CBROPS 200-201 Exam | UPDATED Questions with 100%
Verified Answers
Q1: C. exploitation
A: How is attacking a vulnerability categorized?
A. action on objectives
B. delivery
C. exploitation
D. installation
Q2: A permissions
A: An engineer must compare NIST vs ISO frameworks The engineer deeded to compare as
readable documentation and also to watch a comparison video review. Using Windows 10
Q3: C. service
A: OS. the engineer started a browser and searched for a NIST document and then opened
a new tab in the same browser and searched for an ISO document for comparison
The engineer tried to watch the video, but there 'was an audio problem with OS so the
engineer had to troubleshoot it At first the engineer started CMD and looked fee a driver
path then locked for a corresponding registry in the registry editor The engineer enabled
"Audiosrv" in task manager and put it on auto start and the problem was solved Which
two components of the OS did the engineer touch? (Choose two)
A permissions
B PowerShell logs
C service
D MBR
E process and thread
Q4: D. opening a malicious file
A: Which event is user interaction?
A. gaining root access
B. executing remote code
C. reading and writing file permission
D. opening a malicious file
Q5: C. Separation of duties
A: Which security principle requires more than one person is required to perform a critical
task?
A. least privilege
B. need to know
C. separation of duties
D. due diligence
Q6: C. It collects and detects all traffic locally
,A: What is a benefit of agent-based protection when compared to agentless protection?
Q7: Host-based antivirus protection is also known as agent-based.
Agent-based antivirus runs on every protected machine.
Agentless antivirus protection performs scans on hosts from a
centralized system. Agentless systems have become popular
for virtualized environments in which multiple OS instances are
running on a host simultaneously. Agent-based antivirus
running in each virtualized system can be a serious drain on
system resources. Agentless antivirus for virtual hosts involves
the use of a special security virtual appliance that performs
optimized scanning tasks on the virtual hosts. An example of
this is VMware's vShield.
A: A. It lowers maintenance costs
B. It provides a centralized platform
C. It collects and detects all traffic locally
D. It manages numerous devices simultaneously
Q8: B. Rapid response
A: Which principle is being followed when an analyst gathers information relevant to a
security incident to determine the appropriate course of action?
A. decision making
B. rapid response
C. data mining
D. due diligence
Q9: D. confidentiality, integrity, and availability
A: One of the objectives of information security is to protect the CIA of information and
systems. What does CIA mean in this context?
A. confidentiality, identity, and authorization
B. confidentiality, integrity, and authorization
C. confidentiality, identity, and availability
D. confidentiality, integrity, and availability
Q10: B. proof of a user's action
A: What is rule-based detection when compared to statistical detection?
A. proof of a user's identity
B. proof of a user's action
C. likelihood of user's action
D. falsification of a user's identity
Q11: D. delivery
A: A user received a malicious attachment but did not run it. Which category classifies the
intrusion?
A. weaponization
,B. reconnaissance
C. installation
D. delivery
Q12: B. data normalization
A: Which process is used when IPS events are removed to improve data integrity?
A. data availability
B. data normalization
C. data signature
D. data protection
Q13: C. 5-tuple
A: An analyst is investigating an incident in a SOC environment. Which method is used to
identify a session from a group of logs?
A. sequence numbers
B. IP identifier
C. 5-tuple
D. timestamps
Q14: A. SOAR platforms are used for threat and vulnerability
management, but SIEM applications are not
A: What is a difference between SOAR and SIEM?
A. SOAR platforms are used for threat and vulnerability management, but SIEM
applications are not
B. SIEM applications are used for threat and vulnerability management, but SOAR
platforms are not
C. SOAR receives information from a single platform and delivers it to a SIEM
D. SIEM receives information from a single platform and delivers it to a SOAR
Q15: B. MAC is the strictest of all levels of control and DAC is
object-based access
A: What is the difference between mandatory access control (MAC) and discretionary
access control (DAC)?
A. MAC is controlled by the discretion of the owner and DAC is controlled by an
administrator
B. MAC is the strictest of all levels of control and DAC is object-based access
C. DAC is controlled by the operating system and MAC is controlled by an administrator
D. DAC is the strictest of all levels of control and MAC is object-based access
Q16: A. least privilege
A: What is the practice of giving employees only those permissions necessary to perform
their specific role within an organization?
A. least privilege
B. need to know
, C. integrity validation
D. due diligence
Q17: D. set of virtual memory addresses that can be used
A: What is the virtual address space for a Windows process?
A. physical location of an object in memory
B. set of pages that reside in the physical memory
C. system-level memory protection feature built into the operating system
D. set of virtual memory addresses that can be used
Q18: A. principle of least privilege
A: Which security principle is violated by running all processes as root or administrator?
A. principle of least privilege
B. role-based access control
C. separation of duties
D. trusted computing base
Q19: D. It sends instruction to a compromised system
A: What is the function of a command and control server?
A. It enumerates open ports on a network device
B. It drops secondary payload into malware
C. It is used to regain control of the network after a compromise
D. It sends instruction to a compromised system
Q20: D. Deep packet inspection allows visibility on Layer 7 and
stateful inspection allows visibility on Layer 4
A: What is the difference between deep packet inspection and stateful inspection?
A. Deep packet inspection is more secure than stateful inspection on Layer 4
B. Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies
connection at Layer 7
C. Stateful inspection is more secure than deep packet inspection on Layer 7
D. Deep packet inspection allows visibility on Layer 7 and stateful inspection allows
visibility on Layer 4
Q21: B. Encryption
A: Which evasion technique is a function of ransomware?
A. extended sleep calls
B. encryption
C. resource exhaustion
D. encoding
Q22: D. Source Port
E. Initiator IP
Verified Answers
Q1: C. exploitation
A: How is attacking a vulnerability categorized?
