200-201 Practice Test 10 — 10 Questions

Question 1

A company uses Cisco Firepower NGFW with intrusion prevention. The security team notices that some legitimate traffic is being blocked by the IPS, causing application outages. The analyst reviews the IPS signature events and finds false positives. What is the best approach to handle this without reducing security posture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom rule to exclude the affected traffic based on source/destination, while monitoring the signature for true positives.. It allows the security team to selectively exclude only the specific legitimate traffic causing false positives, using source/destination criteria in a custom rule, while keeping the IPS signature active for all other traffic. This approach maintains the overall security posture by still detecting true positives from the same signature against other traffic flows. Disabling or lowering the signature's severity would globally reduce detection capability, and updating the database may not address a signature that is inherently too broad for the environment.

Answer

Lower the severity of the signature to informational.

Answer

Disable the IPS signature that is causing the false positives.

Answer

Update the IPS signature database to the latest version.

Question 2

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

Accepted Answer

A threat exploits a vulnerability, resulting in risk.. In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Answer

A vulnerability is a potential danger; a threat is a weakness; risk is the impact.

Answer

A vulnerability is a potential attack; a threat is a weakness.

Answer

Risk is eliminated when a vulnerability is patched.

Question 3

A SOC Tier 2 analyst receives an escalated alert about a potential command-and-control (C2) communication. The analyst needs to correlate network logs with threat intelligence. Which data format and transport protocol pair is specifically designed for standardized threat intelligence sharing?

Accepted Answer

STIX and TAXII. STIX is the format, TAXII is the transport protocol for sharing threat intelligence.

Answer

OpenIOC and MISP

Answer

MISP and STIX

Answer

TAXII and OpenIOC

Question 4

During which phase of the NIST SP 800-61 Rev 2 incident response process does an organization develop an incident response plan and assemble a team?

Accepted Answer

Preparation. The Preparation phase includes developing the IR plan, team, tools, and conducting exercises.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 5

A SOC analyst is investigating a suspected data exfiltration. The analyst needs to preserve evidence from a compromised workstation. Which of the following is the CORRECT procedure to ensure evidence integrity?

Accepted Answer

Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.. Proper evidence preservation requires hashing the original disk before imaging and then hashing the image to verify integrity.

Answer

Create a forensic image without write-blocking, then hash the image.

Answer

Copy all files to an external drive without hashing.

Answer

Disconnect the hard drive and boot from a live CD to collect data.

Question 6

An analyst wants to determine if a specific executable has been run on a Windows system. Which artifact provides evidence of prior execution?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows when an executable runs, storing execution details such as the first eight file paths referenced and the last run time. Analyzing Prefetch files allows an analyst to determine if a specific executable has been executed, even if the executable itself has been deleted. This makes Prefetch the most direct artifact for evidence of prior execution.

Answer

Registry Run keys

Answer

Task Scheduler logs

Answer

Windows Event Logs

Question 7

Which TWO actions are appropriate when analyzing network traffic to identify a potential data exfiltration attempt?

Accepted Answer

Look for connections to known malicious IP addresses or domains.. Option A is correct because correlating observed connections against threat-intelligence lists of known malicious IP addresses and domains is a standard way to flag command-and-control or exfiltration endpoints during traffic analysis. Option E is correct because data exfiltration typically manifests as anomalously large outbound transfers (high byte counts, long-duration sessions, or off-hours uploads) to external hosts, making volume and destination analysis essential. Option B is wrong because clearing network logs destroys the very evidence needed for analysis and violates forensic preservation principles. Option C is wrong because exfiltration is outbound by nature, so focusing exclusively on inbound traffic would miss the activity being investigated. Option D is wrong because immediately blocking all outbound traffic from the suspect host is a containment/remediation action, not an analysis step, and it can tip off the attacker or disrupt evidence collection.

Answer

Clear the network logs to ensure accurate analysis.

Answer

Focus exclusively on inbound traffic from external sources.

Answer

Immediately block all outbound traffic from the suspect host.

Question 8

A company's security policy requires that all data classified as 'Confidential' must be encrypted at rest and in transit. This requirement is part of which policy?

Accepted Answer

Data Classification Policy. The requirement to encrypt 'Confidential' data is a direct outcome of a data classification policy, which defines categories (e.g., Public, Internal, Confidential, Restricted) and mandates specific security controls for each category. Encryption at rest and in transit is a typical control for the 'Confidential' tier, ensuring data is protected using mechanisms like AES-256 for storage and TLS 1.2+ for transmission.

Answer

Remote Access Policy

Answer

Password Policy

Answer

Acceptable Use Policy

Question 9

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. Standard well-known port assignments: HTTP=80, HTTPS=443, SSH=22, DNS=53. Common confusions include swapping HTTP/HTTPS ports or confusing SSH with Telnet.

Answer

HTTP: 443

Answer

SSH: 23

Question 10

An organization is conducting a risk assessment and assigns a monetary value to potential losses. Which risk assessment method is being used?

Accepted Answer

Quantitative risk assessment. Assigning a monetary value to potential losses is a hallmark of quantitative risk assessment. This method uses numerical data (e.g., dollar amounts, percentages) to calculate metrics such as Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE), enabling objective comparison of risks. In contrast, qualitative methods rely on subjective ratings like high/medium/low.

Answer

Risk treatment

Answer

Qualitative risk assessment

Answer

Risk identification