200-201 Practice Test 12 — 15 Questions

Question 1

A security analyst is reviewing logs from a web server and notices a high volume of HTTP requests from a single IP address targeting the same login page within a short time frame. The analyst suspects a brute force attack. Which TWO actions are most appropriate to mitigate this type of attack? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement rate limiting on the login endpoint.. Implementing account lockout after a few failed attempts prevents further brute force attempts on the same account. Rate limiting restricts the number of requests from a single IP, slowing down the attack.

Answer

Disable the login page entirely.

Answer

Block all traffic from the offending IP address permanently.

Answer

Increase the password complexity requirements.

Question 2

An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?

Accepted Answer

Man-in-the-Middle. Man-in-the-Middle (MitM) attack involves an attacker intercepting and potentially altering communication between two parties without their knowledge.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 3

A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?

Accepted Answer

DDoS. A DDoS uses multiple sources to flood a target, making it unavailable.

Answer

ARP spoofing

Answer

DoS

Answer

DNS poisoning

Question 4

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Active reconnaissance involves direct interaction with the target. Port scanning, ping sweeps, and vulnerability scanning are active methods. Passive reconnaissance includes social engineering, Google searches, and WHOIS lookups.

Answer

Social engineering

Answer

WHOIS lookups

Question 5

A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?

Accepted Answer

An SSH brute-force attack from the internal host. Multiple denied connection attempts from the same internal IP to the same external IP on port 22 (SSH) with different source ports indicates a brute-force SSH attack. The firewall is denying the connections, but the pattern is indicative of an attack.

Answer

DNS tunneling

Answer

A legitimate SSH session

Answer

A port scan from the external host

Question 6

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. Integrity ensures that data is not altered by unauthorized individuals or processes.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Availability

Question 7

A company's security policy requires that sensitive data be encrypted at rest using AES-256. Which type of encryption does AES-256 represent?

Accepted Answer

Symmetric encryption. AES is a symmetric encryption algorithm, meaning the same key is used for encryption and decryption.

Answer

Hashing algorithm

Answer

Digital signature

Answer

Asymmetric encryption

Question 8

A security analyst is investigating an incident where an employee received an email that appeared to be from the company's IT department, requesting the employee to verify their account by clicking a link and entering their credentials. The employee complied, and later the attacker used those credentials to access the corporate VPN. Which combination of attack types best describes this incident?

Accepted Answer

Spear phishing and credential theft. The email is a social engineering technique known as phishing. Since it targeted a specific employee with a tailored message (IT department), it is spear phishing. The attacker then used the credentials to access the VPN, which is a direct use of the stolen information, not a separate attack like MitM.

Answer

Pretexting and privilege escalation

Answer

Phishing and man-in-the-middle

Answer

Vishing and brute force

Question 9

Refer to the exhibit. An ASA security policy is configured as shown. A user from the internet tries to access 192.168.1.5 via HTTP. What will happen?

Accepted Answer

Traffic will be denied. The ASA security policy shown uses an access control list (ACL) that implicitly denies all traffic unless explicitly permitted. Since the exhibit does not show any ACL entry permitting HTTP traffic from the internet to 192.168.1.5, the traffic is denied by default. The correct answer is B because the ASA's default behavior for inbound traffic on an interface is to deny it unless a matching permit ACE exists.

Answer

Traffic will be allowed, but logged

Answer

Traffic will be allowed only if it matches the subnet

Answer

Traffic will be permitted

Question 10

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

Accepted Answer

GET /products?id=1 UNION SELECT * FROM users. SQL injection often involves injecting SQL keywords like UNION or SELECT into parameters. 'id=1 UNION SELECT' is a classic example.

Answer

GET /login?user=admin&pass=password123

Answer

GET /search?q=

Answer

GET /index.html HTTP/1.1

Question 11

Refer to the exhibit. Based on the intrusion event, what is the likely intent of the traffic?

Accepted Answer

Buffer overflow attempt. The intrusion event shows a long string of 'A' characters (0x41) being sent to an HTTP server, which is a classic pattern for a buffer overflow attack. The intent is to overflow a buffer in the web server software, potentially overwriting memory and executing arbitrary code, making D the correct answer.

Answer

Denial of service

Answer

Normal web browsing

Answer

Port scan

Question 12

An organization has implemented a security information and event management (SIEM) system. The SOC analyst receives an alert indicating a high number of failed login attempts from a single IP address targeting a critical server. The analyst checks the server logs and finds that the server is configured to lock the account after 5 failed attempts. However, the alert shows thousands of attempts. Which of the following explains this discrepancy?

Accepted Answer

The failed attempts are against different usernames, not the same account. The account lockout policy (5 failed attempts) applies per individual username, not per source IP address. If the attacker is attempting to authenticate with many different usernames from the same IP, each username can fail up to 5 times before being locked, allowing thousands of total failed attempts across different accounts. The SIEM aggregates all failed authentication events from that IP, while the server's lockout mechanism only triggers per user, explaining the discrepancy.

Answer

The attacker is using a brute-force tool that bypasses account lockout

Answer

The server's logging is not capturing all authentication events

Answer

The SIEM alert is a false positive due to a misconfiguration

Question 13

An analyst receives an alert for 'ET WEB_SERVER Possible SQL Injection Attempt' triggered by a URL parameter containing ' OR 1=1--'. After investigating, the analyst confirms that the web application is not vulnerable to SQL injection and the request was a benign test. How should this alert be classified?

Accepted Answer

False positive. The alert triggered but there was no actual attack, so it is a false positive.

Answer

True negative

Answer

False negative

Answer

True positive

Question 14

An analyst is reviewing PCAP and sees a TCP stream with a Wireshark filter 'tcp.stream eq 0'. The conversation shows an interactive shell session with commands like 'whoami' and 'ls'. This is most likely evidence of what?

Accepted Answer

Reverse shell. An interactive shell session over TCP indicates a reverse shell, allowing the attacker to execute commands remotely.

Answer

DNS tunneling

Answer

SQL injection

Answer

ARP spoofing

Question 15

An analyst identifies HTTP traffic containing the string "" in the URL parameter. Which TWO attack types are likely being attempted?

Accepted Answer

HTML injection. The script tag is classic XSS; HTML injection occurs when attacker injects HTML content.

Answer

LDAP injection

Answer

Command injection

Answer

SQL injection