A. action on objectives
B. delivery
C. exploitation
D. installation
Q2: A permissions
A: An engineer must compare NIST vs ISO frameworks The engineer deeded to compare as
readable documentation and also to watch a comparison video review. Using Windows 10
Q3: C. service
A: OS. the engineer started a browser and searched for a NIST document and then opened
a new tab in the same browser and searched for an ISO document for comparison
The engineer tried to watch the video, but there 'was an audio problem with OS so the
engineer had to troubleshoot it At first the engineer started CMD and looked fee a driver
path then locked for a corresponding registry in the registry editor The engineer enabled
"Audiosrv" in task manager and put it on auto start and the problem was solved Which
two components of the OS did the engineer touch? (Choose two)
A permissions
B PowerShell logs
C service
D MBR
E process and thread
Q4: D. opening a malicious file
A: Which event is user interaction?
A. gaining root access
B. executing remote code
C. reading and writing file permission
D. opening a malicious file
Q5: C. Separation of duties
A: Which security principle requires more than one person is required to perform a critical
task?
A. least privilege
B. need to know
C. separation of duties
D. due diligence
Q6: C. It collects and detects all traffic locally
,A: What is a benefit of agent-based protection when compared to agentless protection?
Q7: Host-based antivirus protection is also known as agent-based.
Agent-based antivirus runs on every protected machine.
Agentless antivirus protection performs scans on hosts from a
centralized system. Agentless systems have become popular
for virtualized environments in which multiple OS instances are
running on a host simultaneously. Agent-based antivirus
running in each virtualized system can be a serious drain on
system resources. Agentless antivirus for virtual hosts involves
the use of a special security virtual appliance that performs
optimized scanning tasks on the virtual hosts. An example of
this is VMware's vShield.
A: A. It lowers maintenance costs
B. It provides a centralized platform
C. It collects and detects all traffic locally
D. It manages numerous devices simultaneously
Q8: B. Rapid response
A: Which principle is being followed when an analyst gathers information relevant to a
security incident to determine the appropriate course of action?
A. decision making
B. rapid response
C. data mining
D. due diligence
Q9: D. confidentiality, integrity, and availability
A: One of the objectives of information security is to protect the CIA of information and
systems. What does CIA mean in this context?
A. confidentiality, identity, and authorization
B. confidentiality, integrity, and authorization
C. confidentiality, identity, and availability
D. confidentiality, integrity, and availability
Q10: B. proof of a user's action
A: What is rule-based detection when compared to statistical detection?
A. proof of a user's identity
B. proof of a user's action
C. likelihood of user's action
D. falsification of a user's identity
Q11: D. delivery
A: A user received a malicious attachment but did not run it. Which category classifies the
intrusion?
A. weaponization
,B. reconnaissance
C. installation
D. delivery
Q12: B. data normalization
A: Which process is used when IPS events are removed to improve data integrity?
A. data availability
B. data normalization
C. data signature
D. data protection
Q13: C. 5-tuple
A: An analyst is investigating an incident in a SOC environment. Which method is used to
identify a session from a group of logs?
A. sequence numbers
B. IP identifier
C. 5-tuple
D. timestamps
Q14: A. SOAR platforms are used for threat and vulnerability
management, but SIEM applications are not
A: What is a difference between SOAR and SIEM?
A. SOAR platforms are used for threat and vulnerability management, but SIEM
applications are not
B. SIEM applications are used for threat and vulnerability management, but SOAR
platforms are not
C. SOAR receives information from a single platform and delivers it to a SIEM
D. SIEM receives information from a single platform and delivers it to a SOAR
Q15: B. MAC is the strictest of all levels of control and DAC is
object-based access
A: What is the difference between mandatory access control (MAC) and discretionary
access control (DAC)?
A. MAC is controlled by the discretion of the owner and DAC is controlled by an
administrator
B. MAC is the strictest of all levels of control and DAC is object-based access
C. DAC is controlled by the operating system and MAC is controlled by an administrator
D. DAC is the strictest of all levels of control and MAC is object-based access
Q16: A. least privilege
A: What is the practice of giving employees only those permissions necessary to perform
their specific role within an organization?
A. least privilege
B. need to know
, C. integrity validation
D. due diligence
Q17: D. set of virtual memory addresses that can be used
A: What is the virtual address space for a Windows process?
A. physical location of an object in memory
B. set of pages that reside in the physical memory
C. system-level memory protection feature built into the operating system
D. set of virtual memory addresses that can be used
Q18: A. principle of least privilege
A: Which security principle is violated by running all processes as root or administrator?
A. principle of least privilege
B. role-based access control
C. separation of duties
D. trusted computing base
Q19: D. It sends instruction to a compromised system
A: What is the function of a command and control server?
A. It enumerates open ports on a network device
B. It drops secondary payload into malware
C. It is used to regain control of the network after a compromise
D. It sends instruction to a compromised system
Q20: D. Deep packet inspection allows visibility on Layer 7 and
stateful inspection allows visibility on Layer 4
A: What is the difference between deep packet inspection and stateful inspection?
A. Deep packet inspection is more secure than stateful inspection on Layer 4
B. Stateful inspection verifies contents at Layer 4 and deep packet inspection verifies
connection at Layer 7
C. Stateful inspection is more secure than deep packet inspection on Layer 7
D. Deep packet inspection allows visibility on Layer 7 and stateful inspection allows
visibility on Layer 4
Q21: B. Encryption
A: Which evasion technique is a function of ransomware?
A. extended sleep calls
B. encryption
C. resource exhaustion
D. encoding
Q22: D. Source Port
E. Initiator IP
