Free 200-201 CBROPS Practice Test – 2025 Updated

Which open-sourced packet capture tool uses Linux and Mac OS X operating systems?

What is the relationship between a vulnerability and a threat?

Which security principle is violated by running all processes as root or administrator?

An offline audit log contains the source IP address of a session suspected to have exploited a vulnerability resulting in system compromise.
Which kind of evidence is this IP address?

Refer to the exhibit. Which event is occurring?

When an event is investigated, which type of data provides the investigate capability to determine if data exfiltration has occurred?

What does the Zero Trust security model signify?

An engineer needs to discover alive hosts within the 192.168.1.0/24 range without triggering intrusive portscan alerts on the IDS device using Nmap. Which command will accomplish this goal?

At a company party a guest asks questions about the company's user account format and password complexity. How is this type of conversation classified?

Which type of attack occurs when an attacker is successful in eavesdropping on a conversation between two IP phones?

Refer to the exhibit. What is occurring in this network?

Which type of data consists of connection level, application-specific records generated from network traffic?

What is the difference between the ACK flag and the RST flag in the NetFlow log session?

What is vulnerability management?

How does a certificate authority impact security?

A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within
48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?

What specific type of analysis is assigning values to the scenario to see expected outcomes?

Which metric in CVSS indicates an attack that takes a destination bank account number and replaces it with a different bank account number?

What is the practice of giving an employee access to only the resources needed to accomplish their job?

What is the virtual address space for a Windows process?

What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?

Which event is user interaction?

Which security principle requires more than one person is required to perform a critical task?

Refer to the exhibit. In which Linux log file is this output found?

An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.
Which testing method did the intruder use?

An engineer is investigating a case of the unauthorized usage of the `Tcpdump` tool. The analysis revealed that a malicious insider attempted to sniff traffic on a specific interface. What type of information did the malicious insider attempt to obtain?

Which data format is the most efficient to build a baseline of traffic seen over an extended period of time?

Which list identifies the information that the client sends to the server in the negotiation phase of the TLS handshake?

Which data type is necessary to get information about source/destination ports?

An employee reports that someone has logged into their system and made unapproved changes, files are out of order, and several documents have been placed in the recycle bin. The security specialist reviewed the system logs, found nothing suspicious, and was not able to determine what occurred. The software is up to date; there are no alerts from antivirus and no failed login attempts. What is causing the lack of data visibility needed to detect the attack?

What is a purpose of a vulnerability management framework?

What is a difference between SOAR and SIEM?

What is a benefit of agent-based protection when compared to agentless protection?

What causes events on a Windows system to show Event Code 4625 in the log messages?

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions.
Which identifier tracks an active program?

What is an attack surface as compared to a vulnerability?

Refer to the exhibit. What does the output indicate about the server with the IP address 172.18.104.139?

What is indicated by an increase in IPv4 traffic carrying protocol 41?

Refer to the exhibit. What is occurring in this network traffic?

Which security technology guarantees the integrity and authenticity of all messages transferred to and from a web application?

Which security monitoring data type requires the largest storage space?

Refer to the exhibit. Which kind of attack method is depicted in this string?

What is an example of social engineering attacks?

Refer to the exhibit. What should be interpreted from this packet capture?

Refer to the exhibit. An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?

Which attack is the network vulnerable to when a stream cipher like RC4 is used twice with the same key?

Refer to the exhibit. Which type of log is displayed?

Refer to the exhibit. Which type of log is displayed?

What makes HTTPS traffic difficult to monitor?

A security incident occurred with the potential of impacting business services. Who performs the attack?

Which event is a vishing attack?

When communicating via TLS, the client initiates the handshake to the server and the server responds back with its certificate for identification.
Which information is available on the server certificate?

Why is encryption challenging to security monitoring?

What is the principle of defense-in-depth?

What does an attacker use to determine which network ports are listening on a potential target device?

What is the difference between an attack vector and an attack surface?

What is the practice of giving employees only those permissions necessary to perform their specific role within an organization?

Which evasion technique is a function of ransomware?

What is rule-based detection when compared to statistical detection?

Which principle is being followed when an analyst gathers information relevant to a security incident to determine the appropriate course of action?