Cisco CyberOps Associate 200-201 (200-201) — Questions 226–300

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a DDoS (Distributed Denial of Service) attack aims to overwhelm a target with traffic to disrupt service, not to insert fake DNS entries. Option C is wrong because a man-in-the-middle (MITM) attack intercepts and potentially alters communications between two parties in real time, whereas DNS poisoning corrupts the resolver's stored cache records. Option D is wrong because ARP spoofing links an attacker's MAC address to a legitimate IP address on a local network, targeting Layer 2 address resolution, not the DNS resolver's cache.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because encrypting all network traffic is not the role of a digital certificate; encryption of traffic is performed by protocols like TLS using the public/private key pair, but the certificate itself only provides the binding and does not perform encryption. Option C is wrong because a digital certificate contains only the public key and identity information, never the private key; backing up private keys is a separate key management task, and exposing the private key in a certificate would break the entire security model. Option D is wrong because preventing malware infections is a function of security controls such as antivirus software, firewalls, and endpoint protection, not of digital certificates or PKI.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the log indicates an inbound connection (external to internal), not outbound; the source is internal and destination is external, but the direction field says 'inbound', which refers to the traffic flow relative to the firewall's perspective. Option B is wrong because the action is 'DENY', not 'ALLOW', so the connection was not allowed. Option D is wrong because the connection is inbound, not outbound, and it was denied, not allowed.

Why this answer

How to eliminate wrong answers

Option A is wrong because restoring from backup ignores the active compromise and fails to contain the threat; the alert is not a false positive given the clear indicators of attack (failed logons, successful logon, encoded PowerShell download). Option C is wrong because running a full antivirus scan is a slow, passive step that does not immediately stop the attacker's access or the ongoing download; isolation alone does not revoke the compromised credentials or block the outbound connection to the remote server. Option D is wrong because disabling only the user account 'jdoe' does not block the outbound traffic to the remote server, allowing the payload download to complete; investigating the source IP is important but not the most effective immediate response to limit lateral movement.

Why this answer

How to eliminate wrong answers

Option A is wrong because internal network scanning would target internal IP addresses, not external IP addresses, and would typically use ports like ICMP or TCP 445/3389, not exclusively port 443. Option B is wrong because normal web browsing activity is distributed across many users and times, not a sudden spike from a single workstation to multiple external IPs; a single user's browsing would not generate a sharp, sustained increase in NetFlow data volume. Option D is wrong because a scheduled software update usually contacts a single or few known update servers (e.g., Microsoft or Adobe CDNs), not multiple random external IPs, and updates typically use HTTP/HTTPS but with predictable patterns and destinations.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the IDS being in a different subnet does not prevent SPAN from sending traffic to it; SPAN operates at Layer 2 and forwards frames regardless of IP subnet, as long as the destination interface is correctly connected and configured. Option C is wrong because if the SPAN destination interface were not connected to the IDS, the IDS would not be physically linked, which would be a cabling or connectivity issue, but the question states the IDS sees no traffic, implying a configuration problem rather than a physical disconnection. Option D is wrong because VLAN tagging on the server does not inherently block SPAN; SPAN can copy tagged frames, and the IDS would still see them if the source interface is correctly specified and the destination interface is configured to accept tagged traffic.

Why this answer

How to eliminate wrong answers

Option A (Least privilege) is wrong because it focuses on granting users only the minimum permissions needed to perform their tasks, not on deploying multiple layers of security controls. Option C (Risk management) is wrong because it is a broader process of identifying, assessing, and prioritizing risks, not a specific design principle for implementing layered defenses. Option D (Separation of duties) is wrong because it prevents fraud or error by dividing critical tasks among multiple individuals, which is an administrative control, not a technical architecture for layered security.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling the Windows Firewall, while beneficial, does not address the SMBv1 vulnerability; the firewall would still allow SMB traffic on port 445 if not explicitly blocked, and the outdated protocol remains exploitable. Option B is wrong because blocking broadcast traffic on the switch port would disrupt legitimate network discovery and communication (e.g., NetBIOS name resolution), and it does not mitigate the SMBv1 security flaw. Option C is wrong because creating VLANs is a longer-term segmentation strategy that requires network reconfiguration and does not provide immediate remediation; it also does not directly disable the vulnerable SMBv1 protocol.

