200-201 Practice Test 1 — 10 Questions

Question 1

A security analyst observes repeated failed login attempts to an internal web server from multiple external IP addresses. The analyst creates a correlation rule that triggers an alert if more than 10 failed logins occur from a single source IP within 5 minutes. After deploying the rule, the analyst finds that the rule generates false positives from legitimate users who mistype passwords. Which action should the analyst take to reduce false positives while maintaining detection effectiveness?

Accepted Answer

Increase the threshold to 15 failed logins within a 10-minute window.. Option D is correct because increasing the threshold to 15 failed logins within a 10-minute window reduces false positives by allowing more mistyped attempts from legitimate users before triggering an alert, while still detecting brute-force attacks. The longer time window and higher threshold smooth out transient user errors without significantly delaying detection of sustained attack patterns.

Answer

Whitelist all external IP addresses that belong to business partners.

Answer

Reduce the time window to 2 minutes to catch attacks faster.

Answer

Change the rule to block the source IP after 5 failed attempts.

Question 2

A security analyst is investigating a host that is suspected of being used as a pivot point in a network intrusion. The analyst needs to identify which process initiated an outbound connection to a known malicious IP address. Which host-based analysis approach should the analyst use to correlate the network connection to the specific process?

Accepted Answer

Run 'netstat -b' on the Windows host to display active connections with the associated process executable.. Running 'netstat -b' on a Windows host displays active TCP connections along with the executable name of the process that created each connection. This directly correlates the outbound connection to the malicious IP with the specific process, which is exactly what the analyst needs to identify the pivot point.

Answer

Examine the Windows Firewall log to see the source and destination IP addresses and ports for outbound traffic.

Answer

Review Windows Security Event Log for Event ID 4688 (Process Creation) for the timeline of process starts.

Answer

Use PowerShell cmdlet 'Get-NetTCPConnection' to list current TCP connections and their states.

Question 3

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Accepted Answer

A sudden increase in traffic from a single source IP address. Option D is correct because a sudden increase in traffic from a single source IP address is a classic indicator of a direct DoS attack, where the attacker uses a single compromised host to flood the target with packets, overwhelming its resources. This contrasts with a distributed denial-of-service (DDoS) attack, which uses multiple sources. The abrupt spike in volume from one IP is a clear anomaly that network monitoring tools flag as a potential DoS event.

Answer

A low level of network utilization on the target server

Answer

A gradual increase in traffic from multiple geographic locations

Answer

A high number of DNS queries from diverse source IPs

Question 4

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Accepted Answer

The deny statement with logging may generate excessive logs, potentially masking attacks.. The ACL has a single permit statement for traffic from 192.168.1.0/24 to 10.10.10.10 on port 443, followed by an implicit deny all that is logged. This means every packet that does not match the permit rule generates a log entry. In a production environment, even normal background noise (e.g., scans, broadcast traffic) can produce thousands of log messages per second, overwhelming syslog storage and masking malicious activity. The core issue is that logging on the deny-all can cause log flooding, not that the permit lacks logging.

Answer

The ACL is applied inbound on the outside interface, which could allow external traffic.

Answer

The permit statement does not have logging enabled, so traffic is not monitored.

Answer

The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.

Question 5

Which TWO of the following are indicators of a network intrusion? (Choose two.)

Accepted Answer

A sudden increase in DNS queries to unknown domains from a single host. Option D is correct because a sudden spike in DNS queries to unknown domains from a single host is a classic sign of DNS tunneling or command-and-control (C2) activity. Attackers often use DNS to exfiltrate data or communicate with external servers by encoding data in DNS queries, bypassing traditional firewall rules that allow DNS traffic.

Answer

High bandwidth usage during business hours

Answer

A single failed login attempt from an internal user

Answer

Regular ICMP echo requests to external hosts

Question 6

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Accepted Answer

Brute force attempt on Telnet service. The log shows repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23, which is the default port for Telnet. Multiple failed connection attempts to a Telnet service indicate a brute force attack, where an attacker tries to guess credentials by repeatedly attempting to log in.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

ICMP flood attack

Question 7

Drag and drop the steps for the TCP three-way handshake into the correct order.

Question 8

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Question 9

Drag and drop the steps for initial configuration of a Cisco IOS device after booting into the correct order.

Question 10

Drag and drop the steps to implement a disaster recovery plan for a critical server into the correct order.