received a threatening call but did not take action, leading to an actual breach within 48 hours. References: The explanation is inferred from general cybersecurity knowledge as specific details are not provided in the Cisco Cybersecurity documents linked.