Why this answer

How to eliminate wrong answers

Option A is wrong because a valid signature from an untrusted publisher does not automatically mean the file is malicious; the publisher may simply not be in the trusted store (e.g., a self-signed certificate). Option B is wrong because a revoked signature would be reported as invalid, not as valid but from an untrusted publisher; revocation is checked via CRL or OCSP and would cause the signature to fail verification. Option D is wrong because a valid signature does not imply safety; the publisher could be malicious or compromised, and the signature only ensures integrity, not trustworthiness.

Why this answer

Why this answer

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because phishing is a broad, untargeted attack sent to many users, whereas this scenario describes a targeted email appearing to come from the company's IT department, which is characteristic of spear phishing. Option C is wrong because whaling targets high-profile executives (e.g., CEO, CFO) with highly personalized content, not a general user reporting an IT password reset request. Option D is wrong because vishing (voice phishing) uses phone calls or voice messages, not email, to trick victims into revealing sensitive information.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a crash would likely result in no ACK or a RST without a preceding ACK, but here the client properly ACKs the FIN before sending the RST, indicating intentional action. Option B is wrong because a normal completion involves a graceful four-way handshake (FIN from server, ACK from client, FIN from client, ACK from server), not a RST. Option C is wrong because a delayed response would manifest as a long gap before the server sends data or FIN, not as a client-initiated RST after the transfer completes.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the SIEM were not receiving logs from the authentication server, the analyst would not have observed any failed login attempts at all, but the analyst explicitly notes repeated failed attempts. Option C is wrong because the analyst is monitoring the correct log source (the critical server's authentication logs) as evidenced by the observed failed attempts; the issue is with the correlation rule's window, not the log source. Option D is wrong because the question states the threshold is 10 failed attempts in 5 minutes, not 15; the rule's threshold is clearly defined and not misconfigured to a higher value.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because encryption standards for data at rest are a data protection control, not a reporting mechanism; they do not address the immediate notification of security incidents. Option B is wrong because acceptable use policies govern proper resource usage, not the process for reporting incidents when they occur. Option D is wrong because requiring complex passwords is an authentication strength measure, unrelated to the procedural requirement of reporting security events.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Telnet uses TCP port 23, not port 22, and the ACL specifically permits port 22. Option B is wrong because HTTP uses TCP port 80, which is not matched by the ACL. Option D is wrong because FTP uses TCP ports 20 and 21, neither of which is port 22.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a man-in-the-middle attack involves an attacker intercepting and potentially altering communications between two parties (e.g., ARP spoofing or SSL stripping), not repeated login attempts from a single IP. Option B is wrong because phishing relies on social engineering to trick users into revealing credentials or sensitive information via deceptive emails or websites, not on automated, repeated login attempts. Option C is wrong because a DDoS (Distributed Denial of Service) attack aims to overwhelm a target with traffic from multiple sources to disrupt service, not to guess passwords via repeated login failures from a single IP.

Why this answer

How to eliminate wrong answers

Option B is wrong because log analysis for performance tuning is a secondary operational benefit, not the primary security-driven reason for a one-year retention mandate; performance analysis typically uses shorter-term metrics. Option C is wrong because while regulatory compliance (e.g., PCI DSS, HIPAA) often mandates retention periods, the question asks for the primary purpose, which is forensic investigation — compliance is a driver, not the purpose itself. Option D is wrong because real-time monitoring relies on current log streams, not historical data retained for a year; long-term retention is for post-incident analysis, not immediate alerting.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because command injection involves executing arbitrary OS commands on the server (e.g., via shell metacharacters like ';' or '|'), not SQL queries; the signature explicitly mentions 'SQL Injection', not command execution. Option B is wrong because a buffer overflow attack exploits memory corruption by overflowing a buffer (e.g., stack or heap) to execute arbitrary code, which is unrelated to SQL query manipulation. Option C is wrong because cross-site scripting (XSS) injects malicious client-side scripts (e.g., JavaScript) into web pages viewed by other users, not SQL statements targeting the database.

