200-201 Practice Test

Refer to the exhibit.

Which type of log is displayed?

A.

proxy

B.

NetFlow

C.

IDS

D.

sys

A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions.
Which identifier tracks an active program?

A.

application identification number

B.

process identification number

C.

runtime identification number

D.

process identification number

Which metric is used to capture the level of access needed to launch a successful attack?

A.

privileges required

B.

user interaction

C.

attack complexity

D.

attack vector

Which IETF standard technology is useful to detect and analyze a potential security incident by recording
session flows that occurs between hosts?

A.

SFlow

B.

NetFlow

C.

NFlow

D.

IPFIX

What is the difference between mandatory access control (MAC) and discretionary access control (DAC)?

A.

MAC is controlled by the discretion of the owner and DAC is controlled by an
administrator

B.

MAC is the strictest of all levels of control and DAC is object-based access

C.

DAC is controlled by the operating system and MAC is controlled by an administrator

D.

DAC is the strictest of all levels of control and MAC is object-based access