What is the difference between an attack vector and an attack surface?
Answer(s): A
An attack vector is the method or path an adversary uses to exploit a weakness, while the attack surface is the collection of all points in a system where those weaknesses exist and where an attacker can attempt entry.
How does an attacker observe network traffic exchanged between two users?
Answer(s): B
In a man-in-the-middle (MITM) attack, an attacker intercepts communication between two parties without their knowledge. By positioning themselves between the communicating parties, the attacker can eavesdrop on the traffic passing between them, potentially capturing sensitive information, modifying data, or even injecting malicious content into the communication.
Which regular expression is needed to capture the IP address 192.168.20.232?
https://www.cisco.com/c/en/us/td/docs/security/security_management/cs-mars/4-3/user/guide/local _controller/appreexp.html
Refer to the exhibit. A SOC analyst is examining the Windows security logs of one of the endpoints. What is the possible reason for this event log?
Answer(s): C
Looking at the event log, there are several indicators that suggest a potential malware attack:● Event ID 4688: A new process was created in the *C:\Temp* directory (s21351b.exe). This is suspicious because legitimate processes typically don’t run from temporary directories, which are often used by malware to hide malicious executables.● Event ID 1102: The audit log was cleared by SYSTEM. Attackers often clear event logs to cover their tracks after gaining access to a system, which is a clear indicator of malicious activity.● Event ID 4657: A registry key related to Windows Defender was modified. Malware often disables security software like Windows Defender to prevent detection and removal.● Event ID 7045: The Windows Defender Antivirus Service was stopped. Stopping the antivirus service is a common action taken by malware to disable security defenses.These events together strongly suggest that a malware attack is taking place, where an attacker has executed a malicious process, modified system security settings, and disabled the antivirus to avoid detection.
Which evasion technique is a function of ransomware?
Answer(s): D
Extended sleep calls delay execution so that dynamic analysis environments (like sandboxes) time out before the malicious activity runs; this is a common time-based anti-analysis evasion technique used by ransomware/malware.
Post your Comments and Discuss Cisco 200-201 exam prep with other Community members: