A network engineer discovers that a foreign government hacked one of the defense contractors in their home country and stole intellectual property.
What is the threat agent in this situation?

the intellectual property that was stolen
the defense contractor who stored the intellectual property
the method used to conduct the attack
the foreign government that conducted the attack

Answer(s): D

Show Answer Next Question

QUESTION: 27 Exam Topic: Security Concepts

What is the practice of giving an employee access to only the resources needed to accomplish their job?

principle of least privilege
organizational separation
separation of duties
need to know principle

Answer(s): A

Show Answer Next Question

QUESTION: 28 Exam Topic: Security Concepts

Which metric is used to capture the level of access needed to launch a successful attack?

privileges required
user interaction
attack complexity
attack vector

Answer(s): A

Show Answer Next Question

QUESTION: 29 Exam Topic: Security Concepts

What is the difference between an attack vector and attack surface?

An attack surface identifies vulnerabilities that require user input or validation; and an attack vector identifies vulnerabilities that are independent of user actions.
An attack vector identifies components that can be exploited; and an attack surface identifies the potential path an attack can take to penetrate the network.
An attack surface recognizes which network parts are vulnerable to an attack; and an attack vector identifies which attacks are possible with these vulnerabilities.
An attack vector identifies the potential outcomes of an attack; and an attack surface launches an attack using several methods against the identified vulnerabilities.

Answer(s): C

Show Answer Next Question

QUESTION: 30 Exam Topic: Security Concepts

Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

integrity
confidentiality
availability
scope

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 7 of 70
Viewing questions 31 - 35 out of 477 questions

Post your Comments and Discuss Cisco 200-201 exam prep with other Community members:

Comments:

Name:

200-201 Exam Discussions & Posts
200-201 AI Verifications

Zed on: July 10, 2025
using this to prep for my exam
UNITED STATES

None-ya on: March 06, 2025
Just here for the practice.
UNITED STATES

AEB on: January 30, 2025
The breadth of knowledge for this exam is large. It doesn't seem possible to learn everything on it for an associate level exam.
UNITED STATES

Subnet on: August 27, 2026
This exam was tough but these questions really helped me pass.
Singapore

Microcode on: June 19, 2026
The exam was pretty rough but the practice questions on this site were a lifesaver.
United Kingdom

Strace on: June 27, 2026
Took my time reviewing and passed.
Canada

Baud on: July 09, 2026
Took a while but I managed to review these questions enough. This cert went well finally. Thanks to the exam prep here I passed eventually.
Iceland

Cgroups on: July 23, 2026
The exam was stressful. Glad I used this website.
France

Packet on: September 11, 2026
At first I didn't feel confident about this exam but using the practice questions here really helped me learn a lot.
Saudi Arabia

Inode on: July 06, 2026
Test was tough but practice helped. Big thanks.
Monaco

Sshd on: July 23, 2026
At first didn't feel confident about this exam but the practice questions were a lifesaver.
United States

Pids on: August 05, 2026
Work was crazy so I did short study bursts using this site's practice questions and now I'm just relieved it's over.
Belgium

Shebang on: August 20, 2026
This exam tough but these questions saved me.
Costa Rica

Ring0 on: July 01, 2026
The exam was tough but these questions got me through.
Australia

Symlink on: August 27, 2026
These questions were a lifesaver.
Costa Rica

VlanId on: August 12, 2026
Took my time with these questions slowly but surely got better passed the exam at last.
UAE

Synack on: September 11, 2026
Man this exam was a beast but these questions helped me chill. Glad I used the prep material here.
Israel

Parity on: July 25, 2026
Was pretty stressed about the exam but the practice questions really helped calm me down. I think they were relevant and that was good.
Israel

Vlan on: July 02, 2026
This exam was brutal but the practice questions helped so much. Glad that's over.
Italy

Linter on: July 13, 2026
I cram like crazy using this site and somehow save time and money to pass the exam slow.
New Zealand

Hexdump on: August 03, 2026
The exam was harder than I thought. AI assistant here really helped a lot.
Luxembourg

Scsi on: September 01, 2026
Thought I was toast but the practice questions helped heaps.
Argentina

Alex on: September 15, 2026
QUESTION: 729 mistake
Msida, Malta

Microcode on: July 18, 2026
I was cramming and this website saved me time and money since I passed the exam by going through it slowly.
Monaco

Osama Jat on: September 22, 2026
Me Osama Jat. Please give me provide CCNA real question. hepl in the ccna real exam.
Biratnagar, Nepal

ZeroDay on: August 31, 2026
This exam was a beast but these questions on the site helped me get through it.
Poland

Pdu on: July 02, 2026
I got through this exam slow but sure with cramming questions on the site saved me time and money passed it too.
Italy

Daemon on: August 06, 2026
Crammed like crazy using the exam prep on this site saved me some time and money for sure happy with how it turned out.
Australia

Semlock on: June 27, 2026
Took me a while but passed.
Costa Rica

Replica on: August 01, 2026
I crammed with the AI assistant on this site and saved some time and a bit of money got through this exam slowly but passed.
Finland

Anonymous User on: October 13, 2026
Upload this exam please! I am working on this one
Monroe, United States

Mtu on: August 31, 2026
Saved time and money with cramming got through exam slowly.
Spain

Hotfix on: July 28, 2026
Progress was slow but I passed.
France

Tcpdump on: September 15, 2026
Crammed with this site to save time and money passed the cert slow but steady.
Costa Rica

Heap on: July 05, 2026
I wasn't super confident but the practice questions here really helped me learn fast.
Sweden

Dnssec on: August 19, 2026
Work made me squeeze in short study sessions on the fly, so glad I passed and done with this cert.
Germany

Strace on: June 20, 2026
This exam was harder than I thought but with this website’s practice questions it was doable.
Taiwan

