2026 The Most Effective 200-201 with 478 Questions Answers [Q265-Q286]

Q265. A SOC analyst is investigating an incident that involves a Linux system that is identifying specific sessions. Which identifier tracks an active program?

Q266. Refer to the exhibit

An engineer is analyzing DNS response packets that are larger than expected The engineer looks closer and notices a lack of appropriate DNS queries What is occurring?

Q267. What is a description of a social engineering attack?

Q268. An organization’s security team has detected network spikes coming from the internal network. An investigation has concluded that the spike in traffic was from intensive network scanning How should the analyst collect the traffic to isolate the suspicious host?

Q269. An engineer received an alert affecting the degraded performance of a critical server. Analysis showed a heavy CPU and memory load. What is the next step the engineer should take to investigate this resource usage?

Q270. Refer to the exhibit.

What does the output indicate about the server with the IP address 172.18.104.139?

Q271. An engineer receives a security alert that traffic with a known TOR exit node has occurred on the network. What is the impact of this traffic?

Q272. A company receptionist received a threatening call referencing stealing assets and did not take any action assuming it was a social engineering attempt. Within 48 hours, multiple assets were breached, affecting the confidentiality of sensitive information. What is the threat actor in this incident?

Q273. At a company party a guest asks questions about the company’s user account format and password complexity. How is this type of conversation classified?

Q274. Refer to the exhibit.

What is the potential threat identified in this Stealthwatch dashboard?

Q275. Exhibit.

An engineer received a ticket about a slowdown of a web application, Drug analysis of traffic, the engineer suspects a possible attack on a web server. How should the engineer interpret the Wiresharat traffic capture?

Q276. Refer to the exhibit.

An attacker gained initial access to the company s network and ran an Nmap scan to advance with the lateral movement technique and to search the sensitive data Which two elements can an attacker identify from the scan? (Choose two.)

Q277. What is a collection of compromised machines that attackers use to carry out a DDoS attack?

Q278. Drag and drop the security concept from the left onto the example of that concept on the right.

Q279. Which event is user interaction?

Q280. What describes the vulnerability management process?

Q281. Refer to the exhibit.

What does this output indicate?

Q282. A developer is working on a project using a Linux tool that enables writing processes to obtain these required results:
* If the process is unsuccessful, a negative value is returned.
* If the process is successful, 0 value is returned to the child process, and the process ID is sent to the parent process.
Which component results from this operation?

Q283. Drag and drop the technology on the left onto the data type the technology provides on the right.

Q284. What does an attacker use to determine which network ports are listening on a potential target device?

Q285. Refer to the exhibit.

An analyst receives an IDS alert pertaining to a possible data exfiltration attempt. An additional set of logs is collected from different systems and analyzed. Which type of evidence do the logs provide in relation to the primary alert from the IDS?

Q286.

Refer to the exhibit. An engineer must map these events to the source technology that generated the event logs. To which technology do the generated logs belong?