Cisco CyberOps Associate 200-201 (200-201) — Questions 376–450

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the syslog message shows the packet was permitted (action 'permit'), not denied, and the log entry itself indicates it was logged; the question asks what should be investigated, and a permitted HTTP packet from a source that should be allowed does not warrant investigation. Option B is wrong because the packet was permitted, not denied, and HTTP traffic from 10.10.10.5 is exactly the type of traffic that the policy exception allows. Option C is wrong because the syslog message provides no indication that 192.168.1.10 is compromised; the destination IP is simply the target of a permitted HTTP request, and compromise would require additional evidence such as abnormal traffic patterns or alerts.

Why this answer

How to eliminate wrong answers

Option A is wrong because checking the baseline is a passive analysis step that wastes time during an active, multi-indicator compromise; the alerts already confirm anomalous behavior. Option B is wrong because blocking only the external IP leaves the host still infected and able to communicate internally via high ports (e.g., 4444, 5555), allowing lateral movement and persistence. Option C is wrong because updating antivirus signatures and scanning is a reactive, slow step that may miss advanced malware; the host should be isolated first to prevent damage while a deeper investigation is conducted.

Why this answer

How to eliminate wrong answers

Option B is wrong because a DNS amplification attack relies on sending small queries with a spoofed source IP to open resolvers, causing them to flood the victim with large responses; the 'query' field would typically be a fixed, short string (e.g., 'ANY isc.org'), not a long random subdomain. Option C is wrong because DNS cache poisoning involves corrupting a resolver's cache with forged DNS records, which does not manifest as a long random subdomain in the query itself; it would instead show unexpected IP addresses in the answer section. Option D is wrong because legitimate DNS queries for services like CDNs or load balancers may use long hostnames, but they follow a predictable pattern (e.g., 'cdn123.example.com') and are not random-looking; a truly random subdomain is a strong anomaly.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because ransomware typically requires user interaction (e.g., clicking a link or opening an attachment) to execute and encrypt files; it does not self-propagate automatically. Option B is wrong because a virus attaches itself to a legitimate host file or program and relies on user action (e.g., running the infected file) to spread, not autonomous network propagation. Option C is wrong because a Trojan disguises itself as legitimate software to trick users into installing it, and it does not self-replicate or spread automatically across networks.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because creating a policy exception would formally bypass the security policy without implementing any compensating controls, leaving the shared account vulnerable to misuse and violating the principle of least privilege. Option C is wrong because disabling the application is an extreme, business-disruptive measure that ignores the requirement to maintain legacy operations; a technical solution like PAM can secure the account without halting the application. Option D is wrong because ignoring the policy due to the system's legacy status is a security negligence that exposes the organization to unauthorized access, audit failures, and potential compliance violations.

Why this answer

How to eliminate wrong answers

Option B (Symmetric encryption) is wrong because it only provides confidentiality (secrecy) and does not provide integrity or non-repudiation; both parties share the same key, so the sender can deny sending the message. Option C (Hashing) is wrong because while it ensures integrity by detecting tampering, it does not provide non-repudiation since there is no key binding the hash to a specific sender. Option D (Public key infrastructure (PKI)) is wrong because PKI is a framework of policies, roles, and procedures for managing digital certificates and keys, not a cryptographic method itself; it enables digital signatures but does not directly provide integrity and non-repudiation.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because SSL VPN is configured using `webvpn` or `crypto ssl` commands, not `crypto isakmp policy`. Option C is wrong because MACsec is configured under interface mode with `mka` or `macsec` commands, not with a global ISAKMP policy. Option D is wrong because SSH is configured using `ip ssh` or `crypto key generate rsa` commands, and it does not use IKE phase 1 parameters like Diffie-Hellman groups or encryption algorithms in a policy block.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Reconnaissance involves gathering information about the target (e.g., scanning, OSINT) and does not include transferring a malware executable. Option B is wrong because Weaponization is the phase where the attacker creates the malicious payload (e.g., coupling exploit with backdoor), but the file transfer itself is not the creation step. Option C is wrong because Exploitation occurs when the delivered payload triggers a vulnerability to execute code; the PCAP file transfer only shows the delivery, not the execution or trigger.

Why this answer

How to eliminate wrong answers

Option A is wrong because confidentiality concerns unauthorized access to or disclosure of information, not unauthorized modification. Option B is wrong because availability ensures that systems and data are accessible when needed; file modification does not inherently prevent access. Option D is wrong because non-repudiation provides proof of origin or delivery of data (e.g., via digital signatures), not protection against unauthorized changes.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A (Brute force) is wrong because it typically involves many password attempts against a single account, not multiple accounts from one IP. Option B (Dictionary attack) is wrong because it uses a list of likely passwords against one account, not spreading attempts across accounts. Option C (Credential stuffing) is wrong because it uses previously breached username/password pairs from other services, not a single IP trying common passwords across accounts.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because piping tcpdump output through `-X` prints hex and ASCII, but the grep for 'string' will match any occurrence in the raw packet data, not specifically within HTTP POST URIs, and it lacks a filter for port 80 or POST method. Option C is wrong because ngrep is not a standard tool included in most base Linux distributions or the Cisco exam's assumed toolset, and while it could work, the question asks for a command using tcpdump, making this an incorrect choice. Option D is wrong because it filters only for traffic to/from host 10.0.0.1 with `-nn` (no name resolution), but it does not isolate HTTP POST requests or search for a specific string in the URI.

