Free Cisco 200-201 Exam Questions

Become Cisco Certified with updated 200-201 exam questions and correct answers

Page: 1 / 82

Total 406 Questions | Updated On: Aug 15, 2025

Add To Cart

Question 1

Refer to the exhibit.

An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server Which display filters should the analyst use to filter the FTP traffic?

A : dstport == FTP

B : tcp.port==21

C : tcpport = FTP

D : dstport = 21

Answer: C

Question 2

Which incidence response step includes identifying all hosts affected by an attack?

A : tection and analysis

B : t-incident activity

C : eparation

D : ntainment, eradication, and recovery

Answer: D

Question 3

Which action should be taken if the system is overwhelmed with alerts when false positives and false negatives are compared?

A : dify the settings of the intrusion detection system.

B : ign criteria for reviewing alerts.

C : define signature rules

D : just the alerts schedule.

Answer: A

Question 4

An investigator is examining a copy of an ISO file that is stored in CDFS format. What type of evidence is this file?

A : ta from a CD copied using Mac-based system

B : ta from a CD copied using Linux system

C : ta from a DVD copied using Windows system

D : ta from a CD copied using Windows

Answer: B

Question 5

An analyst received an alert on their desktop computer showing that an attack was successful on the host. After investigating, the analyst discovered that no mitigation action occurred during the attack. What is the reason for this discrepancy?

A : computer has a HIPS installed on it.

B : computer has a NIPS installed on it.

C : computer has a HIDS installed on it

D : computer has a NIDS installed on it.

Answer: C

Page: 1 / 82

Total 406 Questions | Updated On: Aug 15, 2025

Add To Cart