Free Cisco 200-201 Practice Exam with Questions & Answers | Set: 8

In the Common Vulnerability Scoring System (CVSS), attack complexity refers to the conditions beyond the attacker’s control that must exist for the vulnerability to be successfully exploited.

This includes factors such as the need for user interaction, the presence of specific configurations, or network conditions that are not easily controlled by the attacker.

A high attack complexity means that these external factors make exploitation more difficult, while a low attack complexity indicates that fewer such conditions are required.

References

CVSS v3.1 Specifications Document

Understanding Attack Complexity in Vulnerability Assessments

Cybersecurity Frameworks and Metrics

Statistical detection involves collecting data over time to define what is considered normal behavior or legitimate data for users or systems. It then uses statistical analysis to identify abnormal behavior that could indicate a security incident. Rule-based detection uses predefined rules or patterns that are based on known threats or vulnerabilities - it operates on an IF/THEN basis where if certain conditions are met then an alert is triggered. References := Cisco Cybersecurity Operations Fundamentals

A vulnerability scanner is a core security technology used to identify known weaknesses, misconfigurations, and exploitable flaws within an organization’s IT infrastructure. These tools systematically scan systems, networks, applications, and devices to compare them against databases of known vulnerabilities, such as missing patches, insecure services, outdated software versions, and weak configurations.

Vulnerability scanners operate by probing systems using signatures, checks, and authenticated or unauthenticated methods to determine exposure to threats. The results are typically presented in detailed reports that include severity ratings, affected assets, and remediation guidance. This makes vulnerability scanning an essential foundational activity in cybersecurity operations, risk management, and compliance programs.

The other options do not fulfill this function. Identity and access management focuses on user authentication, authorization, and access control, not weakness detection. Configuration management ensures systems remain in a desired state but does not actively discover vulnerabilities. Mobile device management is limited to controlling and securing mobile endpoints rather than assessing infrastructure-wide weaknesses.

From an operational perspective, vulnerability scanning supports proactive defense by allowing organizations to identify and remediate issues before attackers exploit them. It is commonly integrated into continuous monitoring programs, patch management workflows, and security assessments. As emphasized in cybersecurity operations documentation, vulnerability scanners are a primary mechanism for visibility into an organization’s attack surface.

A greylist in endpoint applications refers to a list of items that are not yet classified as either good (whitelisted) or bad (blacklisted).

The primary function of a greylist is to hold applications, processes, or files that are under observation due to their unknown status.

These items are neither trusted nor immediately flagged as harmful, allowing security teams to monitor them closely for any suspicious behavior.

By placing items on a greylist, security operations can prevent potential threats without disrupting legitimate processes, awaiting further analysis to determine their true nature.

References

Cisco Cybersecurity Operations Fundamentals

Endpoint Security Best Practices

Greylisting Concepts in Cybersecurity

A rootkit is a type of malicious software specifically designed to maintain persistent, unauthorized control over a compromised system while evading detection. Rootkits operate by embedding themselves deep within the operating system, often at the kernel level, allowing attackers to hide processes, files, network connections, and registry entries.

Once installed, a rootkit enables long-term access even after system reboots, making it a powerful persistence mechanism. Attackers use rootkits to maintain control, execute commands, capture credentials, and install additional malware without alerting security tools or administrators.

Option B, ARP spoofing, is a network-level attack used for traffic interception, not persistence. Option C, DDoS, is an availability attack and does not provide control over a device. Option D, encryption, is a defensive technology and does not grant persistence.

Cybersecurity operations and incident response documentation consistently identify rootkits as high-severity threats because of their stealth, durability, and ability to undermine trust in the operating system. Detecting rootkits often requires specialized tools, integrity checks, and sometimes full system reimaging.

Therefore, the technology used to maintain persistent control of an exploited device is a rootkit, making Option A the correct answer.

This type of analysis is deterministic because it assigns fixed values to the scenario and calculates the expected outcomes based on those values. Deterministic analysis does not account for uncertainty or randomness in the scenario. References: https://learningnetworkstore.cisco.com/on-demand-e-learning/understanding-cisco-cybersecurity-operations-fundamentals-cbrops-v1-0/CSCU-LP-CBROPS-V1-028093.html (Module 3, Lesson 3.1.2)