Why this answer

How to eliminate wrong answers

Option A (MitM) is wrong because a man-in-the-middle attack intercepts or alters communication between two parties (e.g., ARP spoofing, SSL stripping), not overwhelming a server with traffic. Option B (DoS) is wrong because while a DoS attack also aims to make a service unavailable, the question explicitly states 'multiple compromised systems,' which distinguishes it as a distributed attack; a standard DoS originates from a single source. Option C (Botnet) is wrong because a botnet is the network of compromised devices used to launch the attack, not the attack itself; the question asks for the type of attack, not the infrastructure.

Why this answer

How to eliminate wrong answers

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because brute-force tools cannot bypass account lockout policies enforced by the authentication system (e.g., Windows Active Directory or Linux PAM); lockout is a server-side mechanism that applies regardless of the tool used. Option C is wrong because if the server were missing log entries, the SIEM would show fewer events than the server, not more; the alert shows thousands of attempts, indicating logging is capturing them. Option D is wrong because the alert is not a false positive—it accurately reflects the high volume of failed attempts from that IP; the misconfiguration would be in the analyst's interpretation, not in the SIEM rule.

Why this answer

How to eliminate wrong answers

Option A is wrong because creating shared admin accounts violates accountability and makes it impossible to attribute actions to specific individuals, while also providing standing privileges that exceed least privilege. Option C is wrong because granting permanent admin rights to all senior administrators gives them continuous, unnecessary access, directly contradicting the principle of least privilege. Option D is wrong because monitoring admin activity without restricting access does nothing to reduce the attack surface; it only observes violations after they occur, failing to enforce least privilege proactively.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a false positive would typically produce alerts from a single or few IPs due to benign traffic matching a signature, not a coordinated pattern of multiple distinct internal IPs triggering the same alert. Option B is wrong because a DDoS attack would involve multiple sources targeting a single victim, but the sources are usually external (or a mix), and the alerts would likely show varied signatures or traffic types, not the same signature repeated from internal IPs. Option D is wrong because a misconfigured server would cause alerts from that server's IP only, not from multiple different internal IPs, and the signature would typically reflect the misconfiguration (e.g., protocol violations) rather than a consistent outbound connection pattern.

Why this answer

How to eliminate wrong answers

Option A is wrong because a service being running is not inherently suspicious; many legitimate services run continuously. Option B is wrong because the service name 'WindowsUpdate' is not misspelled; it matches the expected name for the Windows Update service. Option C is wrong because the service displaying 'WindowsUpdate' is expected behavior for a service named that; the suspicious element is the binary path, not the display name.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because allowing the device and updating the policy would undermine the existing AUP without a formal review process; it conflates a single violation with a policy change, which should involve management and legal review, not an ad hoc decision. Option B is wrong because blocking the device and investigating is an overly aggressive response for a first-time AUP violation that does not indicate malicious intent; investigation is warranted only if there is suspicion of data exfiltration or malware, which is not described. Option D is wrong because disabling the network port is a drastic measure that could disrupt legitimate business operations and is typically reserved for repeated violations or security incidents, not a single policy infraction.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because a legitimate Windows update uses Microsoft's own signed binaries and update servers, and its traffic does not match the specific patterns of a Trojan signature; Snort would not trigger on benign update traffic unless a false positive occurs due to a poorly tuned signature. Option C is wrong because a misconfigured firewall might cause connectivity issues or block legitimate traffic, but it does not generate Trojan-specific network payloads that would match this signature. Option D is wrong because a buffer overflow exploit typically targets a vulnerability in a service or application and would be detected by a different class of signatures (e.g., 'ET EXPLOIT' or 'SHELLCODE'), not a generic Trojan signature.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because asymmetric encryption uses a pair of keys (public and private) for encryption and decryption, not a single key. Option C is wrong because a digital signature is a cryptographic mechanism for authentication and non-repudiation, not an encryption method; it uses asymmetric keys to sign and verify, not to encrypt data. Option D is wrong because hashing is a one-way function that produces a fixed-size digest and cannot be reversed to recover the original data, so it does not support both encryption and decryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because a single failed SSH login is a common benign event (e.g., typo, forgotten password) and would generate excessive false positives, failing to indicate a brute force attack. Option C is wrong because successful SSH logins outside business hours may indicate unauthorized access but do not directly detect the repeated failed attempts that define a brute force attack; this rule would miss the attack entirely. Option D is wrong because multiple failed logins from various IPs in one hour suggests a distributed attack (e.g., credential stuffing) rather than a classic brute force from a single source, and the one-hour window is too long to trigger timely response, allowing many attempts before alerting.