Traceroute on: June 27, 2026
The exam was a bit harder but doable.
Greece

Backplane on: June 28, 2026
Honestly the exam was pretty tough and covered a bit more than I thought. The AI assistant on this site came in clutch though.
Italy

Hotfix on: September 10, 2026
The exam was stressful. Practice questions helped though.
Kuwait

Vlan on: July 18, 2026
Barely had time between work but glad these questions helped me pass.
Panama

Posix on: June 23, 2026
I didn't feel confident at first but practice questions really helped me learn what I needed for this cert.
Australia

Systemd on: August 09, 2026
This website saved me time and money passed this exam.
France

Strace on: September 06, 2026
Man the exam covered more than I thought it would and it was tough. Luckily the AI assistant on this site really helped break down some tricky parts so that was good.
Chile

Tcpdump on: September 07, 2026
Man this exam was a beast. Happy I used the prep from this website 'cause it chilled me out some.
Norway

Anycast on: September 06, 2026
The AI assistant on this site helped me save a lot of time and money by cramming relevant questions at my own pace and I passed the exam comfortably.
New Zealand

Sysctl on: September 05, 2026
This exam threw me a curveball with more topics than I expected but the prep on this website helped out. The AI assistant nailed it by clarifying tricky bits which saved my skin.
Sweden

Prasi on: October 13, 2026
So far so good
Dublin, Ireland

Sshd on: August 26, 2026
Man the exam was a grind but thank god for these practice questions. Wouldn't have made it through without this website's prep stuff.
Netherlands

Bytecode on: July 01, 2026
Work crazy but short study breaks helped me pass the cert bro.
Belgium

AI Explanation - verified by User1028 on: September 22, 2026
Question 1:
The answer key shows C, but I believe the best answer is A: Provides a scalable platform for developing and deploying generative AI solutions.
Why:

Microsoft Foundry is an enterprise platform for developers, data scientists, and IT teams.

It supports the full AI application lifecycle: selecting models, connecting enterprise data, developing, evaluating, deploying, monitoring, and scaling solutions.

It can include visual tools and low-code experiences, but it is not primarily designed to enable business users to build complete generative AI solutions independently.

Why the other options are weaker:

B: You still need to select and configure an appropriate model.

C: Business users may participate through visual tools, but they are not the primary target audience.

D: Foundry includes low-code tools, but it is not fundamentally a low-code-only platform.

Exam takeaway: Microsoft Foundry’s key benefit is an enterprise-grade, scalable environment for building and managing generative AI applications and agents.
Chennai, India

AI Explanation - verified by User3698 on: September 22, 2026
Question 12:
The answer key selects D — Exploitation, but the question is imperfect.
In the Cyber Kill Chain:

Reconnaissance: Gathering information about the target.

Weaponization: Creating or combining a malicious payload with a delivery method.

Delivery: Sending the payload, such as through phishing.

Exploitation: Triggering a vulnerability or weakness to gain execution or access.

Social engineering exploits a human weakness, so the moment the victim is manipulated and the attacker gains initial access, Exploitation is the closest available option.
However, the phrase “does not want to lose access” more specifically suggests Installation or Command and Control, where an attacker establishes persistence or maintains remote access. Those stages are not offered.
Therefore, D is the best answer among these choices, but it should not be interpreted as meaning that exploitation itself is the persistence stage. The key distinction is: gaining access through a human weakness is exploitation; maintaining that access would normally involve later kill-chain stages.
Cuiabá, Brazil

AI Explanation - verified by sandrocarlos52 on: October 01, 2026
Question 43:
Você está certo em desconfiar do gabarito. A, C e E parecem ser as respostas corretas:

A — Increased call deflection: o KCS disponibiliza conhecimento reutilizável para clientes e agentes, ajudando a resolver dúvidas sem abrir ou continuar chamadas.

C — Reduced issue resolution time: os representantes reutilizam artigos e soluções já documentadas, acelerando o atendimento.

E — Optimized use of resources: o conhecimento compartilhado reduz retrabalho e melhora o uso dos recursos da equipe.

O gabarito mostra C, D e E, mas D — Reduced support channels não é um benefício típico do KCS. O objetivo é melhorar o suporte em vários canais, não necessariamente reduzir a quantidade deles.
B — Increased call routing accuracy também não é um benefício central do KCS; isso está mais relacionado a classificação, roteamento e configuração de filas.
Portanto, eu consideraria o gabarito dessa questão incorreto: A, C e E.
Recife, Brazil

AI Explanation - verified by User1570 on: September 17, 2026
Question 64:
Correct answer: C — SSH
The user wants remote command-line access to manage a development web server, but Telnet is insecure because it sends credentials and session data without encryption. SSH provides encrypted remote administration and is the standard secure replacement for Telnet.
Why the other options are incorrect:

HTTPS: Secure web traffic, not general command-line server administration.

SNMPv3: Secure network monitoring and management, not interactive server login.

RDP: Provides graphical remote desktop access. It can be secure, but it is not the direct replacement for Telnet in this scenario.

SMTP: Used to send email.

The key exam association is: Telnet ? replace with SSH.
Atlanta, United States

AI Explanation - verified by User5895 on: October 02, 2026
Question 8:
Correct answer: A — Apply tool output pruning.
In a multi-step workflow, tool results such as search results, file contents, or API responses may be useful temporarily but become irrelevant later. Tool output pruning removes those stale results from the active context while preserving the information still needed for future steps.
Why the other options are weaker:

B: Prompt caching reduces cost and latency for repeated content, but cached content still occupies the context window. It does not solve context accumulation.

C: Switching to a smaller model changes model capacity but does not address the growing context or remove irrelevant data.

D: Keeping everything indefinitely increases token usage, risks context-window limits, and can distract the model with outdated information.

