CBROPS 2 | UPDATED Questions with 100% Verified
Answers
Q1: NetFlow collects metadata from a network flow whereas
Wireshark captures full data packets.
A: What is a key difference between the data captured by NetFlow and data captured by
Wireshark?
Response
NetFlow provides transaction data whereas Wireshark provides session data.
NetFlow data shows network flow contents whereas Wireshark data shows network flow
statistics.
NetFlow collects metadata from a network flow whereas Wireshark captures full data
packets.
NetFlow data is analyzed by tcpdump whereas Wireshark data is analyzed by nfdump.
Q2: Host-based IDS
A: Which IDS system can detect attacks using encryption?
Response
Network IDS deployed in promiscuous mode
Host-based IDS
Network IPS deployed in inline mode
Network IDS deployed in inline mode
Q3: An employee knowingly crashing an e-commerce server by
buffer overflow
A: Which of the following is an example of a computer security incident?
Response
An intruder breaking into an office premises
An employee accessing a secure file
A security administrator changing permission settings of a directory
An employee knowingly crashing an e-commerce server by buffer overflow
Q4: Classify the potential assets and associated risks and address
the risk analysis matrix
A: Risk analysis can be carried out in two major ways: qualitative and quantitative. Which of
the following steps must be taken while conducting a qualitative risk analysis?
Response
Calculate the cost to cover the risk
Calculate the asset value if the risk was to be realized.
Classify the potential assets and associated risks and address the risk analysis matrix
Calculate the return on investment and risk expectancy
Q5: Level of privileges
, A: CVSSv3 defines several characteristics for the base, temporal, and environmental groups.
What does Privileges Required (PR) represent in terms of the exploitability metric?
Response
Level of privileges
Exploit code maturity
Attack complexity
Security requirements
Q6: tagged protocols being used on the network
A: An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The
analysis revealed that a malicious insider attempted to sniff traffic on a specific interface.
What type of information did the malicious insider attempt to obtain?
Response
all information and data within the datagram
tagged ports being used on the network
tagged protocols being used on the network
all firewall alerts and resulting mitigations
Q7: The source host is omar.cisco.com, and the destination is
www1.cisco.com.
A: Refer to the following output of tcpdump. Which of the following statements are true of
this packet capture?(Select all that apply.)
23:52:36.664771 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [S], seq
Q8: These are TCP transactions.
A: 2841244609, win 29200,options [mss 1460,sackOK,TS val 1193036826 ecr 0,nop,wscale 7],
length 0
23:52:36.694193 IP www1.cisco.com.http > omar.cisco.com.33498: Flags [S.], seq
1686130907,ack 2841244610, win 32768, options [mss 1380], length 0
23:52:36.694255 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [.], ack 1, win
29200, length 0
23:52:36.694350 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [P.], seq 1:74, ack 1,
win 29200,length 73: HTTP: GET / HTTP/1.123:52:36.723736 IP www1.cisco.com.http >
omar.cisco.com.33498: Flags [.], ack 74, win 32695, length 0
23:52:36.724590 IP www1.cisco.com.http > omar.cisco.com.33498: Flags [P.], seq 1:505, ack
74,win 32768, length 504: HTTP: HTTP/1.1 301 Moved Permanently23:52:36.724631 IP
omar.cisco.com.33498 > www1.cisco.com.http: Flags [.], ack 505, win 30016, length 0
23:52:36.724871 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [F.], seq 74, ack
505, win 30016,length 0
23:52:36.754313 IP www1.cisco.com.http > omar.cisco.com.33498: Flags [F.], seq 505, ack
75, win 15544,length 0
23:52:36.754364 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [.], ack 506, win
30016, length 0
Response
This is SIP redirect via HTTP.
The source host is omar.cisco.com, and the destination is www1.cisco.com.
, These are UDP transactions.
These are TCP transactions.
Q9: Require remote access connections through IPsec VPN.
A: Which measure can a security analyst take to perform effective security monitoring
against network traffic encrypted by SSL technology?
Response
Use a Syslog server to capture network traffic.
Deploy a Cisco SSL Appliance.
Require remote access connections through IPsec VPN.
Deploy a Cisco ASA.
Q10: SQL injection
A: Which two attacks target web servers through exploiting possible vulnerabilities of input
functions used by an application? (Choose two.)
Q11: cross-site scripting
A: Response
SQL injection
port redirection
trust exploitation
port scanning
cross-site scripting
Q12: an unidentified person claiming to be a technician collecting
user information from employees
A: Which is an example of social engineering?
Response
an unidentified person claiming to be a technician collecting user information from
employees
a computer displaying unauthorized pop-ups and adware
the infection of a computer by a virus carried by a Trojan
an anonymous programmer directing a DDoS attack on a data center
Q13: A fork represents the operation where a process makes a
copy of itself (a parent creates a child)
A: What is a fork in the context of a Linux system?
Response
A fork represents a parent and child process running in separate memory spaces
A fork represents the operation where a process makes a copy of itself (a parent creates
a child)
A fork allows a Linux system to run multithreaded programs
A fork is not responsible to return a process ID (or PID)
Answers
Q1: NetFlow collects metadata from a network flow whereas
Wireshark captures full data packets.
