Cisco 200-201 Actual Questions

The weaponization step in the Cyber Kill Chain model involves creating or repurposing malware based on the information gathered during reconnaissance to exploit vulnerabilities in the target’s system. This step culminates in the preparation of the malware to be delivered to the victim2.

References:

• Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)
• Cyber Kill Chain

 The average time taken by a Security Operations Center (SOC) to detect and resolve incidents is a critical metric for evaluating its effectiveness and scope. This metric reflects the SOC’s efficiency in identifying security threats and its ability to respond and mitigate those threats promptly. It encompasses the entire incident lifecycle, from initial detection to final resolution, providing a comprehensive measure of the SOC’s performance1.

References :=

• Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS)

According to the NIST SP 800-61 incident handling process, the SOC team should first isolate the affected endpoints to prevent further spread of the attack and take disk images for analysis (A). This helps in preserving evidence for a thorough investigation. The next step would be to block the connection to the C&C server on the perimeter next-generation firewall ©, which helps to cut off the communication between the compromised endpoint and the attacker’s server, thereby mitigating the threat123.

References: The answers are based on the guidelines provided in the NIST SP 800-61 Computer Security Incident Handling Guide, which outlines the steps for incident handling, including detection, analysis, containment, eradication, recovery, and post-incident activities

Patch management is the process of distributing and managing updates to software and systems. These updates can include patches for security vulnerabilities, bug fixes, and enhancements to improve performance or add new features. It ensures that systems are up-to-date, secure, and performing optimally. References := Cisco Cybersecurity Training