200-201: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

200-201: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) practice questions, page 22 of 23, with answer review and explanations.

Question 106

An OSINT team scans the target hosts, gathers information regarding the adversary online services, and equips the red team with the obtained information. Which step in the kill chain is this activity?

  1. weaponization
  2. installation
  3. delivery
  4. reconnaissance

Question 107

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

  1. examination
  2. investigation
  3. collection
  4. reporting

Question 108

Which step in the incident response process researches an attacking host through logs in a SIEM?

  1. detection and analysis
  2. preparation
  3. eradication
  4. containment

Question 109

A malicious file has been identified in a sandbox analysis tool. Which piece of information is needed to search for additional downloads of this file by other hosts?

  1. file type
  2. file size
  3. file name
  4. file hash value

Question 110

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

  1. Host 10.201.3.149 is sending data to 152.46.6.91 using TCP/443.
  2. Host 152.46.6.91 is being identified as a watchlist country for data transfer.
  3. Traffic to 152.46.6.149 is being denied by an Advanced Network Control policy.
  4. Host 10.201.3.149 is receiving almost 19 times more data than is being sent to host 152.46.6.91.