Objective 4.0

Network Intrusion Analysis

200-201 Practice Questions

Use this page to practise Network Intrusion Analysis questions for this certification. Focus on how the exam tests network intrusion analysis in scenario format — understanding the why behind each answer builds more durable knowledge than memorising options.

Full Practice Test →All Objectives

What this objective tests

200-201 Network Intrusion Analysis — Key Topics

Network Intrusion Analysis questions on this certification test your ability to deploy and manage network intrusion analysis concepts in scenario-based situations.

Core Network Intrusion Analysis concepts and how they apply in real-world cloud scenarios.
How to deploy network intrusion analysis correctly and verify the outcome.
Troubleshooting network intrusion analysis issues by interpreting error output and system state.
Cloud best practices and Network Intrusion Analysis design trade-offs tested by this certification.

Common exam traps

Where candidates lose marks on Network Intrusion Analysis

⚠Selecting the most expensive service when a simpler managed option meets the requirement.
⚠Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
⚠Choosing a global service fix when the issue is region-specific.
⚠Overlooking cost implications of cross-region data transfer in architecture questions.

200-201 Network Intrusion Analysis — Practice Questions

30 questions from this objective

Question 2easymultiple choice

Network Intrusion Analysis

200-201 Network Intrusion Analysis — Key Topics

Where candidates lose marks on Network Intrusion Analysis

200-201 Network Intrusion Analysis — Practice Questions

A security analyst reviews an alert from the IPS that shows a spike in TCP SYN packets from an external IP to multiple internal hosts on port 443. What is the most likely attack type?

An analyst notices that a host is sending large amounts of data to an external IP address on TCP port 22 during non-business hours. What is the most likely activity?

An analyst sees an alert: 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent (Mozilla/5.0 compatible; MSIE 6.0; Windows NT 5.1)'. The source is an internal host that typically uses Windows 10. What should the analyst suspect?

During an investigation, an analyst finds that an internal host has been communicating with a known malicious IP on port 445. Which protocol is most likely involved?

An analyst reviews NetFlow data and sees a single internal IP communicating with many external IPs on port 53, each with small UDP packets. The internal host is not a DNS server. What is the most likely explanation?

A security analyst detects a large number of TCP RST packets from a single external IP to various internal hosts. The internal hosts are not sending any corresponding packets. What is the most likely cause?

An analyst sees an alert from the IDS: 'ET TROJAN Possible Zeus Variant Outbound Connection'. What action should the analyst take first?

A host is infected with malware that uses DNS tunneling to exfiltrate data. Which type of analysis would best detect this activity?

An analyst observes that an internal host is sending ICMP echo requests with payloads containing random data to an external IP. The payload size is larger than typical. What is the most likely technique?

Which TWO types of network traffic should be analyzed to detect a data exfiltration attempt via HTTP? (Choose two.)

Which THREE indicators are commonly found in network traffic that suggest a host is part of a botnet? (Choose three.)

Which TWO network behaviors suggest an ARP spoofing attack is occurring? (Choose two.)

Refer to the exhibit. The analyst sees two IDS alerts from the same source. What should the analyst conclude?

Exhibit

Refer to the exhibit. A firewall log shows denied TCP traffic from an internal host to an external IP on consecutive ports. What type of activity is indicated?

Exhibit

Refer to the exhibit. An analyst sees repeated ICMP echo requests from a host to the broadcast address. What is this an example of?

Exhibit

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

An analyst needs to determine if a host is infected with malware that is attempting to contact a known malicious domain. Which log source is most appropriate for this analysis?

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Exhibit

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Based on the exhibit, what is the most likely type of attack being observed?

Exhibit

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Drag and drop the steps to implement a disaster recovery plan for a critical server into the correct order.

Match each Linux command to its function.

Match each analysis type to its description.

A security analyst observes a high volume of ICMP echo replies from multiple internal hosts to a single external IP address. Which type of network activity is most likely indicated?

All 200-201 Objectives

Network Intrusion Analysis

200-201 Network Intrusion Analysis — Key Topics

Where candidates lose marks on Network Intrusion Analysis

200-201 Network Intrusion Analysis — Practice Questions

A security analyst reviews an alert from the IPS that shows a spike in TCP SYN packets from an external IP to multiple internal hosts on port 443. What is the most likely attack type?

An analyst notices that a host is sending large amounts of data to an external IP address on TCP port 22 during non-business hours. What is the most likely activity?

An analyst sees an alert: 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent (Mozilla/5.0 compatible; MSIE 6.0; Windows NT 5.1)'. The source is an internal host that typically uses Windows 10. What should the analyst suspect?

During an investigation, an analyst finds that an internal host has been communicating with a known malicious IP on port 445. Which protocol is most likely involved?

An analyst reviews NetFlow data and sees a single internal IP communicating with many external IPs on port 53, each with small UDP packets. The internal host is not a DNS server. What is the most likely explanation?

A security analyst detects a large number of TCP RST packets from a single external IP to various internal hosts. The internal hosts are not sending any corresponding packets. What is the most likely cause?

An analyst sees an alert from the IDS: 'ET TROJAN Possible Zeus Variant Outbound Connection'. What action should the analyst take first?

A host is infected with malware that uses DNS tunneling to exfiltrate data. Which type of analysis would best detect this activity?

An analyst observes that an internal host is sending ICMP echo requests with payloads containing random data to an external IP. The payload size is larger than typical. What is the most likely technique?

Which TWO types of network traffic should be analyzed to detect a data exfiltration attempt via HTTP? (Choose two.)

Which THREE indicators are commonly found in network traffic that suggest a host is part of a botnet? (Choose three.)

Which TWO network behaviors suggest an ARP spoofing attack is occurring? (Choose two.)

Refer to the exhibit. The analyst sees two IDS alerts from the same source. What should the analyst conclude?

Exhibit

Refer to the exhibit. A firewall log shows denied TCP traffic from an internal host to an external IP on consecutive ports. What type of activity is indicated?

Exhibit

Refer to the exhibit. An analyst sees repeated ICMP echo requests from a host to the broadcast address. What is this an example of?

Exhibit

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

An analyst needs to determine if a host is infected with malware that is attempting to contact a known malicious domain. Which log source is most appropriate for this analysis?

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Exhibit

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Based on the exhibit, what is the most likely type of attack being observed?

Exhibit

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Drag and drop the steps to implement a disaster recovery plan for a critical server into the correct order.

Match each Linux command to its function.

Match each analysis type to its description.

A security analyst observes a high volume of ICMP echo replies from multiple internal hosts to a single external IP address. Which type of network activity is most likely indicated?

All 200-201 Objectives