Cisco Updated 200-201 Exam Questions and Answers by ruby-rose

The source IP address from an audit log that indicates a session which may have exploited a vulnerability is considered corroborative evidence. This type of evidence supports other evidence that suggests a security breach occurred. In the context of cybersecurity, corroborative evidence can help establish that an attack was carried out and can be used in conjunction with other data points to build a case during an investigation.

References := The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) training material discusses the types of data needed to investigate security incidents, which includes understanding the role of different types of evidence in building a security incident case1.

 When communicating via TLS, part of the handshake process involves presenting a certificate containing the server name, the name of the trusted CA that issued the certificate, and the public key of the server. The client can verify the validity of the certificate and use the public key to encrypt the data sent to the server. References := Cisco Cybersecurity Source Documents

The purpose of command and control (C&C) for network-aware malware is to allow an attacker to remotely control compromised systems. This includes sending commands to the malware, receiving data from the infected host, and updating the malware to evade detection or enhance its capabilities.

References: The CBROPS course materials cover the topic of network-aware malware and the role of command and control servers in managing such malware