Exam 200-201 topic 1 question 421 discussion

Actual exam question from Cisco's 200-201

Question #: 421
Topic #: 1

[All 200-201 Questions]

Refer to the exhibit. What is occurring?

A. Monitoring of encrypted and unencrypted web sessions for diagnostics.
B. Analysis of traffic flows during network capacity testing.
C. Review of session logs for performance optimization in a distributed application environment.
D. Identifying possible malware communications and botnet activity

Show Suggested Answer

Suggested Answer: D 🗳️

by PeterParkerrrr at Jan. 25, 2025, 11:04 a.m.

Comments

Submit Cancel

PeterParkerrrr

4 months, 3 weeks ago

Selected Answer: A

http.request: HTTP request packets. These are typically unencrypted web traffic. tls.handshake.type eq 1: TLS handshake type 1, which corresponds to the ClientHello message in the TLS protocol. This is part of the initial stage of establishing a secure TLS connection (i.e., encrypted traffic). !(ssdp): Excludes SSDP (Simple Service Discovery Protocol), which is commonly used for device discovery in a local network. The analyst is looking at both unencrypted web traffic (HTTP requests) and encrypted traffic (TLS handshakes) but excluding device discovery traffic (SSDP).

upvoted 2 times

...