Cisco 200-201 Daily Practice Exam New 2026 Updated 478 Questions [Q16-Q36]

Rate this post

Cisco 200-201 Daily Practice Exam New 2026 Updated 478 Questions

Use Valid 200-201 Exam – Actual Exam Question & Answer

QUESTION 16
An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network.
What is the impact of this traffic?

ransomware communicating after infection

users downloading copyrighted content

data exfiltration

user circumvention of the firewall

QUESTION 17
Refer to the exhibit.

Which type of evidence is this file?

corroborating evidence

circumstantial evidence

best evidence

direct evidence

QUESTION 18
Refer to the exhibit.

Which stakeholders must be involved when a company workstation is compromised?

Employee 1 Employee 2, Employee 3, Employee 4, Employee 5, Employee 7

Employee 1, Employee 2, Employee 4, Employee 5

Employee 4, Employee 6, Employee 7

Employee 2, Employee 3, Employee 4, Employee 5

QUESTION 19
Refer to the exhibit.

What is occurring within the exhibit?

regular GET requests

XML External Entities attack

insecure deserialization

cross-site scripting attack

QUESTION 20
Refer to exhibit.

An analyst performs the analysis of the pcap file to detect the suspicious activity. What challenges did the analyst face in terms of data visibility?

data encapsulation

IP fragmentation

code obfuscation

data encryption

QUESTION 21
What is sliding window anomaly detection?

Detect changes in operations and management processes.

Identify uncommon patterns that do not fit usual behavior.

Define response times for requests for owned applications.

Apply lowest privilege/permission level to software

QUESTION 22
Which metric is used to capture the level of access needed to launch a successful attack?

privileges required

user interaction

attack complexity

attack vector

QUESTION 23
Refer to the exhibit.

What does the message indicate?

an access attempt was made from the Mosaic web browser

a successful access attempt was made to retrieve the password file

a successful access attempt was made to retrieve the root of the website

a denied access attempt was made to retrieve the password file

QUESTION 24
What specific type of analysis is assigning values to the scenario to see expected outcomes?

deterministic

exploratory

probabilistic

descriptive

QUESTION 25
Which event artifact is used to identify HTTP GET requests for a specific file?

destination IP address

URI

HTTP status code

TCP ACK

QUESTION 26
Refer to the exhibit.

What must be interpreted from this packet capture?

IP address 192.168.88 12 is communicating with 192 168 88 149 with a source port 74 to destination port 49098 using TCP protocol

IP address 192.168.88.12 is communicating with 192 168 88 149 with a source port 49098 to destination port 80 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168 88.12 with a source port 80 to destination port 49098 using TCP protocol.

IP address 192.168.88.149 is communicating with 192.168.88.12 with a source port 49098 to destination port 80 using TCP protocol.

QUESTION 27
Refer to the exhibit.

An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email.
What is the state of this file?

The file has an embedded executable and was matched by PEiD threat signatures for further analysis.

The file has an embedded non-Windows executable but no suspicious features are identified.

The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.

QUESTION 28
Which tool gives the ability to see session data in real time?

tcpdstat

trafdump

tcptrace

trafshow

QUESTION 29
During which phase of the forensic process are tools and techniques used to extract information from the collected data?

investigation

examination

reporting

collection

QUESTION 30
A security engineer has a video of a suspect entering a data center that was captured on the same day that files in the same data center were transferred to a competitor.
Which type of evidence is this?

best evidence

prima facie evidence

indirect evidence

physical evidence

QUESTION 31
An analyst is investigating a host in the network that appears to be communicating to a command and control server on the Internet. After collecting this packet capture, the analyst cannot determine the technique and payload used for the communication.

Which obfuscation technique is the attacker using?

Base64 encoding

TLS encryption

SHA-256 hashing

ROT13 encryption

QUESTION 32
Refer to the exhibit.

Which component is identifiable in this exhibit?

Trusted Root Certificate store on the local machine

Windows PowerShell verb

Windows Registry hive

local service in the Windows Services Manager

QUESTION 33

Refer to the exhibit Which TLS version does this client support?

1.0 and 1.2

1.1 and 13

QUESTION 34
Refer to the exhibit.

An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email. What is the state of this file?

The file has an embedded executable and was matched by PEiD threat signatures for further analysis.

The file has an embedded non-Windows executable but no suspicious features are identified.

The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.

The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.

QUESTION 35
Refer to the exhibit.

Which stakeholders must be involved when a company workstation is compromised?

Employee 1 Employee 2, Employee 3, Employee 4, Employee 5, Employee 7

Employee 1, Employee 2, Employee 4, Employee 5

Employee 4, Employee 6, Employee 7

Employee 2, Employee 3, Employee 4, Employee 5

QUESTION 36
At a company party a guest asks questions about the company’s user account format and password complexity.
How is this type of conversation classified?

Phishing attack

Password Revelation Strategy

Piggybacking

Social Engineering