CBROPS Practice Exam | UPDATED Questions with 100%
Verified Answers
Q1: statistical
A: Which type of data is used by Cisco Cognitive Intelligence to find malicious activity that
has bypassed security controls, or entered through unmonitored channels, and is
Q2: Explanation: Cisco Cognitive Intelligence utilizes statistical
data for statistical analysis in order to find malicious activity
that has bypassed security controls, or entered through
unmonitored channels (including removable media), and is
operating inside the network of an organization.
A: operating inside an enterprise network?
statistical
session
alert
transaction
Q3: traffic fragmentation
A: Which type of evasion technique splits malicious payloads into smaller packets in order
to bypass security sensors that do not reassemble the payloads before scanning them?
Q4: Explanation: In order to keep the malicious payload from
being recognized by security sensors, such as IPS or IDS,
perpetrators fragment the data into smaller packets.These
fragments can be passed by sensors that do not reassemble
the data before scanning.
A: pivoting
traffic fragmentation
protocol-level misinterpretation
traffic insertion
Q5: scope
A: A security analyst is investigating a cyber attack that began by compromising one file
system through a vulnerability in a custom software application. The attack now appears
Q6: Explanation: The scope metric is impacted by an exploited
vulnerability that can affect resources beyond the authorized
privileges of the vulnerable component or that are managed
by a different security authority.
A: to be affecting additional file systems under the control of another security authority.
Which CVSS v3.0 base exploitability metric score is increased by this attack
characteristic?
, privileges required
scope
attack complexity
user interaction
Q7: 0{4}
A: Which regular expression would match any string that contains 4 consecutive zeros?
{0-4}
Q8: Explanation: The regular expression 0{4} matches any string
that contains 4 repetitions of zero or 4 consecutive zeros.
A: [0-4]
0{4}
^0000
Q9: checksum
destination port
source port
A: Which three fields are found in both the TCP and UDP headers? (Choose three.)
window
checksum
Q10: Explanation: The UPD header has four fields. Three of these
fields are in common with the TCP header. These three fields
are the source port, destination port, and checksum.
A: options
sequence number
destination port
source port
Q11: NetFlow collects metadata from a network flow whereas
Wireshark captures full data packets.
A: What is a key difference between the data captured by NetFlow and data captured by
Wireshark?
Q12: Explanation: Wireshark captures the entire contents of a
packet. NetFlow does not. Instead, NetFlow collects
metadata, or data about the flow.
A: NetFlow provides transaction data whereas Wireshark provides session data.
NetFlow data is analyzed by tcpdump whereas Wireshark data is analyzed by nfdump.
NetFlow collects metadata from a network flow whereas Wireshark captures full data
packets.
NetFlow data shows network flow contents whereas Wireshark data shows network flow
Verified Answers
Q1: statistical
A: Which type of data is used by Cisco Cognitive Intelligence to find malicious activity that
has bypassed security controls, or entered through unmonitored channels, and is
Q2: Explanation: Cisco Cognitive Intelligence utilizes statistical
data for statistical analysis in order to find malicious activity
that has bypassed security controls, or entered through
unmonitored channels (including removable media), and is
operating inside the network of an organization.
A: operating inside an enterprise network?
statistical
session
alert
transaction
Q3: traffic fragmentation
A: Which type of evasion technique splits malicious payloads into smaller packets in order
to bypass security sensors that do not reassemble the payloads before scanning them?
Q4: Explanation: In order to keep the malicious payload from
being recognized by security sensors, such as IPS or IDS,
perpetrators fragment the data into smaller packets.These
fragments can be passed by sensors that do not reassemble
the data before scanning.
A: pivoting
traffic fragmentation
protocol-level misinterpretation
traffic insertion
Q5: scope
A: A security analyst is investigating a cyber attack that began by compromising one file
system through a vulnerability in a custom software application. The attack now appears
Q6: Explanation: The scope metric is impacted by an exploited
vulnerability that can affect resources beyond the authorized
privileges of the vulnerable component or that are managed
by a different security authority.
A: to be affecting additional file systems under the control of another security authority.
Which CVSS v3.0 base exploitability metric score is increased by this attack
characteristic?
, privileges required
scope
attack complexity
user interaction
Q7: 0{4}
A: Which regular expression would match any string that contains 4 consecutive zeros?
{0-4}
Q8: Explanation: The regular expression 0{4} matches any string
that contains 4 repetitions of zero or 4 consecutive zeros.
A: [0-4]
0{4}
^0000
Q9: checksum
destination port
source port
A: Which three fields are found in both the TCP and UDP headers? (Choose three.)
window
checksum
Q10: Explanation: The UPD header has four fields. Three of these
fields are in common with the TCP header. These three fields
are the source port, destination port, and checksum.
A: options
sequence number
destination port
source port
Q11: NetFlow collects metadata from a network flow whereas
Wireshark captures full data packets.
A: What is a key difference between the data captured by NetFlow and data captured by
Wireshark?
Q12: Explanation: Wireshark captures the entire contents of a
packet. NetFlow does not. Instead, NetFlow collects
metadata, or data about the flow.
A: NetFlow provides transaction data whereas Wireshark provides session data.
NetFlow data is analyzed by tcpdump whereas Wireshark data is analyzed by nfdump.
NetFlow collects metadata from a network flow whereas Wireshark captures full data
packets.
NetFlow data shows network flow contents whereas Wireshark data shows network flow