The broader principle is context engineering: maintain the smallest high-signal context needed for the current task. In practice, an application might summarize important results, store durable state externally, and clear ephemeral tool outputs once they are no longer required.
Pune, India

AI Explanation - verified by User2639 on: September 22, 2026
Question 1:
Correct answer: B. Transfer
Risk transfer means shifting the financial impact or responsibility for a risk to another party. Cyber insurance is a classic example: the company pays an insurer to assume some of the financial loss associated with specified cyber incidents.

Accept: Acknowledging the risk without taking additional action.

Transfer: Moving the risk’s financial impact to a third party, such as an insurer.

Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.

Avoid: Eliminating the activity that creates the risk.

The insurance does not necessarily stop an attack from occurring; it primarily helps manage the consequences, which makes transfer the best choice.
Dallas, United States

AI Explanation - verified by User9782 on: September 18, 2026
Question 22:
Question 22 is referring to the Security Accounts Manager (SAM) database, which stores local Windows account information, including password hashes.

Correct exam answer: A — HKEY_LOCAL_MACHINE

The relevant location is associated with HKEY_LOCAL_MACHINE\SAM.

The SAM does not store passwords in plain text; it stores password hashes.

Why the other choices are less suitable:

HKEY_CURRENT_USER contains settings for the currently logged-in user, not the account-password database.

HKEY_USERS contains user profiles and settings loaded for users.

HKEY_CURRENT_CONFIGURATION contains hardware/profile configuration information.

Important nuance: The question’s wording is imprecise—it says “password file,” but the Registry location contains the SAM database and password hashes. The answer key’s A is consistent with the expected EC-Council concept.
Kolkata, India

AI Explanation - verified by User2484 on: September 13, 2026
Question 3:
Question 3 tests AWS Organizations SCP inheritance and temporary account onboarding.
Correct answer: D, assuming the option text means:

Create a temporary Onboarding OU.

Move the new account into it.

Move the restrictive SCPs from the organization root to the Production OU.

Allow the account to update AWS Config.

Move the account into Production after onboarding.

Why this works:

An SCP attached at the organization root applies to every account and OU beneath it.

An SCP attached to the Production OU applies only to accounts in that OU.

Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.

Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

Important nuance: An Allow SCP cannot override an explicit Deny SCP. Therefore, simply placing an Allow SCP on the Onboarding OU would not work if the root SCP explicitly denies the AWS Config actions.
The other choices either remove protections permanently, introduce unnecessary maintenance, or incorrectly assume that an Allow SCP overrides a Deny.
Madrid, Spain

AI Explanation - verified by User1726 on: September 17, 2026
Question 3:
Question 3: Correct answer — D: Host A is the ERSPAN source, and Host B is the traffic analyzer.
Key concepts:

The ERSPAN source is the device or interface whose traffic is being copied.

The ERSPAN destination is the device receiving the encapsulated copy and forwarding it to the traffic analyzer.

The local monitor session number is locally significant. Therefore, the source and destination do not need matching session IDs such as 47 or 48.

The erspan-id identifies the ERSPAN stream and must correspond between the source and destination configuration.

Thus, options claiming that session ID 47 or 48 must match are incorrect. Based on the exhibit referenced by the question, traffic flows from Host A toward Host B, making A the source and B the analyzer.
Paterson, United States

AI Explanation - verified by User7912 on: October 11, 2026
Question 30:
Answer: C
This design combines least-privilege IAM with organization-wide guardrails:

Create procurement-manager-role only in the shared services accounts, where procurement managers operate.

Attach AWSPrivateMarketplaceAdminFullAccess to that role.

Procurement managers assume the role when they need to administer Private Marketplace.

Apply a root-level SCP that explicitly denies Private Marketplace administration to everyone except that role. The SCP acts as a maximum-permission boundary across member accounts.

Add another SCP denying creation of a role with the same name. Otherwise, another administrator might create a similarly named role and bypass the intended exception.

Why the other options are weaker:

Creating the role in every account increases administration and creates more opportunities for misuse.

A permissions boundary on developer roles does not prevent other administrators from managing Private Marketplace.

Applying the SCP only to shared services accounts would not protect the rest of the organization.

The key idea is that IAM grants the permitted role access, while the SCP explicitly denies everyone else. Note that SCPs do not grant permissions themselves; the role still requires its IAM policy.
Móstoles, Spain

AI Explanation - verified by User3463 on: October 14, 2026
Question 4:
Correct answer: D. Shadow IT
Shadow IT refers to employees using unauthorized or unapproved applications, services, devices, or network connections to perform work. By bypassing the company VPN, the R&D department is accessing company resources outside the organization’s approved security controls.
Why the others are incorrect:

Espionage: Stealing information, usually for competitive or political purposes.

Data exfiltration: Unauthorized removal or transfer of data.

Nation-state attack: An attack sponsored or conducted by a government.

Shadow IT: Unapproved technology or access methods used by employees.

The question does not state that data was stolen or that an external attacker was involved; it focuses on the use of an unapproved access method.
Broomfield, United States

AI Explanation - verified by zakhele.mbebe on: October 06, 2026
Question 109:
Correct answer: B. Reports
In the Microsoft 365 Defender portal, use Reports to view security trends and monitor the protection status of identities and other security areas. Reports provide dashboards, metrics, and historical insights that help track changes over time.
Why the others are incorrect:

Attack simulator — Used to run phishing and other attack simulations for user awareness training.

Hunting — Used to proactively query security data and investigate potential threats.

Incidents — Used to investigate and manage related alerts and active security events.

So, when the question focuses on trends and tracking protection status, choose Reports.
Johannesburg, South Africa

AI Explanation - verified by User3916 on: October 12, 2026
Question 101:
Correct answer: D. Due diligence
The analyst is evaluating whether a SaaS vendor is trustworthy and meets the organization’s security requirements before adoption. Requesting a SOC 2 report is a typical part of third-party/vendor due diligence.
Why the others are less appropriate:

Internal audit: Reviews the organization’s own controls and processes.

Penetration testing: Actively tests systems for exploitable vulnerabilities.

