Free 200-201 sample questions

Correct answer: stream

Stream ciphers encrypt data bit by bit, processing one bit at a time continuously. This is in contrast to block ciphers which process fixed-size blocks of data. Stream ciphers use a keystream that is combined with plaintext bit by bit, making them ideal for real-time applications. Block ciphers process chunks of data, asymmetric algorithms use different keys for encryption/decryption, and symmetric is a broader category that includes both stream and block ciphers.

Correct answer: obtained without authorization

Privilege escalation occurs when someone obtains, without authorization, the rights and privileges of a different user or system. This typically happens when an attacker exploits vulnerabilities or misconfigurations to gain higher-level access than originally granted. Vertical movement refers to gaining higher privileges (like admin rights), while horizontal movement involves accessing resources at the same privilege level but in different contexts. The key aspect is that escalation happens without proper authorization.

Correct answer: if we change the VLAN of Fa0/2 to VLAN 3 and change the IP address of PC1 to 192.168.6.5, PC1 will be able to connect with PC0

Based on the network diagram shown in the image, the PCs are currently on different VLANs (VLAN 2 and VLAN 3) with different IP subnets, which prevents communication. To enable connectivity, both PCs must be on the same VLAN and same IP subnet. Changing Fa0/2 to VLAN 3 puts both PCs on the same VLAN, and changing PC1 IP to 192.168.6.5 puts them on the same subnet (192.168.6.0/24), allowing communication. Simply changing IP addresses without VLAN alignment or only changing VLANs without IP subnet alignment would not work.

Correct answer: HIDS

A Host-based Intrusion Detection System (HIDS) is deployed directly on endpoints as an agent or standalone application to monitor individual workstations. HIDS monitors system calls, file integrity, registry changes, and local network activity on the specific host. Network-based IDS (NIDS) operates at the network level, NIPS (Network Intrusion Prevention System) is network-based, and NGFW (Next Generation Firewall) is a network perimeter device. Only HIDS is specifically designed for endpoint deployment.

Correct answer: vulnerability

A vulnerability is an exploitable weakness in software or systems that has not been patched or mitigated. It represents a potential entry point for attackers but is not yet being actively exploited. An exploit is the actual method or code used to take advantage of a vulnerability, a threat is a potential danger, and a breach occurs when an attack successfully compromises a system. Vulnerabilities become dangerous when they remain unpatched and unmitigated, creating opportunities for exploitation.

Correct answer: Many TCP SYN packets are captures with the same sequence number, source, and destination IP address, but different payloads.

A TCP injection attack occurs when an attacker injects malicious data into legitimate TCP packets. The key indicator is multiple TCP SYN packets captured with identical sequence numbers, source and destination IP addresses, but different payloads - this shows someone is manipulating the packet contents. High volume scanning indicates reconnaissance activity, different IP addresses would suggest packet spoofing rather than injection, and slower actions indicate stealth techniques rather than injection attacks.

Correct answer: permissions

Linux manages ownership and control of objects through a comprehensive permissions system. This includes file permissions (read, write, execute), ownership (user and group), and access control mechanisms. The permission system controls who can access files, directories, and system resources, and what actions they can perform. Rights is too general a term, while permissions specifically refers to the Linux access control framework that governs object ownership and control.

Correct answer: X.509

Explanation: The standard for digital certificates is X.509. These text documents include identifying information of the holder, the most important being the public key of the holder. X.500 is the standards for directory services. Power over Ethernet (PoE) is defined by the IEEE 802.3af and 802.3at standards. PoE allows an Ethernet switch to provide power to an attached device by applying power to the same wires in a UTP cable that are used to transmit and receive data. PoE+ is an enhanced version of PoE that provides more power and better reliability. PoE+ is most commonly deployed in enterprise networks, while PoE is usually sufficient for small business or home networks. The IEEE 802.11 standard, which is the main standard for wireless LANs (WLANs), specifies using Carrier Sense Multiple Access/Collision Avoidance (CSMA/CA) for its media access method. Like an Ethernet network, which uses Carrier Sense Multiple Access/Collision Detection (CSMA/CD), wireless adapter cards “sense', or listen, for network traffic before transmitting. If the network is free of traffic, the station will send its data. The 802.22 standard also refers to CSMA/CA as Distributed Coordination Function (DCF).However, unlike an Ethernet network, wireless network cards cannot send and receive transmissions at the same time, which means that they cannot detect a collision. Instead, the sending station will wait for an acknowledgement packet (ACK) to be sent by the destination computer, verifying that the data was received. If, after a random amount of time, an acknowledgement has not been received, the sending station will retransmit the data. Objective: CryptographySub-Objective: Describe these items in regards to SSL/TLS: Cipher-suite, X.509 certificates, Key exchange, Protocol version, PKCS -- Reference: https://searchsecurity.techtarget.com/definition/X509-certificate

Correct answer: PKI

Explanation: A public key infrastructure (PKI) contains software hardware and policies that allow digital certificates to be created, validated, or revoked. A digital signature provides integrity, authentication, and non-repudiation in electronic mail. A PKI typically consists of the following components: certificates, a key repository, a method for revoking certificates, and a method to evaluate a certificate chain, which security professionals can use to follow the possession of keys. Pretty Good Privacy (PGP) is an email encryption system. PGP uses a web of trust to validate public key pairs. In a web of trust model, users sign their own key pairs. If a user wants to receive a file encrypted with PGP, the user must first supply the public key. Post Office Protocol (POP) is a client email program. It is used to retrieve email from the email server. Dynamic Host Configuration (DHCP) is a protocol that allows network administrators to centrally manage and automate the assignment of Internet Protocol (IP) addresses in an organization’s network. DHCP can automatically assign a new IP address when a computer is plugged into a different location on the network. Objective: Cryptography Sub-Objective: Describe the operation of a PKI -- Reference: https://searchsecurity.techtarget.com/definition/PKI

Correct answer: performs actions slower than normal

Explanation: Timing attacks are those in which operations carried out are done much slower than normal to keep the IPS or IDS from assembling the operation into a recognizable attack. Performing actions faster than normal might even make it easier for the IPS or IDS to assemble the parts of the operation into a recognizable attack. Delaying the attack will have no bearing how easily the IPS may or may not recognize the attack. Attackers really have no way of recognizing or acting upon an opportune moment. Objective: Attack MethodsSub-Objective: Describe these evasion methods: Encryption and tunneling, Resource exhaustion, Traffic fragmentation, Protocol-level misinterpretation, Traffic substitution and insertion, Pivot.