200-201 Practice Test 10 — 10 Questions

Question 1

A SOC analyst is tuning IDS signatures and notices that a particular signature triggers frequently on legitimate traffic from a specific internal application. The signature has a high false positive rate. What is the best action to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a suppression rule to ignore the specific source IP or application.. To reduce false positives without losing detection capability, the analyst should create a suppression filter that excludes the known benign IP or application from triggering the signature.

Answer

Disable the signature entirely.

Answer

Increase the severity of the signature to get more attention.

Answer

Change the signature action to 'alert' instead of 'drop'.

Question 2

A security analyst is examining system logs for signs of privilege escalation. Which THREE events are most relevant to detect such activity?

Accepted Answer

Execution of commands with sudo. Privilege escalation often involves account creation with elevated rights, changes to user privileges, and successful use of 'sudo' commands.

Answer

Multiple failed login attempts

Answer

Successful SSH login from a remote IP

Question 3

A security analyst is monitoring network traffic and notices a high volume of TCP SYN packets sent to various ports on a single host. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan uses TCP SYN packets to probe for open ports on a target host. Excessive SYN packets to multiple ports indicate a port scan.

Answer

DNS amplification

Answer

Smurf attack

Answer

ARP spoofing

Question 4

An analyst finds a YARA rule that matches a file containing the string 'MZ' at offset 0 and includes 'CreateRemoteThread'. This rule likely identifies:

Accepted Answer

A malicious executable. 'MZ' indicates a PE (Portable Executable) file, and 'CreateRemoteThread' is a common API used for process injection, suggesting malware.

Answer

A benign PDF

Answer

A network packet capture

Answer

A Linux ELF binary

Question 5

A security analyst is examining web server logs and finds an entry with method 'POST', URL '/login.php', response code '200', and user-agent 'Mozilla/5.0'. The log shows 100 similar entries from the same IP within 5 seconds. What is the most likely activity?

Accepted Answer

A brute-force attack on the login form. Multiple POST requests to a login page from a single IP in a short time suggests a brute-force password guessing attack.

Answer

A SQL injection attempt on the login page

Answer

A DDoS attack targeting the web server

Answer

A user repeatedly clicking the login button due to a slow connection

Question 6

A security analyst is using Wireshark to capture traffic from a network segment. They want to see only packets that contain the string 'password' in the payload. Which type of filter should they apply?

Accepted Answer

Display filter using 'frame contains "password"'. Display filters are applied after capture to filter packets based on criteria. A capture filter would limit packets captured, but the question implies after capture. The analyst wants to display only packets with 'password' in payload, which is a display filter.

Answer

Display filter using 'tcp.port == 80'

Answer

Capture filter using 'port 80'

Answer

Capture filter using 'tcp contains password'

Question 7

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)

Accepted Answer

Prioritize alerts based on severity and asset criticality.. Prioritizing by severity, correlating with threat intelligence, and checking for associated IoCs help focus on important alerts. Alert fatigue leads to missed incidents; automation and triage are key.

Answer

Investigate alerts in the order they were received.

Answer

Automatically close all low-severity alerts without review.

Question 8

An analyst is reviewing DNS logs and sees a high volume of NXDOMAIN responses for a specific domain. Which TWO scenarios could this indicate?

Accepted Answer

DNS amplification attack. High NXDOMAIN responses may indicate a DNS amplification attack (using resolvers to amplify traffic) or fast-flux DNS (rapidly changing IPs for malicious domains).

Answer

DNS tunneling

Answer

Legitimate website misconfiguration

Answer

Normal DNS caching behavior

Question 9

An analyst uses Wireshark to examine network traffic and wants to see only packets that contain the string 'password'. Which type of filter should be applied?

Accepted Answer

Display filter. Display filters in Wireshark allow filtering of already captured packets based on criteria like packet content.

Answer

Protocol filter

Answer

Capture filter

Answer

BPF filter

Question 10

Which of the following is a valid indicator of compromise (IoC)?

Accepted Answer

A file hash (MD5). An IoC is any artifact observed on a network or system that indicates a potential intrusion. File hashes (MD5/SHA-256) are commonly used IoCs.

Answer

The company's logo

Answer

An employee's email address

Answer

A user's full name