A: What is a key difference between the data captured by NetFlow and data captured by
Wireshark?
Response
NetFlow provides transaction data whereas Wireshark provides session data.
NetFlow data shows network flow contents whereas Wireshark data shows network flow
statistics.
NetFlow collects metadata from a network flow whereas Wireshark captures full data
packets.
NetFlow data is analyzed by tcpdump whereas Wireshark data is analyzed by nfdump.
Q2: Host-based IDS
A: Which IDS system can detect attacks using encryption?
Response
Network IDS deployed in promiscuous mode
Host-based IDS
Network IPS deployed in inline mode
Network IDS deployed in inline mode
Q3: An employee knowingly crashing an e-commerce server by
buffer overflow
A: Which of the following is an example of a computer security incident?
Response
An intruder breaking into an office premises
An employee accessing a secure file
A security administrator changing permission settings of a directory
An employee knowingly crashing an e-commerce server by buffer overflow
Q4: Classify the potential assets and associated risks and address
the risk analysis matrix
A: Risk analysis can be carried out in two major ways: qualitative and quantitative. Which of
the following steps must be taken while conducting a qualitative risk analysis?
Response
Calculate the cost to cover the risk
Calculate the asset value if the risk was to be realized.
Classify the potential assets and associated risks and address the risk analysis matrix
Calculate the return on investment and risk expectancy
Q5: Level of privileges
, A: CVSSv3 defines several characteristics for the base, temporal, and environmental groups.
What does Privileges Required (PR) represent in terms of the exploitability metric?
Response
Level of privileges
Exploit code maturity
Attack complexity
Security requirements
Q6: tagged protocols being used on the network
A: An engineer is investigating a case of the unauthorized usage of the "Tcpdump" tool. The
analysis revealed that a malicious insider attempted to sniff traffic on a specific interface.
What type of information did the malicious insider attempt to obtain?
Response
all information and data within the datagram
tagged ports being used on the network
tagged protocols being used on the network
all firewall alerts and resulting mitigations
Q7: The source host is omar.cisco.com, and the destination is
www1.cisco.com.
A: Refer to the following output of tcpdump. Which of the following statements are true of
this packet capture?(Select all that apply.)
23:52:36.664771 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [S], seq
Q8: These are TCP transactions.
A: 2841244609, win 29200,options [mss 1460,sackOK,TS val 1193036826 ecr 0,nop,wscale 7],
length 0
23:52:36.694193 IP www1.cisco.com.http > omar.cisco.com.33498: Flags [S.], seq
1686130907,ack 2841244610, win 32768, options [mss 1380], length 0
23:52:36.694255 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [.], ack 1, win
29200, length 0
23:52:36.694350 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [P.], seq 1:74, ack 1,
win 29200,length 73: HTTP: GET / HTTP/1.123:52:36.723736 IP www1.cisco.com.http >
omar.cisco.com.33498: Flags [.], ack 74, win 32695, length 0
23:52:36.724590 IP www1.cisco.com.http > omar.cisco.com.33498: Flags [P.], seq 1:505, ack
74,win 32768, length 504: HTTP: HTTP/1.1 301 Moved Permanently23:52:36.724631 IP
omar.cisco.com.33498 > www1.cisco.com.http: Flags [.], ack 505, win 30016, length 0
23:52:36.724871 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [F.], seq 74, ack
505, win 30016,length 0
23:52:36.754313 IP www1.cisco.com.http > omar.cisco.com.33498: Flags [F.], seq 505, ack
75, win 15544,length 0
23:52:36.754364 IP omar.cisco.com.33498 > www1.cisco.com.http: Flags [.], ack 506, win
30016, length 0
Response
This is SIP redirect via HTTP.
The source host is omar.cisco.com, and the destination is www1.cisco.com.
, These are UDP transactions.
These are TCP transactions.
Q9: Require remote access connections through IPsec VPN.
A: Which measure can a security analyst take to perform effective security monitoring
against network traffic encrypted by SSL technology?
Response
Use a Syslog server to capture network traffic.
Deploy a Cisco SSL Appliance.
Require remote access connections through IPsec VPN.
Deploy a Cisco ASA.
Q10: SQL injection
A: Which two attacks target web servers through exploiting possible vulnerabilities of input
functions used by an application? (Choose two.)
Q11: cross-site scripting
A: Response
SQL injection
port redirection
trust exploitation
port scanning
cross-site scripting
Q12: an unidentified person claiming to be a technician collecting
user information from employees
A: Which is an example of social engineering?
Response
an unidentified person claiming to be a technician collecting user information from
employees
a computer displaying unauthorized pop-ups and adware
the infection of a computer by a virus carried by a Trojan
an anonymous programmer directing a DDoS attack on a data center
Q13: A fork represents the operation where a process makes a
copy of itself (a parent creates a child)
A: What is a fork in the context of a Linux system?
Response
A fork represents a parent and child process running in separate memory spaces
A fork represents the operation where a process makes a copy of itself (a parent creates
a child)
A fork allows a Linux system to run multithreaded programs
A fork is not responsible to return a process ID (or PID)
