What is the typical first stage of a ransomware attack lifecycle?

Exfiltration of data to the attacker

Initial infection, such as through a phishing email

Encryption of files on the endpoint

Which outcome is a direct result of a buffer overflow that corrupts adjacent memory but does not execute code?

The system automatically patches the vulnerability

The buffer is automatically resized to accommodate the data

The application crashes or behaves unexpectedly

The attacker gains persistent remote access

A security analyst observes that a compromised host is making periodic HTTP requests to a legitimate-looking website, with the URL containing random-looking strings. The responses include JavaScript that, when executed, instructs the host to download a second-stage payload. Which C2 evasion technique is being used?

DNS tunneling, where the random strings are subdomains used to encode commands.

Domain generation algorithm (DGA), where the host generates random domain names to connect to.

HTTP beaconing with encoded data in URLs, blending with normal web traffic to avoid detection.

Fast flux, where the domain's IP changes rapidly to evade blacklisting.

A developer is reviewing code for a network service that parses client-supplied data. The code uses a fixed-size buffer and does not check the length of the input. The service runs on a Linux server with NX (no-execute) and ASLR enabled. The developer proposes to fix the issue by adding a length check. Which additional mitigation should be considered to reduce the risk of exploitation?

Disable ASLR to simplify debugging and make the code more predictable.

Use a different programming language that does not require memory management.

Run the service as root to ensure it has enough memory for large inputs.

Use stack canaries to detect buffer overflows before the return address is corrupted.

A user clicks a link in an email that leads to a website hosting an exploit kit. The exploit kit scans the user's browser for vulnerabilities and delivers malware. Which infection vector is this?

Drive-by download via exploit kit

CiscoCertified CyberOps Associate

Domain 2Objective 8

2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 9)

Part of the 2.0 Security Monitoring domain, which accounts for 25% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

25%of the exam

Questions 41–45

41foundation · easy
What is the typical first stage of a ransomware attack lifecycle?
Select an answer first
42foundation · easy
Which outcome is a direct result of a buffer overflow that corrupts adjacent memory but does not execute code?
Select an answer first
43application · medium
A security analyst observes that a compromised host is making periodic HTTP requests to a legitimate-looking website, with the URL containing random-looking strings. The responses include JavaScript that, when executed, instructs the host to download a second-stage payload. Which C2 evasion technique is being used?
Select an answer first
44expert · hard
A developer is reviewing code for a network service that parses client-supplied data. The code uses a fixed-size buffer and does not check the length of the input. The service runs on a Linux server with NX (no-execute) and ASLR enabled. The developer proposes to fix the issue by adding a length check. Which additional mitigation should be considered to reduce the risk of exploitation?
Select an answer first
45application · medium
A user clicks a link in an email that leads to a website hosting an exploit kit. The exploit kit scans the user's browser for vulnerabilities and delivers malware. Which infection vector is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 9)

Questions 41–45

What is the typical first stage of a ransomware attack lifecycle?

Which outcome is a direct result of a buffer overflow that corrupts adjacent memory but does not execute code?

A user clicks a link in an email that leads to a website hosting an exploit kit. The exploit kit scans the user's browser for vulnerabilities and delivers malware. Which infection vector is this?

Keep studying — 2.0 Security Monitoring