Question 1

Which signature impacts network traffic by causing legitimate traffic to be blocked?

Accepted Answer

A false positive occurs when legitimate traffic is incorrectly identified as malicious, leading to it being blocked and impacting network traffic.

Question 2

A security engineer deploys an enterprise-wide host/endpoint technology for all of the company's corporate PCs. Management requests the engineer to block a selected set of applications on all PCs. Which technology should be used to accomplish this task?

Accepted Answer

Application whitelisting/blacklisting is a technology that allows or blocks specific applications from running on endpoints, making it suitable for blocking a selected set of applications on all PCs.

Question 3

Which system monitors local system operation and local network access for violations of a security policy?

Accepted Answer

The answer of Which system monitors local system operation and...

Question 4

Refer to the exhibit. Which application protocol is in this PCAP file?

Accepted Answer

The answer of  Refer to the exhibit. Which application...

Question 5

Which regex matches only on all lowercase letters?

Accepted Answer

[a?z]+ matches only on all lowercase letters because the ? quantifier matches the preceding element zero or one times, and the + quantifier matches the preceding element one or more times. So, [a?z]+ matches on one or more lowercase letters.

Question 6

Which incidence response step includes identifying all hosts affected by an attack?

Accepted Answer

The containment, eradication, and recovery step involves identifying all affected hosts to contain the attack and begin recovery efforts.

Question 7

Which type of data collection requires the largest amount of storage space?

Accepted Answer

Full packet capture requires the largest amount of storage space because it involves capturing all the data packets transmitted over a network, including headers and payloads, which results in a large volume of data.

Question 8

While viewing packet capture data, an analyst sees that one IP is sending and receiving traffic for multiple devices by modifying the IP header. Which technology makes this behavior possible?

Accepted Answer

NAT (Network Address Translation) allows multiple devices on a local network to be mapped to a single public IP address, modifying the IP header to manage traffic between the internal network and external networks.

Question 9

Refer to the exhibit. What does the message indicate?

Accepted Answer

The answer of  Refer to the exhibit. What does...

Question 10

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

Accepted Answer

The process identification number (PID) is used to track active programs or processes in a Linux system.

Question 11

Which HTTP header field is used in forensics to identify the type of browser used?

Accepted Answer

The "user-agent" HTTP header field contains information about the browser type and version, which can be used in forensics to identify the browser used.

Question 12

What is a difference between inline traffic interrogation and traffic mirroring?

Accepted Answer

The answer of What is a difference between inline traffic...

Question 13

An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?

Accepted Answer

A false negative occurs when a legitimate threat is not detected by the security system, leading to the dismissal of a legitimate security alert.

Question 14

Which NIST IR category stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

Accepted Answer

Management is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies.

Question 15

Refer to the exhibit. What is the expected result when the "Allow subdissector to reassemble TCP streams" feature is enabled?

Accepted Answer

The answer of  Refer to the exhibit. What is...

Question 16

Which two pieces of information are collected from the IPv4 protocol header? (Choose two.)

Accepted Answer

The IPv4 protocol header contains the source IP address and destination IP address of the packet.

Question 17

An organization has recently adjusted its security stance in response to online threats made by a known hacktivist group. What is the initial event called in the NIST SP800-61?

Accepted Answer

In NIST SP800-61, a "precursor" is an event that indicates a potential incident may occur in the future. The online threats made by a hacktivist group serve as a warning or precursor to a possible security incident.

Question 18

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

Accepted Answer

A Host-based Intrusion Detection System (HIDS) can detect attacks but does not take action to mitigate them, which explains why no mitigation occurred.

Question 19

Refer to the exhibit. In which Linux log file is this output found?

Accepted Answer

The answer of  Refer to the exhibit. In which...

Question 20

Refer to the exhibit. This request was sent to a web application server driven by a database. Which type of web server attack is represented?

Accepted Answer

The answer of  Refer to the exhibit. This request...

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)