Why these pairings

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the parent process were terminated immediately after spawning, the parent process ID (PPID) would still be recorded in the event log, and the parent process path would not be empty—it would show the path of the terminated process. Option C is wrong because event log corruption would typically manifest as missing events, garbled data, or error codes, not as a consistently empty parent process path for a specific event type. Option D is wrong because kernel threads are not user-mode processes and do not generate Event ID 4688 logs; they are managed by the kernel and appear in different log sources or not at all.

Why this answer

How to eliminate wrong answers

Option A is wrong because running a full antivirus scan is reactive and may not detect the specific malware variant if signatures are outdated or if the malware employs evasion techniques like packing or polymorphism; the hash match already confirms maliciousness, so scanning adds no new forensic value. Option B is wrong because disabling the network adapter is a network-based containment step, not a host-based analysis step; while it may prevent C2 communication, the question specifically asks for the next best step in host-based analysis, which should focus on understanding the malware's local impact and persistence. Option D is wrong because rebooting the host may clear malware from memory (e.g., fileless malware), but it destroys volatile evidence such as running processes, network connections, and memory-resident artifacts, and it does not address persistence mechanisms that would cause the malware to reload on startup.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because authentication verifies the identity of a user or device (e.g., via passwords, certificates, or biometrics) but does not prevent the user from later denying they performed an action. Option B is wrong because accountability refers to the ability to trace actions back to a specific entity through logging and auditing, but it does not inherently provide cryptographic proof to prevent denial. Option C is wrong because authorization controls what resources or actions a user is permitted to access (e.g., via ACLs or RBAC), but it does not address the issue of denying past actions.

Why this answer

How to eliminate wrong answers

Option A is wrong because the ACL is explicitly denying traffic, not permitting it; the access group is used to apply the ACL, but the ACL itself contains a deny statement. Option B is wrong because the ACL denies UDP traffic to port 53, but TCP traffic to a DNS server (port 53) is not affected by this rule; the rule only targets UDP. Option D is wrong because the ACL denies UDP traffic from any source, but ICMP traffic uses a different protocol (type 1) and is not affected by a UDP-specific deny statement.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Application log records events from applications and programs, not authentication or logon activities. Option B is wrong because the System log records events from Windows system components (e.g., driver failures, service starts), not user logon events. Option C is wrong because the Setup log records events related to Windows installation and updates, not user authentication or logon activity.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the host is already isolated from the network; further firewall blocking is redundant, and memory acquisition is a forensic step, not containment. Option B is wrong because simply removing the file and killing the process does not address the compromised credentials or potential lateral movement via SMB; the attacker could re-authenticate or have already moved to other hosts. Option C is wrong because powering off and reimaging destroys volatile evidence and does not revoke the attacker's access via Kerberos tickets or changed passwords, allowing them to persist in the domain.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because the syslog shows the source IP is internal (10.0.0.10) and the destination is external (203.0.113.5), meaning the connection attempt originates from inside the network, not from an external host. Option B is wrong because a denial-of-service attack would typically generate multiple rapid connection attempts or specific DoS signatures, not a single deny message per connection; the ASA would also log a different severity or event type for DoS. Option D is wrong because a port scan would involve multiple destination ports or sequential connection attempts, but the log only shows a single denied connection to port 80, not a pattern of scanning behavior.

Why this answer

How to eliminate wrong answers

Option B is wrong because if SIEM correlation rules were accidentally disabled, the SIEM would stop generating alerts for all events, not just for this specific malware signature, and the sharp decrease would be broad, not isolated to one signature. Option C is wrong because the SIEM not receiving logs from the EDR tool would cause a loss of endpoint-based alerts, but the question states that endpoint scans still show infections, implying the EDR is still functioning and reporting; the decrease is in SIEM alerts, which are primarily network-based in this context. Option D is wrong because if the malware mutated into a different variant, it would evade detection by both network and endpoint tools, but endpoint scans still detect the infections, indicating the original signature is still present on the hosts.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because blocking all DNS queries to external domains not on a whitelist is a restrictive, policy-based approach that would break normal internet access for users and services, and it does not detect tunneling—it only prevents it, which is not a monitoring strategy. Option C is wrong because increasing Snort signature sensitivity for all DNS-related alerts to maximum would generate an overwhelming number of false positives from legitimate DNS traffic (e.g., normal lookups, NXDOMAIN responses), rendering the IDS alerts useless for actual threat detection. Option D is wrong because NetFlow monitoring on the DNS server for traffic volume anomalies is too coarse—DNS tunneling often uses low-and-slow data transfer that does not create significant volume spikes, and NetFlow lacks the packet-level detail (e.g., query payload size, entropy) needed to distinguish tunneling from normal DNS traffic.

Why this answer

Why this answer

Why this answer

Why this answer