Attestation: A SOC 2 report is an attestation product issued by an independent auditor, but the analyst is not performing the attestation. They are reviewing it as part of vendor evaluation.

Exam clue: When an organization investigates a service provider before entering into or continuing a relationship, think due diligence.
San Jose, United States

AI Explanation - verified by User6966 on: September 23, 2026
Question 37:
Question 37 asks you to choose three true statements about Snowflake data loading.
Correct answers: A, C, and D.

A — VARIANT "null" values are not the same as SQL NULL values: True

- A JSON null stored in a VARIANT column is a value representing JSON null. - SQL NULL means the value is missing or unknown. Snowflake treats them differently in comparisons and functions.

B — Frequent, single-row DMLs: False

- Snowflake is optimized for batch-oriented processing rather than many individual INSERT or UPDATE statements. - Loading data in batches generally provides better performance and efficiency.

C — Validate data before loading into the target table: True

- Data should be checked for format, structure, data types, and quality before it reaches the production target. - Snowflake supports validation approaches such as checking staged files and using COPY INTO validation options.

D — Use staging tables to manage MERGE statements: True

- Data is commonly loaded into a staging table first. - A MERGE can then compare staging data with the target and perform controlled inserts, updates, or deletes.
The answer key’s A, C, D is consistent with Snowflake loading b
Erlanger, United States

AI Explanation - verified by User7020 on: September 26, 2026
Question 86:
Correct answer: OWASP
OWASP, especially the OWASP Top 10, provides information about common ways web applications are exploited, such as:

Injection

Broken access control

Authentication failures

Security misconfiguration

Cross-site scripting

Why the others are less suitable:

STIX: A standardized language and format for exchanging threat intelligence.

OVAL: Used to describe and assess system vulnerabilities and configuration issues.

Threat intelligence feed: Provides current indicators and intelligence about threats, but not necessarily a structured overview of common application exploitation methods.

CVE: A catalog of individually identified, publicly disclosed vulnerabilities.

The answer key’s A is correct. For application-security attack methods, think OWASP; for vulnerability identifiers, think CVE.
Seattle, United States

AI Explanation - verified by nhoxzznhox15 on: September 12, 2026
Question 137:
Correct answer: C — AWS Network Firewall with a Lambda-created drop rule.
Why:

AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.

GuardDuty findings are sent to Security Hub.

A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

Why the others are incorrect:

GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.

AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.

GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

A practical implementation would also need appropriate IAM permissions and a mechanism to update or remove expired block rules. The firewall must be correctly placed in the VPC traffic path for the drop rule to be effective.
Duong Minh Châu, Vietnam

AI Explanation - verified by User3133 on: September 21, 2026
Question 54:
Correct answer: C — Guardrails for Amazon Bedrock
Guardrails for Amazon Bedrock help control both the input prompts and model responses. The company can configure safeguards such as:

Filtering harmful or inappropriate content

Blocking specified topics

Detecting and masking sensitive information

Enforcing content policies suitable for children

Why the others are incorrect:

Amazon Rekognition analyzes images and videos; it does not control text generated by a language model.

Amazon Bedrock playgrounds are for testing models and prompts, not enforcing production safety policies.

Agents for Amazon Bedrock help models complete tasks and use tools; they do not primarily provide content-safety controls.

For exam questions involving safe, age-appropriate, or policy-compliant Bedrock output, look for Guardrails for Amazon Bedrock.
Bangkok, Thailand

AI Explanation - verified by User5938 on: September 26, 2026
Question 16:
Correct answer: Two (B).
BC should choose the treatment that gives a fair representation of the transaction in the financial statements.
Why:

Treatment one – easier to prepare: Convenience for the accounting team is not the main objective of financial reporting.

Treatment two – fair representation: This is the correct choice because financial statements must faithfully represent the underlying transaction and its economic substance.

Treatment three – maximises profit: Accounting policies must not be selected simply to manipulate or inflate reported profit.

Treatment four – easier to understand: Understandability is important, but it cannot justify presenting information that is less faithfully represented.

The key exam principle is that accounting information should be relevant and faithfully represented. When choosing between accounting treatments, the one that best reflects the actual economic substance of the transaction should be selected—not the one that is easiest or produces the most favourable result.
Maseru, Lesotho

AI Explanation - verified by User6575 on: October 11, 2026
Question 27:
Correct answer: D — Information Technology Infrastructure Library (ITIL)
ITIL is a widely used framework of IT service management best practices. It helps organizations standardize and improve processes such as:

Incident and problem management

Change management

Service-level management

Configuration management

Continual improvement

These practices help reduce unnecessary costs, mitigate operational and security risks, and improve the consistency and quality of customer service.
Why the others are less suitable:

Kanban: A workflow and task-visualization method; useful within service teams but not a complete service-management framework.

Lean Six Sigma: Focuses on reducing waste and process variation; broader process-improvement methodology.

ITSM: The overall discipline of managing IT services, not a specific framework or process model.

Strictly speaking, ITIL is a framework rather than one individual process, but it is the best answer among the choices.
Mexico City, Mexico

AI Explanation - verified by swatisharma4781 on: September 21, 2026
Question 93:
Correct answer: B. They must be uppercase.
Splunk recognizes Boolean operators when written in uppercase:

spl error AND host=WWW3 status=404 OR status=500 NOT source=access.log

Using lowercase words such as and, or, or not may cause Splunk to interpret them as search terms rather than Boolean operators.

Quotation marks are used for exact phrases or values containing spaces.

Parentheses group parts of a Boolean expression, but they are not required for every Boolean search.

The answer key’s B is correct.
Lexington, United States

AI Explanation - verified by User1608 on: October 02, 2026
Question 7:
Correct answer: Standard.
The Standard App Service tier satisfies all requirements:

Custom domains are supported.

It provides dedicated compute instances.

It offers enough storage for the applications.

