A small business wants to protect against ransomware. They have a limited budget and cannot afford a dedicated security team. Which mitigation strategy is most cost-effective and practical?

Purchase a high-end firewall for the network perimeter

Disable all internet access for employees

Implement regular, automated backups to an external drive that is disconnected after the backup

Hire a 24/7 security operations center

A security analyst is investigating a suspected C2 channel. The analyst observes that a compromised host sends DNS queries to a domain that is not on any blocklist. The queries are small and infrequent, and the responses contain TXT records with what appears to be encoded data. The analyst must determine whether this is C2 traffic. Which finding would most strongly confirm DNS tunneling?

The TXT records contain data that decodes to a recognizable command

The DNS queries are to a domain that was registered recently and has low traffic volume

The DNS queries are encrypted with DNS-over-HTTPS

The DNS server is configured to log all queries

What is the primary role of command and control (C2) infrastructure in an endpoint attack?

To automatically patch vulnerabilities on the compromised endpoint

To provide a backup service for the attacker's data

To allow the attacker to remotely control compromised endpoints

To encrypt the endpoint's filesystem to prevent data theft

A security analyst is monitoring network traffic and notices that a host is making HTTP requests to a server that is known to be malicious. The requests contain a unique identifier in the URL that changes every few minutes. The analyst suspects this is C2 traffic. Which technique is the attacker likely using to evade detection?

Using a high port number for C2 communication

Using a well-known domain name for the C2 server

Using fast-flux DNS to change the IP address of the C2 server

Using a static IP address for the C2 server

Which of the following is a common malware infection vector?

Physical damage to the hard drive

Encrypted HTTPS traffic from a trusted website

Email attachments containing malicious macros

Regular software updates from the vendor

CiscoCertified CyberOps Associate

Domain 2Objective 8

2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 10)

Part of the 2.0 Security Monitoring domain, which accounts for 25% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

25%of the exam

Questions 46–50

46application · medium
A small business wants to protect against ransomware. They have a limited budget and cannot afford a dedicated security team. Which mitigation strategy is most cost-effective and practical?
Select an answer first
47expert · medium
A security analyst is investigating a suspected C2 channel. The analyst observes that a compromised host sends DNS queries to a domain that is not on any blocklist. The queries are small and infrequent, and the responses contain TXT records with what appears to be encoded data. The analyst must determine whether this is C2 traffic. Which finding would most strongly confirm DNS tunneling?
Select an answer first
48foundation · easy
What is the primary role of command and control (C2) infrastructure in an endpoint attack?
Select an answer first
49application · medium
A security analyst is monitoring network traffic and notices that a host is making HTTP requests to a server that is known to be malicious. The requests contain a unique identifier in the URL that changes every few minutes. The analyst suspects this is C2 traffic. Which technique is the attacker likely using to evade detection?
Select an answer first
50foundation · easy
Which of the following is a common malware infection vector?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 10)

Questions 46–50

A small business wants to protect against ransomware. They have a limited budget and cannot afford a dedicated security team. Which mitigation strategy is most cost-effective and practical?

What is the primary role of command and control (C2) infrastructure in an endpoint attack?

Which of the following is a common malware infection vector?

Keep studying — 2.0 Security Monitoring