Free Practice Questions for Cisco 200-201 Exam

A rootkit is a type of malicious software specifically designed to maintain persistent, unauthorized control over a compromised system while evading detection. Rootkits operate by embedding themselves deep within the operating system, often at the kernel level, allowing attackers to hide processes, files, network connections, and registry entries.

Once installed, a rootkit enables long-term access even after system reboots, making it a powerful persistence mechanism. Attackers use rootkits to maintain control, execute commands, capture credentials, and install additional malware without alerting security tools or administrators.

Option B, ARP spoofing, is a network-level attack used for traffic interception, not persistence. Option C, DDoS, is an availability attack and does not provide control over a device. Option D, encryption, is a defensive technology and does not grant persistence.

Cybersecurity operations and incident response documentation consistently identify rootkits as high-severity threats because of their stealth, durability, and ability to undermine trust in the operating system. Detecting rootkits often requires specialized tools, integrity checks, and sometimes full system reimaging.

Therefore, the technology used to maintain persistent control of an exploited device is a rootkit, making Option A the correct answer.

False-positive alerts are alerts that are triggered by benign or normal network traffic and are mistakenly identified as malicious. False positives can have a negative impact on business as they may consume the resources and time of the security team that need to analyze and verify them. True-positive alerts are alerts that correctly identify malicious traffic or activity and require proper incident response procedures. True positives can help the security team to quickly detect and mitigate threats and minimize the damage to the organization. References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, page 92; [Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide], page 98

When a server is experiencing heavy CPU and memory load, the initial step is to identify the processes consuming the most resources. The command “ps -ef” provides a detailed view of all running processes, including their IDs, CPU, and memory usage, which helps in pinpointing the resource-intensive processes1234. References: This approach is supportedby various resources on server management and troubleshooting, which recommend using the “ps -ef” command as a starting point for investigating high resource usage on servers

The improper use or disclosure of Personally Identifiable Information (PII) falls under the category of compliance because organizations are required to adhere to laws and regulations that protect the privacy and security of PII. This includes following guidelines set forth by privacy laws such as GDPR, HIPAA, and others that mandate the proper handling of personal data to prevent misuse and unauthorized access123.

References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS), Personally identifiable information (PII): What it is, how it’s used, and how to protect it, What is PII? Examples, laws, and standards, Overview of the Privacy Act: 2020 Edition

The command in the exhibit is a Snort rule that is configured to alert on TCP packets with the SYN flag set, where the source is not the home network (!$HOME_NET) and the destination is within the home network ($HOME_NET) on port 80. This rule is designed to detect potential SYN flood attacks targeting the internal network’s web server on port 80.

A Distributed Denial of Service (DDoS) attack involves multiple compromised devices (botnet) sending a large number of requests to a target server to overwhelm it.

In a specific type of DDoS attack known as an NTP amplification attack, the attacker exploits the Network Time Protocol (NTP) servers by sending small queries with a spoofed source IP address (the target’s IP).

The NTP server responds with a much larger reply to the target’s IP address, thereby amplifying the traffic directed at the target.

This reflection and amplification technique significantly increases the volume of traffic sent to the target, causing denial of service.

References

OWASP DDoS Attack Overview

NTP Amplification Attack Explained

Understanding Botnets and Distributed Attacks

Traffic tapping involves replicating network traffic and sending it to a separate port where it can be analyzed without affecting the original traffic flow. This allows security analysts to monitor and analyze traffic for potential threats without the risk of blocking legitimate traffic.

This explanation is based on general network security concepts, as the current page does not provide specific Cisco documentation.