Free 200-201 sample questions

Correct answer: if we change the VLAN of Fa0/2 to VLAN 3 and change the IP address of PC1 to 192.168.6.5, PC1 will be able to connect with PC0

Based on the network diagram shown in the image, the PCs are currently on different VLANs (VLAN 2 and VLAN 3) with different IP subnets, which prevents communication. To enable connectivity, both PCs must be on the same VLAN and same IP subnet. Changing Fa0/2 to VLAN 3 puts both PCs on the same VLAN, and changing PC1 IP to 192.168.6.5 puts them on the same subnet (192.168.6.0/24), allowing communication. Simply changing IP addresses without VLAN alignment or only changing VLANs without IP subnet alignment would not work.

Correct answer: HIDS

A Host-based Intrusion Detection System (HIDS) is deployed directly on endpoints as an agent or standalone application to monitor individual workstations. HIDS monitors system calls, file integrity, registry changes, and local network activity on the specific host. Network-based IDS (NIDS) operates at the network level, NIPS (Network Intrusion Prevention System) is network-based, and NGFW (Next Generation Firewall) is a network perimeter device. Only HIDS is specifically designed for endpoint deployment.

Correct answer: vulnerability

A vulnerability is an exploitable weakness in software or systems that has not been patched or mitigated. It represents a potential entry point for attackers but is not yet being actively exploited. An exploit is the actual method or code used to take advantage of a vulnerability, a threat is a potential danger, and a breach occurs when an attack successfully compromises a system. Vulnerabilities become dangerous when they remain unpatched and unmitigated, creating opportunities for exploitation.

Correct answer: Many TCP SYN packets are captures with the same sequence number, source, and destination IP address, but different payloads.

A TCP injection attack occurs when an attacker injects malicious data into legitimate TCP packets. The key indicator is multiple TCP SYN packets captured with identical sequence numbers, source and destination IP addresses, but different payloads - this shows someone is manipulating the packet contents. High volume scanning indicates reconnaissance activity, different IP addresses would suggest packet spoofing rather than injection, and slower actions indicate stealth techniques rather than injection attacks.

Correct answer: permissions

Linux manages ownership and control of objects through a comprehensive permissions system. This includes file permissions (read, write, execute), ownership (user and group), and access control mechanisms. The permission system controls who can access files, directories, and system resources, and what actions they can perform. Rights is too general a term, while permissions specifically refers to the Linux access control framework that governs object ownership and control.

Correct answer: X.509

Explanation: The standard for digital certificates is X.509. These text documents include identifying information of the holder, the most important being the public key of the holder. X.500 is the standards for directory services. Power over Ethernet (PoE) is defined by the IEEE 802.3af and 802.3at standards. PoE allows an Ethernet switch to provide power to an attached device by applying power to the same wires in a UTP cable that are used to transmit and receive data. PoE+ is an enhanced version of PoE that provides more power and better reliability. PoE+ is most commonly deployed in enterprise networks, while PoE is usually sufficient for small business or home networks. The IEEE 802.11 standard, which is the main standard for wireless LANs (WLANs), specifies using Carrier Sense Multiple Access/Collision Avoidance (CSMA/CA) for its media access method. Like an Ethernet network, which uses Carrier Sense Multiple Access/Collision Detection (CSMA/CD), wireless adapter cards “sense', or listen, for network traffic before transmitting. If the network is free of traffic, the station will send its data. The 802.22 standard also refers to CSMA/CA as Distributed Coordination Function (DCF).However, unlike an Ethernet network, wireless network cards cannot send and receive transmissions at the same time, which means that they cannot detect a collision. Instead, the sending station will wait for an acknowledgement packet (ACK) to be sent by the destination computer, verifying that the data was received. If, after a random amount of time, an acknowledgement has not been received, the sending station will retransmit the data. Objective: CryptographySub-Objective: Describe these items in regards to SSL/TLS: Cipher-suite, X.509 certificates, Key exchange, Protocol version, PKCS -- Reference: https://searchsecurity.techtarget.com/definition/X509-certificate

Correct answer: PKI

Explanation: A public key infrastructure (PKI) contains software hardware and policies that allow digital certificates to be created, validated, or revoked. A digital signature provides integrity, authentication, and non-repudiation in electronic mail. A PKI typically consists of the following components: certificates, a key repository, a method for revoking certificates, and a method to evaluate a certificate chain, which security professionals can use to follow the possession of keys. Pretty Good Privacy (PGP) is an email encryption system. PGP uses a web of trust to validate public key pairs. In a web of trust model, users sign their own key pairs. If a user wants to receive a file encrypted with PGP, the user must first supply the public key. Post Office Protocol (POP) is a client email program. It is used to retrieve email from the email server. Dynamic Host Configuration (DHCP) is a protocol that allows network administrators to centrally manage and automate the assignment of Internet Protocol (IP) addresses in an organization’s network. DHCP can automatically assign a new IP address when a computer is plugged into a different location on the network. Objective: Cryptography Sub-Objective: Describe the operation of a PKI -- Reference: https://searchsecurity.techtarget.com/definition/PKI

Correct answer: performs actions slower than normal

Explanation: Timing attacks are those in which operations carried out are done much slower than normal to keep the IPS or IDS from assembling the operation into a recognizable attack. Performing actions faster than normal might even make it easier for the IPS or IDS to assemble the parts of the operation into a recognizable attack. Delaying the attack will have no bearing how easily the IPS may or may not recognize the attack. Attackers really have no way of recognizing or acting upon an opportune moment. Objective: Attack MethodsSub-Objective: Describe these evasion methods: Encryption and tunneling, Resource exhaustion, Traffic fragmentation, Protocol-level misinterpretation, Traffic substitution and insertion, Pivot.

Correct answer: ABAC

Explanation: This is an example of attribute-based access control (ABAC). In this model, attributes and their combinations are used to control access. There are several classes of attributes that might be included: Role-based access control (RBAC) provides a specific set of rights and permission based on the job role assigned to the user. Discretionary access control (DAC) prescribes that the owner of an asset (data) decides the sensitively of the resource and who has access. Mandatory access control (MAC) creates clearance levels and assigns clearance levels to data assets and to users. Subjects (users) can only access levels to which they have been given clearance and those below. Objective: Security Concepts Sub-Objective: Compare and contrast these access control models: Discretionary access control, mandatory access control, Nondiscretionary access control

Correct answer: Layer 3

Explanation: Both IPv4 and IPv6 operate at the Network Layer 3 of the Open System Interconnection (OSI) model. The TCP/IP suite of protocols includes Address Resolution Protocol (ARP), Internet Protocol (IP), Internet Control Message (ICMP), Internet Group Management Protocol (IGMP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP).The TCP/IP suite operates at Layer 2, Layer 3, and Layer 4 of the OSI model follows:Layer 2, Data Link: ARPLayer 3, Network: IP, ICMP, IGMP, ARPLayer 4, Transport: TCP, UDPThe TCP/IP suite operates at layer 2, and layer 3 of the TCP/IP model as follows:Layer 1, Link: ARPLayer 2, Internet: IP, ICMP, IGMP, ARPLayer 3, Transport: TCP, UDPObjective: Network ConceptsSub-Objective: Describe the operation of the following: IP, TCP, UDP, ICMP -- Reference: http://www.ciscopress.com/articles/article.asp?p=1757634seqNum=2