It supports multiple instances with load balancing between them.

It is less expensive than higher tiers such as Premium.

Why the others don’t qualify:

Free and Shared use shared compute and have limited storage, so they cannot meet the dedicated-instance requirement.

Basic provides dedicated compute and custom domains, but the question’s requirement for the broader multi-instance/load-balancing capability is intended to point to Standard.

Therefore, the answer key’s A (Standard) is correct. Azure App Service features and tier names can change, so the exact capability matrix depends on the exam version.
Coimbatore, India

AI Explanation - verified by User8102 on: September 29, 2026
Question 3:
Correct answer: C — The document feeder
The printer produces a vertical line only when copying or scanning, while normal printed pages and received faxes are clean. This isolates the problem to the scanner/document-feeder path, not the laser-printing system.

Document feeder: A scratch, dirt, or debris on the feeder glass or rollers can create a line on every scanned image.

Pickup rollers: Move paper through the printer; they would not normally create a scanner-only line.

Corona wire: Affects toner charging and would cause defects on printed output.

Drum assembly: Also affects printed pages, so faxes and computer print jobs would show the line too.

When troubleshooting, clean and inspect the scanner glass, narrow document-feeder glass strip, and feeder rollers.
Lilongwe, Malawi

AI Explanation - verified by User2896 on: September 26, 2026
Question 13:
Correct answer: A — Multitenancy
Multitenancy is a cloud design in which one application or infrastructure environment serves multiple groups of users or organizations while keeping their data and access logically separated. Here, the company application is hosted in the cloud and made available to both internal users and third parties.

VPC: A logically isolated virtual network within a cloud provider; it describes network design, not the user-access model.

NFV: Runs network services as software instead of on dedicated hardware.

SaaS: Delivers software over the internet. Although the application may be delivered as SaaS, the question emphasizes its availability to multiple user groups, which points to multitenancy.

Khulm, Afghanistan

AI Explanation - verified by User6133 on: September 20, 2026
Which of the following is a feature of a next-generation SIEM system?
Correct answer: B. Automated response actions
A next-generation SIEM combines log collection and correlation with advanced capabilities such as:

Behavioral and anomaly detection

Threat intelligence integration

User and entity behavior analytics

Automated response actions, often through SOAR integration

Why the others are less appropriate:

Virus signatures: Associated primarily with antivirus or endpoint protection.

Security agent deployment: Usually an endpoint-management or EDR function.

Vulnerability scanning: Typically performed by vulnerability-management tools, though a SIEM may integrate their results.

The key distinction is that a next-generation SIEM can help detect and automatically respond to threats, rather than only recording and displaying events.
Kissimmee, United States

AI Explanation - verified by Tholang2016 on: September 11, 2026
Question 152:
Correct answer: A — Efficient
The three Es in not-for-profit performance measurement are:

Economy: Obtaining inputs at the lowest appropriate cost.

Efficiency: Making the best use of resources, such as staff, money, and equipment.

Effectiveness: Achieving the intended objectives or outcomes.

“Optimum utilization of available resources” describes efficiency, so the organization is efficient.
For example, a charity is efficient if it delivers its services using the minimum resources necessary, but it is effective only if those services achieve the intended social results.
Maseru, Lesotho

AI Explanation - verified by User6133 on: September 20, 2026
Question 21:
Correct answer: C — Internal auditing
An internal audit is a systematic review of an organization’s systems, policies, and procedures to determine whether they comply with defined requirements, regulations, and internal objectives.
Why the others are less suitable:

Third-party attestation: Provides independent validation, but is typically periodic and performed by an external party.

Penetration testing: Simulates attacks to identify exploitable vulnerabilities; it does not primarily track compliance.

Vulnerability scans: Identify technical weaknesses, but do not provide a detailed review of procedures or compliance activities.

The key clues are “frequent, detailed reviews” and “track compliance objectives,” which point to internal auditing.
Kissimmee, United States

AI Explanation - verified by User3500 on: September 22, 2026
Question 101:
Correct answer: D — Due diligence
The analyst is evaluating a SaaS vendor before allowing the organization to use its service. Requesting and reviewing the vendor’s SOC 2 report helps determine whether the vendor has appropriate security and operational controls.

Due diligence: Researching and evaluating a third party before entering or continuing a business relationship.

Internal audit: Evaluates controls within the organization itself.

Penetration testing: Actively tests systems for exploitable vulnerabilities.

Attestation: A formal statement or report—such as a SOC 2 report—provided by an independent party about an organization’s controls.

The SOC 2 report is an attestation product, but the analyst’s activity—reviewing it to assess the vendor—is due diligence.
Essex, United States

AI Explanation - verified by User8545 on: September 26, 2026
Can pcs with differet / or ip range can communicate with each other?
Yes, PCs in different IP ranges can communicate, but they usually need a router or Layer 3 switch to route traffic between their networks.
Example:

PC A: 192.168.1.10/24

PC B: 192.168.2.10/24

These are different subnets. They can communicate if:

Both PCs have a correct default gateway

A router or Layer 3 switch connects the subnets

Routing and firewall rules allow the traffic

Without a router, they generally cannot communicate directly because each PC believes the other is on a different network and sends the traffic to its gateway.
The /24 is the subnet prefix length. It determines which addresses are considered local. For example, with 192.168.1.0/24, addresses from 192.168.1.1 through 192.168.1.254 are in the same subnet. A PC at 192.168.2.x is outside that subnet.
Also, PCs in the same broad IP range may still be unable to communicate if VLANs, subnet masks, ACLs, or firewalls separate them.
Quezon City, Philippines

AI Explanation - verified by User6921 on: October 16, 2026
Question 30:
Correct answers: C and D

C. An auto-labeling policy for a retention label

D. A retention label

Why:

Create a retention label configured to:

- Retain content for 12 months - Base the period on when the content was created - Delete the content at the end of the retention period

Create an auto-labeling policy that detects the built-in Credit Card Number sensitive information type (SIT) and automatically applies the retention label to matching messages and documents.

