Question 1

A developer is working on a project using a Linux tool that enables writing processes to obtain these required results: If the process is unsuccessful, a negative value is returned. If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process. Which component results from this operation?

Accepted Answer

The answer of A developer is working on a project...

Question 2

What does cyber attribution identify in an investigation?

Accepted Answer

Cyber attribution identifies the threat actors responsible for an attack, determining who is behind the malicious activity.

Question 3

Refer to the exhibit. Which technology generates this log?

Accepted Answer

The answer of  Refer to the exhibit. Which technology...

Question 4

Refer to the exhibit. What should be interpreted from this packet capture?

Accepted Answer

The answer of  Refer to the exhibit. What should...

Question 5

What is a difference between tampered and untampered disk images?

Accepted Answer

The answer of What is a difference between tampered and...

Question 6

What are two denial of service attacks? (Choose two.)

Accepted Answer

The answer of What are two denial of service attacks?...

Question 7

Refer to the exhibit. What does this output indicate?

Accepted Answer

The answer of  Refer to the exhibit. What does...

Question 8

What is a sandbox interprocess communication service?

Accepted Answer

A sandbox interprocess communication service is a collection of interfaces that allow for coordination of activities among processes, enabling them to communicate and synchronize their actions within a controlled environment.

Question 9

An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

Accepted Answer

The `-sP` option in Nmap is used for a ping scan, which checks for live hosts without scanning ports, thus minimizing the risk of triggering IDS alerts.

Question 10

What is the impact of false positive alerts on business compared to true positive?

Accepted Answer

False positive alerts can lead to unnecessary blocking of legitimate activities, affecting application availability and causing operational disruptions.

Question 11

Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

Accepted Answer

An SSL Certificate ensures the integrity and authenticity of messages by encrypting data transferred between a web server and a client, preventing tampering and eavesdropping.

Question 12

Which filter allows an engineer to filter traffic in Wireshark to further analyze the PCAP file by only showing the traffic for LAN 10.11.x.x, between workstations and servers without the Internet?

Accepted Answer

Wireshark uses the syntax "ip.src" and "ip.dst" for filtering IP addresses. The correct format for specifying a subnet is "ip.src==10.11.0.0/16" and "ip.dst==10.11.0.0/16".

Question 13

An engineer needs to have visibility on TCP bandwidth usage, response time, and latency, combined with deep packet inspection to identify unknown software by its network traffic flow. Which two features of Cisco Application Visibility and Control should the engineer use to accomplish this goal? (Choose two.)

Accepted Answer

Metrics collection and exporting allow the engineer to collect and export data on TCP bandwidth usage, response time, and latency. Application recognition allows the engineer to identify unknown software by its network traffic flow.

Question 14

An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

Accepted Answer

The answer of An engineer is investigating a case of...

Question 15

Refer to the exhibit. What is depicted in the exhibit?

Accepted Answer

The answer of  Refer to the exhibit. What is...

Question 16

Refer to the exhibit. What is the potential threat identified in this Stealthwatch dashboard?

Accepted Answer

The answer of  Refer to the exhibit. What is...

Question 17

Which technology should be used to implement a solution that makes routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes?

Accepted Answer

A proxy server can make routing decisions based on HTTP header, uniform resource identifier, and SSL session ID attributes.

Question 18

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

Accepted Answer

Modifying the settings of the intrusion detection system can help in reducing false positives and false negatives by fine-tuning the sensitivity and specificity of the alerts.

Question 19

Which security monitoring data type requires the largest storage space?

Accepted Answer

Full packet capture requires the largest storage space because it involves recording all the data packets transmitted over a network, capturing every bit of data, which results in a large volume of information.

Question 20

An engineer needs to fetch logs from a proxy server and generate actual events according to the data received. Which technology should the engineer use to accomplish this task?

Accepted Answer

Stealthwatch is a network security monitoring and analytics platform that can be used to collect and analyze logs from proxy servers and other network devices. It can then use this data to generate real-time alerts and reports on security events.

Exam 3: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)