200-201 Free Practice Test

What is a sandbox interprocess communication service?

1. A. A collection of rules within the sandbox that prevent the communication between sandboxes.
2. B. A collection of network services that are activated on an interface, allowing for inter-port communication.
3. C. A collection of interfaces that allow for coordination of activities among processes.
4. D. A collection of host services that allow for communication between sandboxes.

Correct Answer: C
Inter-process communication (IPC) allows communication between different processes. A process is one or more threads running inside its own, isolated address space. https://docs.legato.io/16_10/basicIPC.html

A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.
Which type of evidence is this?

1. A. best evidence
2. B. prima facie evidence
3. C. indirect evidence
4. D. physical evidence

Correct Answer: C
There are three general types of evidence:
--> Best evidence: can be presented in court in the original form (for example, an exact copy of a hard disk drive).
--> Corroborating evidence: tends to support a theory or an assumption deduced by some initial evidence. This corroborating evidence confirms the proposition.
--> Indirect or circumstantial evidence: extrapolation to a conclusion of fact (such as fingerprints, DNA evidence, and so on).

What is a difference between SOAR and SIEM?

1. A. SOAR platforms are used for threat and vulnerability management, but SIEM applications are not
2. B. SIEM applications are used for threat and vulnerability management, but SOAR platforms are not
3. C. SOAR receives information from a single platform and delivers it to a SIEM
4. D. SIEM receives information from a single platform and delivers it to a SOAR

Correct Answer: A

Which attack method intercepts traffic on a switched network?

1. A. denial of service
2. B. ARP cache poisoning
3. C. DHCP snooping
4. D. command and control

Correct Answer: B
An ARP-based MITM attack is achieved when an attacker poisons the ARP cache of two devices with the MAC address of the attacker's network interface card (NIC). Once the ARP caches have been successfully poisoned, each victim device sends all its packets to the attacker when communicating to the other device and puts the attacker in the middle of the communications path between the two victim devices. It allows an attacker to easily monitor all communication between victim devices. The intent is to intercept and view the information being passed between the two victim devices and potentially introduce sessions and traffic between the two victim devices

Which process is used when IPS events are removed to improve data integrity?

1. A. data availability
2. B. data normalization
3. C. data signature
4. D. data protection

Correct Answer: B