A separate SIT is unnecessary because Microsoft Purview already provides a built-in credit card number SIT.
The sensitivity-label options are incorrect because sensitivity labels protect content through classification, encryption, or access controls; they do not provide the required automatic deletion lifecycle.
Bogotá, Colombia

AI Explanation - verified by renrubshac on: October 13, 2026
Question 241:
The answer key shows C (Journaling), but I believe the best answer is D: Hot site.

RTO is how quickly service must be restored.

RPO is how much data loss is acceptable.

A hot site is a fully configured, operational backup environment that can take over quickly, typically using current or near-current data replication. Therefore, it generally provides the lowest RTO and RPO of these choices.
Why the others are less suitable:

Snapshots: Restore points may be older and require restoration time.

On-site backups: Usually require rebuilding or restoring systems, producing higher RTO/RPO.

Journaling: Records database changes and can reduce data loss, but it still generally requires recovery or replay operations; it does not by itself provide the fastest service restoration.

Hot site: Designed for rapid failover and minimal data loss.

Frederick, United States

AI Explanation - verified by khamankopane66 on: September 14, 2026
Question 16:
Correct answer: A, C and D.
Management should ensure:

A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.

C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.

D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

Why the others are not essential prerequisites:

B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.

E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

Maseru, Lesotho

AI Explanation - verified by User6296 on: September 22, 2026
Question 5:
Your understanding is partly correct, but a sensitivity label does not automatically exclude a file from Copilot.

Labels control access and protection, not blanket exclusion.

If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.

If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.

Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

Therefore, in Question 5, a labeled file may contribute to a summary when the requester is authorized. The resulting content can also receive sensitivity-label protection, depending on the configured label and Copilot’s labeling behavior.
The supplied explanation may be oversimplified: content marking (headers, footers, watermarks) is not the same as access protection. A label with content marking disabled can still restrict access through encryption. Conversely, merely having a label does not mean the file is excluded from Copilot.
The actual Hotspot image is unavailable here, so I cannot verify each Yes/No row, but the key principle is: labeled does not mean excluded; unauthorized does mean inaccessible.
Nagpur, India

AI Explanation - verified by talk2vachan on: October 13, 2026
You have an Azure AI Search indexer that ingests PDF policy manuals. Client applications must display page-level citations that have bounding polygons for both text and images. You need to add a single built-in multimodal content extraction skill to the Azure AI Search skillset. The solution must meet the following requirements: ? Provide text and image location metadata. ? Extract tables that span multiple pages. What should you add? A. Document Extraction B. Azure Content Understanding in Foundry Tools C. GenAI Prompt D. Document Layout
Correct answer: D. Document Layout
The Document Layout skill is designed for multimodal document extraction and can provide:

Extracted text and images

Page numbers and bounding polygons for citation or grounding

Structured tables, including tables that continue across multiple pages

Document structure such as sections and figures

Why the others are less suitable:

Document Extraction: Extracts basic text and images, but does not provide the full layout and structural metadata required here.

Azure Content Understanding in Foundry Tools: A broader content-analysis service, not the single built-in Azure AI Search skill expected by this question.

GenAI Prompt: Can transform or interpret content but does not inherently produce reliable document geometry and page-level polygons.

Therefore, add the Document Layout skill to the skillset.
Pune, India

AI Explanation - verified by User4530 on: September 30, 2026
Question 10:
Correct answer: Yes (A).
For a SQL Server Always On availability group listener hosted on Azure VMs, the Azure internal load balancer must use Floating IP—also called Direct Server Return (DSR).
Why:

The load balancer provides the listener’s frontend IP address.

The active SQL Server node must also respond to that same listener IP.

Enabling Floating IP allows the listener IP to be preserved and handled correctly by the active replica.

Without it, SQL connections may be sent to a node that cannot correctly claim the listener address.

The load balancer configuration normally also requires:

A health probe for the SQL Server port

A load-balancing rule using the listener port

Floating IP enabled on that rule

Therefore, the proposed solution—enable Floating IP—meets the goal.
Richmond, United Kingdom

AI Explanation - verified by User3503 on: September 15, 2026
Question 104:
Correct answer: C. WAF (Web Application Firewall)
A WAF is designed to protect web applications and web portals by inspecting HTTP/HTTPS traffic. It can detect and block attacks such as:

SQL injection

Cross-site scripting (XSS)

Malicious or malformed web requests

Some application-layer attacks

Why the others are less suitable:

Layer 4 firewall: Filters based mainly on IP addresses, ports, and transport protocols; it cannot deeply inspect web application content.

NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specifically designed to protect web applications.

UTM: Combines several security functions in one appliance, but it is not the most targeted solution for a web portal.

Because the requirement specifically involves protecting a customer-facing web service, a WAF is the best choice.
New York, United States

AI Explanation - verified by User6020 on: September 23, 2026
Meaning of severity
Severity means the size or seriousness of the impact if a risk occurs.
In risk management:

Frequency/likelihood = how often or how likely the risk is to occur.

Severity/impact = how damaging or costly the consequences would be.

For example:

A minor equipment fault occurring frequently may have high frequency but low severity.

A major cyberattack occurring rarely may have low frequency but high severity.

A risk that happens often and causes substantial losses has high frequency and high severity.

Maseru, Lesotho

AI Explanation - verified by User8696 on: September 27, 2026
Question 17:
Correct answer: D. 587
Port 587 is commonly used for secure SMTP submission—sending email from a mail client to an email server. It typically uses authentication and can upgrade the connection to encryption with STARTTLS.
Why the others are incorrect:

25 — Traditional SMTP server-to-server mail delivery; often restricted and not the usual client submission port.

110 — POP3, used for retrieving email; normally unencrypted.

