Why do attackers often use HTTP or HTTPS for C2 communication?

Because it is the only protocol that supports encryption

Because it blends in with normal web traffic and is often allowed through firewalls

Because it cannot be monitored by security tools

Because it provides the highest possible bandwidth for data transfer

Which technique is commonly used by malware to evade detection during C2 communication?

Using a single, well-known C2 server address

Using only raw TCP connections to a fixed IP address

Encoding C2 data within DNS queries and responses

Sending all C2 traffic in plaintext to avoid encryption overhead

What is an exploit kit?

A set of patches released by a software vendor

A collection of legitimate software tools for system administration

A type of antivirus software that removes malware

A toolkit that automates the exploitation of vulnerabilities to deliver malware

What is the fundamental cause of a buffer overflow vulnerability?

Writing more data to a buffer than it was allocated to hold

Failing to initialize a buffer before using it

Reading data from a buffer that has been freed from memory

Storing a large integer value in a small integer variable

A company has been hit by ransomware. The security team discovers that the ransomware was able to encrypt files on network shares because the service account used by the backup software had write access to those shares. The team is now designing a recovery plan. Which change would most reduce the impact of a future ransomware attack?

Disable the backup service account after business hours

Increase the frequency of full backups to every hour

Move all backups to a cloud provider

Use separate, least-privilege accounts for backup services and restrict their write access to backup repositories only

CiscoCertified CyberOps Associate

Domain 2Objective 8

2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 6)

Part of the 2.0 Security Monitoring domain, which accounts for 25% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

25%of the exam

Questions 26–30

26foundation · easy
Why do attackers often use HTTP or HTTPS for C2 communication?
Select an answer first
27foundation · easy
Which technique is commonly used by malware to evade detection during C2 communication?
Select an answer first
28foundation · easy
What is an exploit kit?
Select an answer first
29foundation · easy
What is the fundamental cause of a buffer overflow vulnerability?
Select an answer first
30expert · medium
A company has been hit by ransomware. The security team discovers that the ransomware was able to encrypt files on network shares because the service account used by the backup software had write access to those shares. The team is now designing a recovery plan. Which change would most reduce the impact of a future ransomware attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.