A server in a DMZ is being profiled after a suspected compromise. The analyst sees that port 4444 is listening and the associated process is named 'syslogd'. The analyst also notices that the legitimate syslog service is running under a different PID and listening on UDP 514. What should the analyst conclude from these findings?

The process name is likely spoofed, and the listening port 4444 may indicate a backdoor or unauthorized service.

The analyst should immediately block port 4444 because all TCP listeners are malicious.

The server is running a legitimate second syslog listener on TCP 4444.

The server has two syslog daemons running, which is a standard high-availability configuration.

A security analyst is profiling a Windows server and uses `Get-Service` to list running services. The analyst sees a service named `Tomcat9` that is running. Which additional command would best help the analyst determine if this service is listening on a network port?

Run `Get-WmiObject Win32_Service` to see the service path.

Run `Get-Process` to see the CPU usage of Tomcat.

Run `netstat -ano | findstr ` to see which ports the Tomcat process is using.

Run `Get-ItemProperty` on the Tomcat registry key.

An analyst is profiling a Windows server and finds that port 3389 is listening, but the process is `svchost.exe`. The analyst also sees that the Remote Desktop Services service is running. What is the most accurate finding?

The server is compromised because `svchost.exe` is listening on port 3389.

The server is running a database because `svchost.exe` hosts database services.

The server has Remote Desktop enabled, which is a potential attack surface if exposed externally.

The server is running a web server because port 3389 is used for HTTPS.

An analyst is profiling a web server and notices a process named 'nginx' running with a high CPU usage. The analyst also sees that the server is listening on port 8080 instead of the standard port 80. What does this combination suggest?

The analyst should block port 8080 to prevent unauthorized access.

The process is definitely a malware masquerading as nginx.

The server has been misconfigured and should be immediately shut down.

The server is running a legitimate web server on a non-standard port, possibly for a specific application.

CiscoCertified CyberOps Associate

Domain 5Objective 8

5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 4)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

15%of the exam

Questions 16–20

16application · medium
A server in a DMZ is being profiled after a suspected compromise. The analyst sees that port 4444 is listening and the associated process is named 'syslogd'. The analyst also notices that the legitimate syslog service is running under a different PID and listening on UDP 514. What should the analyst conclude from these findings?
Select an answer first
17application · medium
A security analyst is profiling a Windows server and uses `Get-Service` to list running services. The analyst sees a service named `Tomcat9` that is running. Which additional command would best help the analyst determine if this service is listening on a network port?
Select an answer first
18expert · hard
An analyst is profiling a Windows server and finds that port 3389 is listening, but the process is `svchost.exe`. The analyst also sees that the Remote Desktop Services service is running. What is the most accurate finding?
Select an answer first
19application · medium
An analyst is profiling a web server and notices a process named 'nginx' running with a high CPU usage. The analyst also sees that the server is listening on port 8080 instead of the standard port 80. What does this combination suggest?
Select an answer first
20foundation · easy
A security analyst is profiling a server and needs to see which user accounts are currently logged in. Which command is most appropriate for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 4)

Questions 16–20

A security analyst is profiling a Windows server and uses `Get-Service` to list running services. The analyst sees a service named `Tomcat9` that is running. Which additional command would best help the analyst determine if this service is listening on a network port?

An analyst is profiling a Windows server and finds that port 3389 is listening, but the process is `svchost.exe`. The analyst also sees that the Remote Desktop Services service is running. What is the most accurate finding?

An analyst is profiling a web server and notices a process named 'nginx' running with a high CPU usage. The analyst also sees that the server is listening on port 8080 instead of the standard port 80. What does this combination suggest?

A security analyst is profiling a server and needs to see which user accounts are currently logged in. Which command is most appropriate for this task?

Keep studying — 5.0 Security Policies and Procedures