143 — IMAP, used for retrieving and synchronizing email; normally unencrypted.

Important nuance: Port 587 is not automatically encrypted merely because of its number; secure configuration generally requires STARTTLS. Port 465 is also associated with implicit TLS for SMTP, but it is not listed here.
Harlingen, United States

AI Explanation - verified by User3021 on: September 20, 2026
Question 6:
The correct answers are C and D:

Report on the discount approval time for quotes

If opportunities increasingly require discounts, slow approval cycles can delay closing. A report can show whether quote approval time has increased.

Dashboard of opportunity stage duration

This shows how long opportunities remain in each sales stage. Management can identify the stage where opportunities are now taking longer than usual.
The other options are less relevant:

Lead conversion trends measure lead-generation effectiveness, not opportunity closing time.

Campaign ROI evaluates marketing performance, not delays in the sales process.

Warsaw, Poland

AI Explanation - verified by User6020 on: September 23, 2026
Question 132:
Correct answer: C — Cost of components purchased
A transfer price is the price charged when one division supplies another division within the same company.
For the supplying division:

Operating profit is affected because transfer price determines internal sales revenue.

Return on investment (ROI) is affected because ROI depends partly on operating profit.

Sales revenue is affected because the division records revenue from transferring its output.

Cost of components purchased is not affected by the transfer price. These are input costs paid to external suppliers and are based on the supplier’s price.

Therefore, the transfer price affects the division’s reported performance but does not change the actual external cost of components purchased.
Maseru, Lesotho

AI Explanation - verified by User6285 on: September 16, 2026
Question 17:
Correct answer: B — Enabling malware detection through a UTM.
Customers are uploading PDF files, which could contain malicious code or exploit payloads. A UTM (Unified Threat Management) appliance can inspect uploaded content using integrated antivirus or malware-detection capabilities and block suspicious files before they reach internal systems.
Why the others are less suitable:

A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.

C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.

D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

The exam clue is “customers upload documents”—think file inspection and malware detection, not general web-attack filtering.
Secaucus, United States

AI Explanation - verified by User4118 on: October 02, 2026
Question 71:
Correct answer: B — In an Auto Scaling group
An Auto Scaling group (ASG) can automatically adjust the number of EC2 instances based on demand:

Scale out during the hours when customer traffic is high.

Scale in during low-demand periods, reducing instance-hours and cost.

Use scaling policies based on metrics such as CPU utilization or request count.

Why the others are not best:

Multiple Availability Zones: Improves availability and fault tolerance, but does not automatically reduce cost.

Placement group: Helps with specialized performance or low-latency requirements, not cost optimization.

Private subnets: Improve network security, but do not automatically adjust capacity or reduce EC2 usage costs.

The ASG should typically be combined with a load balancer and appropriately configured scaling policies.
Chennai, India

AI Explanation - verified by Azebrgb17 on: September 23, 2026
how to anlsis an offences in qradar siem
To analyze an offense in IBM QRadar SIEM, use this workflow:

Open the Offenses tab

- Review offense magnitude, severity, credibility, relevance, status, and time.

Open the offense details

- Check the offense description, source and destination IPs, users, ports, protocols, rules, and event counts.

Review contributing events

- Examine the raw events that caused the offense. - Verify timestamps, log sources, event names, usernames, and action fields.

Analyze the attack chain

- Look for related authentication failures, successful logins, privilege changes, malware alerts, network connections, or data access. - Use flow data to identify communication patterns and transferred data.

Investigate the assets

- Determine whether the source is an internal workstation, server, privileged account, or known threat indicator. - Check asset criticality and historical offenses.

Validate and respond

- Decide whether it is a true or false positive. - Add notes, assign the offense, follow the response playbook, and close it only after documenting the investigation.
Useful QRadar concepts include rules, offense contributors, events, flows, log sources, and offense magnitude.
Addis Ababa, Ethiopia

AI Explanation - verified by User3680 on: October 10, 2026
Question 12:
Correct answer: B — Compare the approved text with the product label.
When complaints concern labeling, the first step is to verify whether the marketed label matches the regulatory-approved labeling. This establishes whether there is an actual labeling discrepancy and defines the nature and scope of the issue.

Product recall: Premature before confirming a violation or assessing risk.

Notify the regulatory authority: May be required later, especially if the discrepancy affects safety or compliance, but first investigate and verify the facts.

Inform production: Not the initial regulatory assessment step; production may become involved if a packaging or manufacturing error is identified.

The key exam principle is: confirm the deviation against the approved reference before escalating or taking corrective action.
Salt Lake City, United States

AI Explanation - verified by User3075 on: October 09, 2026
Question 3:
Question 3 is a log-analysis hotspot. You must determine:

Which host originated the infection

Whether each other host is clean or infected

Which firewall or host logs provide evidence of the infection’s movement

The screenshots are shown only as [Image] here, so I can’t see the IP addresses, timestamps, connections, or alerts needed to verify the answer key’s “A.” I therefore can’t reliably confirm that A is correct.
Use this reasoning process:

Find the earliest infection-related event. The host associated with that event is the likely origin.

Follow the timeline: outbound connections from that host may indicate propagation or command-and-control activity.

A host receiving suspicious traffic is not automatically infected; look for evidence that it executed or initiated malicious activity.

A firewall log can show traffic paths, but endpoint logs are usually needed to confirm infection.

Mark a host clean only when the logs show no indicators of compromise or malicious activity.

If you provide the hotspot screenshots or transcribe each host’s logs, I can identify the source and classify every host precisely.
Victorville, United States

AI Explanation - verified by fuat on: September 21, 2026
Question 79:
Correct answers: C — Constrained VMs and D — Overprovisioned VMs
These views help identify VMs that are using resources inefficiently:

Constrained VMs: VMs whose workloads are experiencing resource pressure, such as insufficient CPU or memory. They may need additional resources or optimization.

