Objective 2.0

Security Monitoring

200-201 Practice Questions

Monitoring questions test your ability to match the right signal type to the right tool. Metrics for dashboards, logs for forensics, traces for distributed systems — keep this mapping in mind for every scenario.

Full Practice Test →All Objectives

What this objective tests

200-201 Security Monitoring — Key Topics

Monitoring and logging questions test metrics, logs, and traces as the three pillars of observability, and how to choose the right tool for each signal type.

Metrics (time-series data), logs (events), and traces (distributed request flow) — and which tools handle each.
Alert types: threshold-based, anomaly-based, and composite — and when each is appropriate.
Log levels: DEBUG, INFO, WARN, ERROR, CRITICAL — and what should be logged at each level.
Retention policies, aggregation, and the cost trade-off of storing high-cardinality data.

Common exam traps

Where candidates lose marks on Security Monitoring

⚠Choosing a logging solution for real-time metric alerting — logs work for metrics but introduce latency.
⚠Setting all log levels to DEBUG in production — high-volume debug logging degrades performance.
⚠Treating an alert silence as a resolution — silencing without root-cause investigation leaves the issue active.
⚠Forgetting that distributed tracing requires instrumentation in every service in the call chain.

200-201 Security Monitoring — Practice Questions

30 questions from this objective

Question 2easymultiple choice

Security Monitoring

200-201 Security Monitoring — Key Topics

Where candidates lose marks on Security Monitoring

200-201 Security Monitoring — Practice Questions

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Which TWO are common indicators of a compromised host? (Choose two.)

Which THREE are essential components of a security monitoring strategy? (Choose three.)

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Exhibit

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Exhibit

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Exhibit

Exhibit

Drag and drop the steps for the TCP three-way handshake into the correct order.

Drag and drop the steps to analyze a packet capture for suspicious activity into the correct order.

All 200-201 Objectives

Security Monitoring

200-201 Security Monitoring — Key Topics

Where candidates lose marks on Security Monitoring

200-201 Security Monitoring — Practice Questions

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

An analyst is investigating a host that is beaconing to a known malicious domain every 60 seconds. The host also shows outbound connections to multiple IPs on port 443. To confirm the beaconing, which data source is most useful?

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

A company uses a SIEM with correlation rules. They notice that a rule designed to detect brute-force attacks is not triggering even though failed logins are occurring. Which is the most likely cause?

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

An analyst observes a sudden spike in DNS queries from an internal host to a random subdomain of a legitimate domain (e.g., randomstring.google.com). This behavior is consistent with which technique?

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Which TWO are common indicators of a compromised host? (Choose two.)

Which THREE are essential components of a security monitoring strategy? (Choose three.)

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Refer to the exhibit. An analyst configures an ACL to block traffic to a malicious host on port 443. After applying it inbound on the external interface, the analyst sees the ACL counters. What does the output indicate?

Exhibit

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Exhibit

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Exhibit

Exhibit

Drag and drop the steps for the TCP three-way handshake into the correct order.

Drag and drop the steps to analyze a packet capture for suspicious activity into the correct order.

All 200-201 Objectives