Why this answer

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) typically involves injecting JavaScript or HTML tags (e.g., <script>alert('XSS')</script>) into web pages, not SQL keywords like 'union select'. Option B is wrong because buffer overflow attacks exploit memory corruption by sending excessive data to overflow buffers, often using patterns like long strings of 'A's or shellcode, not SQL syntax. Option D is wrong because directory traversal attacks use path manipulation sequences like '../' or '..\' to access restricted files, not SQL commands like 'union select'.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because changing the database administrator password is a reactive step that does not address the active, ongoing data exfiltration; the attacker may already have persistent access or credentials, and isolation must come first. Option B is wrong because the scenario explicitly states that remote administration is only allowed from a management subnet via VPN, and the connection is from the database server to an external IP at 2:00 AM—this cannot be an authorized session. Option C is wrong because while investigating logs is important, the immediate action must be containment (isolation and blocking) to stop the active data transfer; waiting to investigate first risks further data loss and gives the attacker time to cover tracks.

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because blocking the imaging device's IP at the core firewall would disrupt legitimate communication on TCP port 1433, potentially halting critical medical imaging workflows and violating the requirement to not disrupt operations. Option B is wrong because taking the imaging device offline immediately would stop all legitimate imaging traffic, causing direct disruption to patient care; the device is isolated on its own VLAN and the attack is against the database, not the device itself. Option C is wrong because disabling the entire VLAN would cut off all communication between the imaging device and the database server, including legitimate traffic, which would disrupt medical operations and is not a targeted containment measure.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Application layer (Layer 7) provides network services to end-user applications (e.g., HTTP, FTP, SMTP) and does not handle logical addressing or routing. Option B is wrong because the Data link layer (Layer 2) is responsible for physical addressing (MAC addresses) and frame delivery on the same local network segment, not for logical addressing or routing across networks. Option D is wrong because the Transport layer (Layer 4) manages end-to-end communication, segmentation, and flow control (e.g., TCP/UDP port numbers), but does not perform logical addressing or routing.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because rebooting the server would clear the memory, destroying volatile evidence such as the running rundll32.exe process and any network connections, and would not remove the underlying persistence mechanism. Option B is wrong because immediately formatting the hard drive destroys all evidence, including logs, artifacts, and the root cause, making forensic analysis impossible and potentially violating legal or compliance requirements. Option C is wrong because restoring from a backup taken yesterday could reintroduce the same vulnerability or malware if the infection occurred before the backup, and it does not address the immediate need to stop the active outbound connection to the malicious IP.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a Password Policy focuses on password complexity, length, expiration, and reuse rules, not on requiring multiple authentication factors (e.g., something you know plus something you have) for external connections. Option B is wrong because a Data Classification Policy defines how data is categorized (e.g., public, confidential, restricted) and handled based on sensitivity, not the authentication mechanisms for external network access. Option D is wrong because an Acceptable Use Policy outlines what users are allowed to do with organizational resources (e.g., browsing restrictions, software installation), not the technical authentication requirements for external connections.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because restarting the SIEM collector service does not address the root cause—the network outage preventing log transmission—and would not recover logs that were never sent. Option B is wrong because manually monitoring the firewall console is not scalable, does not provide centralized alerting, and would require constant human attention, which is impractical during an outage and does not guarantee that all alerts are captured. Option D is wrong because ignoring the log gap violates fundamental security monitoring principles; logs from critical firewalls are essential for incident detection, forensics, and compliance, and any gap could allow a security event to go undetected.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a port scan typically sends connection requests (SYN packets) to multiple ports on a target, not repeated login attempts; it would be detected by a rule counting connections to different ports, not failed logins. Option B is wrong because a DDoS attack aims to overwhelm a target with traffic volume, not to authenticate; it would be detected by a rule monitoring bandwidth or packet rates, not failed login attempts. Option C is wrong because privilege escalation involves an attacker gaining higher-level access after initial compromise, often using a single exploit or token manipulation, not repeated failed logins; it would be detected by rules monitoring changes in user permissions or unusual process execution.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Worm propagation) is wrong because worm propagation typically involves self-replicating code that spreads by exploiting vulnerabilities, often generating traffic to random or specific ports based on the exploit, not a sequential scan of consecutive ports. Option C (Denial of service) is wrong because a DoS attack aims to overwhelm a target with traffic to disrupt service, usually flooding a single port or using high-volume traffic, not probing multiple consecutive ports in a low-and-slow manner. Option D (Data exfiltration) is wrong because data exfiltration involves sending sensitive data out of the network, which would use established connections on a single port (e.g., HTTP/HTTPS, DNS, or FTP), not a series of denied connection attempts to consecutive ports.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because svchost.exe can make legitimate outbound connections for Windows services like DNS, DHCP, or Windows Update, so an outbound connection alone does not prove compromise. Option C is wrong because killing svchost.exe could crash critical system services and disrupt the investigation; the analyst should first capture memory and network artifacts to identify the injected code. Option D is wrong because while svchost.exe is a critical Windows process, an established connection to an unknown IP on port 4444 is highly suspicious and should not be dismissed as legitimate without further analysis.

