Free Cisco 200-201 Exam Questions

Become Cisco Certified with updated 200-201 exam questions and correct answers

Page: 1 / 96

Total 480 Questions | Updated On: May 10, 2026

Add To Cart

Question 1

An engineer must investigate suspicious connections. Data has been gathered using a tcpdump command on a Linux device and saved as sandboxmalware2022-12-22.pcaps file. The engineer is trying to open the tcpdump in the Wireshark tool. What is the expected result?

A : The file is opened.

B : The tool does not support Linux.

C : The file does not support the “-“ character.

D : The file has an incorrect extension.

Answer: A

Question 2

Refer to the exhibit.

An engineer is analyzing a PCAP file after a recent breach An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers. Further analysis showed several SSH Server Banner and Key Exchange Initiations. The engineer cannot see the exact data being transmitted over an encrypted channel and cannot identify how the attacker gained access How did the attacker gain access?

A : by using the buffer overflow in the URL catcher feature for SSH

B : by using an SSH Tectia Server vulnerability to enable host-based authentication

C : by using an SSH vulnerability to silently redirect connections to the local host

D : by using brute force on the SSH service to gain access

Answer: C

Question 3

Refer to the exhibit.An analyst receives an IDS alert pertaining to a possible data exfiltration attempt. An additional set of logs iscollected from different systems and analyzed. Which type of evidence do the logs provide in relation to theprimary alert from the IDS?

A : corroborative evidence

B : primary evidence

C : circumstantial evidence

D : secondary evidence

Answer: A

Question 4

An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?

A : quence numbers

B : identifier

C : 5-tuple

D : mestamps

Answer: C

Question 5

An engineer must compare NIST vs ISO frameworks The engineer deeded to compare as readable documentation and also to watch a comparison video review. Using Windows 10 OS. the engineer started a browser and searched for a NIST document and then opened a new tab in the same browser and searched for an ISO document for comparison

The engineer tried to watch the video, but there 'was an audio problem with OS so the engineer had to troubleshoot it At first the engineer started CMD and looked fee a driver path then locked for a corresponding registry in the registry editor The engineer enabled 'Audiosrv' in task manager and put it on auto start and the problem was solved Which two components of the OS did the engineer touch? (Choose two)

A : rmissions

B : werShell logs

C : rvice

D : R

E : ocess and thread

Answer: A,C

Page: 1 / 96

Total 480 Questions | Updated On: May 10, 2026

Add To Cart