200-201 Cisco Exam Lab Questions

 The communication channel established from a compromised machine back to the attacker is known as a command and control (C2) channel. This channel allows attackers to maintain communication with the compromised system, issue commands, and potentially exfiltrate data. The C2 channel can be established using various protocols and methods to evade detection and maintain persistence.

 The log in the exhibit is generated by an Intrusion Prevention System (IPS) or Intrusion Detection System (IDS). It contains information about a TCP connection attempt, including the source IP address, destination IP address, and other details related to the connection. The presence of “TCP MISS” indicates that the system detected an anomaly or potential threat during the connection attempt. References := Cisco Cybersecurity Operations Fundamentals

The packet capture exhibit shows that the source IP address is 192.168.122.100 and it is sending a packet from source port 50272 to destination port 80 of destination IP address 81.179.179.69 using TCP protocol. The TCP protocol is indicated by the Protocol field which has the value 6. The source and destination ports are indicated by the SrcPort and DstPort fields respectively. The source and destination IP addresses are indicated by the SrcAddr and DstAddr fields respectively. References := Cisco Cybersecurity Operations Fundamentals - Module 3: Network Data and Event Analysis