Why this answer

How to eliminate wrong answers

Option A is wrong because a vulnerability scan identifies system weaknesses, not user actions like clicking a link; it would not reveal whether an employee visited the phishing URL. Option B is wrong because DNS logs only show that a client resolved the domain 'malicious-login.com', not that the user actually made an HTTP request to the specific '/verify' path; a DNS query could occur from background processes or pre-fetching without user interaction. Option C is wrong because endpoint antivirus logs only record malware detections; the phishing page itself is not malware, and no malicious file would be detected unless the user downloaded and executed a payload.

Why this answer

Why this order

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a denial of service (DoS) attack typically floods a single target with traffic to overwhelm it, resulting in alerts from many source IPs or a high volume to a single port, not a single source IP across multiple destination ports. Option B is wrong because SQL injection attacks target web application parameters (e.g., HTTP GET/POST fields) and would generate alerts related to SQL syntax in payloads, not a pattern of probes across many ports. Option D is wrong because phishing attacks involve social engineering via email or malicious links, which would trigger alerts on email headers or URL patterns, not a single IP scanning multiple ports.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because firewall logs track network traffic (source/destination IPs, ports, protocols) and do not record local file system operations on a host. Option C is wrong because NetFlow data captures network flow metadata (IP conversations, byte counts) and has no visibility into local file modifications. Option D is wrong because DNS logs record domain name resolution queries and responses, not process-level file changes on the endpoint.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a denial-of-service (DoS) attack would typically involve a flood of traffic from a single source to overwhelm the server, but the scenario describes a 300% increase in HTTP traffic volume, which is more consistent with sustained data transfer than a flood designed to cause resource exhaustion. Option C is wrong because a distributed denial-of-service (DDoS) attack involves multiple source IPs (botnets) generating traffic, but the question explicitly states the increase is from a single client IP, ruling out a distributed attack. Option D is wrong because a 300% increase from a single IP to a single external server is not normal peak-hour fluctuation; normal traffic patterns show gradual changes across many clients, not a sudden spike from one source.

Why this answer

How to eliminate wrong answers

Option B is wrong because `http.request.uri contains "password"` only searches the URI portion of HTTP request packets, not the full payload (e.g., POST body or response data), so it would miss packets where 'password' appears in form data or server responses. Option C is wrong because `data contains "password"` filters on the raw data layer (typically application data not parsed by a dissector), but HTTP payloads are already parsed by the HTTP dissector and stored in the `http` protocol tree, not in the generic `data` field; thus this filter would rarely match HTTP traffic. Option D is wrong because `tcp.port == 80 and frame contains "password"` uses the `frame` layer, which searches the entire raw frame (including Ethernet, IP, and TCP headers) for the string 'password', which is inefficient and may produce false positives from header fields, and it does not restrict the search to HTTP protocol data specifically.

Why this answer

How to eliminate wrong answers

Option B is wrong because availability refers to ensuring data is accessible when needed, typically addressed by redundancy, backups, and fault tolerance, not encryption. Option C is wrong because integrity ensures data has not been tampered with, usually provided by hashing algorithms (e.g., SHA-256) or HMAC, not encryption alone. Option D is wrong because non-repudiation prevents a party from denying an action, achieved through digital signatures and public key infrastructure (PKI), not symmetric encryption like AES-256.

Why this answer

How to eliminate wrong answers

Option A is wrong because corrective controls (e.g., restoring from backup after a breach) are applied after an incident to mitigate damage, not before access is granted. Option C is wrong because detective controls (e.g., logging failed authentication attempts) identify ongoing or past violations but do not block the initial connection. Option D is wrong because deterrent controls (e.g., warning banners) discourage malicious behavior through fear of consequences but do not technically enforce authentication like a certificate requirement does.

Why this answer