Question 1

Which signature impacts network traffic by causing legitimate traffic to be blocked?
A) false negative
B) true positive
C) true negative
D) false positive

Accepted Answer

A false positive occurs when legitimate traffic is incorrectly identified as malicious, leading to it being blocked and impacting network traffic.

Question 2

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?
A) application whitelisting/blacklisting
B) network NGFW
C) host-based IDS
D) antivirus/antispyware software

Accepted Answer

Application whitelisting/blacklisting is a technology that allows or blocks specific applications from running on endpoints, making it suitable for blocking a selected set of applications on all PCs.

Question 3

Which system monitors local system operation and local network access for violations of a security policy?
A) host-based intrusion detection
B) systems-based sandboxing
C) host-based firewall
D) antivirus

Accepted Answer

The answer of Which system monitors local system operation and...

Question 4

Refer to the exhibit. Which application protocol is in this PCAP file?
A) SSH
B) TCP
C) TLS
D) HTTP

Accepted Answer

The answer of  Refer to the exhibit. Which application...

Question 5

Which regex matches only on all lowercase letters?
A) [a?z]+
B) [^a?z]+
C) a?z+
D) a*z+

Accepted Answer

[a?z]+ matches only on all lowercase letters because the ? quantifier matches the preceding element zero or one times, and the + quantifier matches the preceding element one or more times. So, [a?z]+ matches on one or more lowercase letters.

Question 6

Which incidence response step includes identifying all hosts affected by an attack?
A) detection and analysis
B) post-incident activity
C) preparation
D) containment, eradication, and recovery

Accepted Answer

The containment, eradication, and recovery step involves identifying all affected hosts to contain the attack and begin recovery efforts.

Question 7

Which type of data collection requires the largest amount of storage space?
A) alert data
B) transaction data
C) session data
D) full packet capture

Accepted Answer

Full packet capture requires the largest amount of storage space because it involves capturing all the data packets transmitted over a network, including headers and payloads, which results in a large volume of data.

Question 8

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?
A) encapsulation
B) TOR
C) tunneling
D) NAT

Accepted Answer

NAT (Network Address Translation) allows multiple devices on a local network to be mapped to a single public IP address, modifying the IP header to manage traffic between the internal network and external networks.

Question 9

Refer to the exhibit. What does the message indicate?
A) an access attempt was made from the Mosaic web browser
B) a successful access attempt was made to retrieve the password file
C) a successful access attempt was made to retrieve the root of the website
D) a denied access attempt was made to retrieve the password file

Accepted Answer

The answer of  Refer to the exhibit. What does...

Question 10

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?
A) application identification number
B) active process identification number
C) runtime identification number
D) process identification number

Accepted Answer

The process identification number (PID) is used to track active programs or processes in a Linux system.

Question 11

Which HTTP header field is used in forensics to identify the type of browser used?
A) referrer
B) host
C) user-agent
D) accept-language

Accepted Answer

The "user-agent" HTTP header field contains information about the browser type and version, which can be used in forensics to identify the browser used.

Question 12

What is a difference between inline traffic interrogation and traffic mirroring?
A) Inline inspection acts on the original traffic data flow
B) Traffic mirroring passes live traffic to a tool for blocking
C) Traffic mirroring inspects live traffic for analysis and mitigation
D) Inline traffic copies packets for analysis and security

Accepted Answer

The answer of What is a difference between inline traffic...

Question 13

An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?
A) true negative
B) false negative
C) false positive
D) true positive

Accepted Answer

A false negative occurs when a legitimate threat is not detected by the security system, leading to the dismissal of a legitimate security alert.

Question 14

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?
A) CSIRT
B) PSIRT
C) public affairs
D) management

Accepted Answer

Management is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies.

Question 15

Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?
A) insert TCP subdissectors
B) extract a file from a packet capture
C) disable TCP streams
D) unfragment TCP

Accepted Answer

The answer of  Refer to the exhibit. What is...

Question 16

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)
A) UDP port to which the traffic is destined
B) TCP port from which the traffic was sourced
C) source IP address of the packet
D) destination IP address of the packet
E) UDP port from which the traffic is sourced

Accepted Answer

The IPv4 protocol header contains the source IP address and destination IP address of the packet.

Question 17

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?
A) online assault
B) precursor
C) trigger
D) instigator

Accepted Answer

In NIST SP800-61, a "precursor" is an event that indicates a potential incident may occur in the future. The online threats made by a hacktivist group serve as a warning or precursor to a possible security incident.

Question 18

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?
A) The computer has a HIPS installed on it.
B) The computer has a NIPS installed on it.
C) The computer has a HIDS installed on it.
D) The computer has a NIDS installed on it.

Accepted Answer

A Host-based Intrusion Detection System (HIDS) can detect attacks but does not take action to mitigate them, which explains why no mitigation occurred.

Question 19

Refer to the exhibit. In which Linux log file is this output found?
A) /var/log/authorization.log
B) /var/log/dmesg
C) var/log/var.log
D) /var/log/auth.log

Accepted Answer

The answer of  Refer to the exhibit. In which...

Question 20

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?
A) parameter manipulation
B) heap memory corruption
C) command injection
D) blind SQL injection

Accepted Answer

The answer of  Refer to the exhibit. This request...

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

Which signature impacts network traffic by causing legitimate traffic to be blocked?

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?

Which system monitors local system operation and local network access for violations of a security policy?

Refer to the exhibit. Which application protocol is in this PCAP file?

Which regex matches only on all lowercase letters?

Which incidence response step includes identifying all hosts affected by an attack?

Which type of data collection requires the largest amount of storage space?

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

Refer to the exhibit. What does the message indicate?

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

Which HTTP header field is used in forensics to identify the type of browser used?

What is a difference between inline traffic interrogation and traffic mirroring?

An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

Refer to the exhibit. In which Linux log file is this output found?

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?