Overprovisioned VMs: VMs allocated more CPU, memory, or storage than their workloads require. Their resources may be reclaimed or reduced.

Why not the others:

Underprovisioned VMs: This is not the predefined view identified for this report question.

Zombie VMs: These are typically inactive or unused VMs and are useful for cleanup, but they are not the two views specifically intended here to identify inefficient resource allocation.

The exam distinction is that constrained VMs need more suitable resources, while overprovisioned VMs have excess resources.
Stockholm, Sweden

AI Explanation - verified by User2736 on: October 16, 2026
Question 6:
Correct answer: B — Recall-Oriented Understudy for Gisting Evaluation (ROUGE)
ROUGE is designed to evaluate automatically generated text, especially summaries, by comparing them with a human-written reference summary.
It measures overlap such as:

ROUGE-N: matching word sequences, such as unigrams or bigrams

ROUGE-L: matching the longest common subsequence

ROUGE-Recall: how much of the reference content appears in the generated summary

Why the others are incorrect:

F1 score: A general classification metric based on precision and recall; not specifically designed for summarization.

Perplexity: Measures how well a language model predicts text, rather than how closely a generated summary matches a reference.

Fréchet Inception Distance (FID): Typically evaluates similarity between generated and real images, not text.

ROUGE is therefore the appropriate automated metric for comparing model-generated summaries with human reference summaries.
São Paulo, Brazil

AI Explanation - verified by User6946 on: October 11, 2026
Question 47:
Question 47 tests Power Query data-profiling and error-handling tools. The image containing the answer choices isn’t visible here, so I can’t verify the exact hotspot selections.
The concepts are:

To identify the number of errors: select Column quality. It shows the percentage and count of Valid, Error, and Empty values for each column.

To resolve errors: use the appropriate error transformation:

- Replace errors when you want to substitute an error with a valid value, such as 0, null, or another value. - Remove errors when rows containing errors should be deleted.
Therefore, if the question asks to preserve the rows while correcting their values, choose Column quality ? Replace errors. If it asks to eliminate problematic rows, choose Column quality ? Remove errors.
Singapore, Singapore

AI Explanation - verified by User2510 on: September 21, 2026
Question 3:
Correct answer: Change the DNS settings.
A computer joining an Active Directory domain must locate the domain controller using DNS, especially the domain’s SRV records. In this scenario, the workstation can ping the server and access the internet, so basic IP connectivity is working.
However, if it is configured to use public DNS servers such as 8.8.8.8 or 1.1.1.1, those servers will not know about the organization’s internal domain records. The workstation should use the organization’s internal DNS server, typically hosted on or associated with the domain controller.
Why the other options are incorrect:

Static IP address: Not needed if the workstation already has network connectivity.

Subnet mask: Incorrect subnetting would usually prevent local communication, including pinging the server.

Default gateway: Primarily affects communication outside the local network; it does not normally prevent finding an internal domain controller.

Key exam clue: Internet access and ping working do not prove that domain-name resolution is configured correctly.
Farmington Hills, United States

AI Explanation - verified by szb.brian on: September 14, 2026
Question 1:
Correct answer: B. Transfer
Purchasing cyber insurance is a risk transfer strategy. The company shifts some of the financial consequences of a cyber incident to an insurance provider in exchange for paying premiums.

Accept: Acknowledges the risk without taking additional action.

Transfer: Shifts the risk or financial impact to another party, such as an insurer.

Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.

Avoid: Eliminates the activity that creates the risk.

The answer key’s B is correct. Note that insurance does not eliminate the underlying threat; it primarily helps transfer the financial impact.
Yangon, Myanmar

AI Explanation - verified by User2164 on: September 29, 2026
Question 5:
Answer: No. The answer key’s B is correct.
Allow gateway transit must be enabled on the peering connection from VirtualNetworkA, because VirtualNetworkA contains the VPN gateway. This setting advertises that VNet A’s gateway can be used by the peered VNet.
Enabling it on VirtualNetworkB is incorrect because B does not contain the gateway. The corresponding configuration would be:

On VirtualNetworkA: enable Allow gateway transit.

On VirtualNetworkB: enable Use remote gateways.

However, in this scenario the Windows 10 device uses a point-to-site VPN connection. The P2S client’s downloaded VPN configuration may not contain routes for the newly peered VNet. Therefore, the practical fix is to download and reinstall the updated VPN client configuration package, as described in Question 6.
Sarajevo, Bosnia And Herzegovina

AI Tutor 👋 I’m here to help!

AI Tutor — 200-201

Hello,
I’m your AI study assistant for the 200-201 exam. Ask me anything about the exam or the questions on this page, and I’ll break it down so it actually makes sense.
You want it in a different language? Just say it.

Contact Us

Exam Vendors

Hay AI, Learn About Us

Customer Reviews

DMCA

Terms of Service

Privacy Policy

© 2026 Free-Braindumps.com - A Community of Learners.
Free-Braindumps.com is owned by Xùnliàn Limited, a company registered at 15 Wang Chiu Rd, Kowloon Bay, Hong Kong.

The resources, practice tests, and study guides on Free-Braindumps.com are strictly for educational and research purposes. We are an independent community platform and are not affiliated with, endorsed by, or sponsored by any official certification vendors, including Microsoft, Cisco, Amazon, CompTIA, or others. All certification names, trademarks, and logos are the property of their respective owners. Our content is user-contributed or independently developed to assist with exam preparation and skill assessment; we do not host or provide access to proprietary, confidential, or live exam questions.

Cisco 200-201 Exam Prep Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) (Page 7 )

QUESTION: 26 Exam Topic: Security Concepts

QUESTION: 27 Exam Topic: Security Concepts

QUESTION: 28 Exam Topic: Security Concepts

QUESTION: 29 Exam Topic: Security Concepts

QUESTION: 30 Exam Topic: Security Concepts

Cisco 200-201 Exam Prep
Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) (Page 7 )