200-201 Practice Test 12 — 15 Questions

Question 1

Match each analysis type to its description.

Question 2

Which TWO host-based analysis techniques are most effective for detecting fileless malware?

Accepted Answer

Process memory analysis to detect injected code. Process memory analysis (A) is effective because fileless malware resides in memory without writing to disk, so examining running processes for injected code, suspicious memory regions, or anomalous API calls can directly detect the malicious payload. PowerShell script block logging (E) captures the full text of PowerShell commands executed, including obfuscated or encoded scripts that fileless malware often uses to load payloads directly into memory, making it a powerful host-based detection technique.

Answer

Network traffic analysis

Answer

Signature-based file scanning

Answer

Registry analysis for persistence

Question 3

An analyst is investigating a host that was compromised via a web exploit. The analyst has a pcap file of the network traffic. Which TWO pieces of evidence would indicate that the attacker established a persistent backdoor?

Accepted Answer

Regular beaconing to an external IP on a high port. Regular beaconing to an external IP on a high port (Option B) is a classic indicator of a persistent backdoor because the compromised host periodically initiates outbound connections to a command-and-control (C2) server, often using non-standard high ports (e.g., 4444, 8080, or 1337) to evade firewall rules. This behavior maintains a communication channel that allows the attacker to issue commands or exfiltrate data over time, even if the initial exploit vector is patched.

Answer

A single large file upload to a cloud service

Answer

A change in the host's registry

Answer

An SSH connection from an external IP

Question 4

An analyst sees this syslog message on the Cisco ASA. What is the most likely cause of this alert?

Accepted Answer

A DoS attack. The syslog message likely indicates a high rate of connection attempts or incomplete sessions (e.g., %ASA-4-106017: Deny TCP due to SYN flood or %ASA-4-733100: Drop rate exceeded). This is characteristic of a Denial of Service (DoS) attack, where an attacker overwhelms the firewall with traffic to exhaust resources or disrupt service. Option C is correct because the ASA's threshold-based alerting specifically triggers on abnormal traffic volumes that match DoS patterns.

Answer

Normal traffic spike

Answer

A routing loop

Answer

A misconfigured firewall

Question 5

Based on the Cisco ASA syslog message, what does this event indicate?

Accepted Answer

An inbound UDP packet from an external source to an internal destination was denied.. The syslog message indicates that an inbound UDP packet from an external source to an internal destination was denied by the Cisco ASA. The message includes the source and destination IP addresses and ports, and the action is 'denied' due to the access-group 'OUTSIDE_IN' applied to the outside interface. This matches option B, which correctly identifies the denied inbound UDP traffic.

Answer

A DNS response from an external server to an internal client was allowed.

Answer

The access-group "OUTSIDE_IN" is misconfigured.

Answer

An outbound UDP connection was denied.

Question 6

A healthcare organization uses an online patient portal where patients can view their medical records. Recently, it was discovered that patient records were being modified by an unauthorized insider, and the system suffered a ransomware attack that encrypted the database, making it inaccessible for three days. Which TWO security principles were primarily violated? (Choose two.)

Accepted Answer

Integrity. The unauthorized modification of patient records violates integrity, which ensures data has not been altered by unauthorized entities. The ransomware attack that encrypted the database and made it inaccessible for three days violates availability, which ensures systems and data are accessible when needed. These two incidents directly compromise the CIA triad principles of integrity and availability.

Answer

Confidentiality

Answer

Authentication

Answer

Non-repudiation

Question 7

During a host-based investigation, an analyst finds a process named 'svchost.exe' consuming high CPU. The process path is 'C:\Windows\Temp\svchost.exe'. What should the analyst conclude?

Accepted Answer

It is likely malware disguised as a legitimate process. The legitimate svchost.exe (Service Host) runs from C:\Windows\System32, not C:\Windows\Temp. The Temp directory is a common location for malware to masquerade as system processes to evade detection. High CPU usage combined with an anomalous path strongly indicates malicious activity, as legitimate svchost.exe instances are signed by Microsoft and reside in System32.

Answer

It is a legitimate Windows service host process

Answer

It is a third-party application that requires investigation

Answer

It is a temporary file created by Windows Update

Question 8

A host-based analysis tool reports that a file has a digital signature that is valid but from an untrusted publisher. What should the analyst interpret from this?

Accepted Answer

The file may be malicious or legitimate; further analysis is needed. A valid digital signature confirms the file has not been tampered with since signing, but it does not guarantee the publisher is trustworthy. An untrusted publisher means the signing certificate is not in the system's trusted root store or has been flagged by a security policy, so the file could be either legitimate (e.g., from a new or self-signed publisher) or malicious (e.g., signed with a stolen certificate). Therefore, further analysis—such as checking the file's reputation, behavior, or origin—is required to determine its safety.

Answer

The file is definitely malicious because the publisher is untrusted

Answer

The file's signature was revoked

Answer

The file is definitely safe because the signature is valid

Question 9

Which TWO locations in a Linux filesystem should be checked for evidence of malware persistence?

Accepted Answer

/var/spool/cron/crontabs. Option B is correct because cron is a standard Linux mechanism for scheduling recurring tasks, and malware often uses cron jobs to re-execute itself after a reboot or at specific intervals. The crontabs directory under /var/spool/cron/ contains the actual cron job files for each user, making it a primary location to check for unauthorized persistence entries. Malware can add a cron entry that downloads or runs a malicious script, ensuring its continued presence on the system.

Answer

/proc

Answer

/var/log/syslog

Answer

/etc/passwd

Question 10

Which two Sysmon Event IDs are most commonly associated with code injection techniques?

Accepted Answer

Event ID 8 (CreateRemoteThread). Sysmon Event ID 8 (CreateRemoteThread) is directly associated with code injection because it logs when a thread is created in a remote process, a common technique used by malware to inject malicious code into a legitimate process. Event ID 10 (ProcessAccess) is also critical as it records when a process opens a handle to another process, often a precursor to injecting code via APIs like OpenProcess and WriteProcessMemory.

Answer

Event ID 3 (Network connect)

Answer

Event ID 1 (Process creation)

Answer

Event ID 7 (Image loaded)

Question 11

Based on the exhibit, what is the most likely conclusion about the host's security state?

Accepted Answer

The host has a backdoor listening on UDP port 4444, and the established connection suggests an active command session via cmd.exe.. The exhibit shows svchost.exe listening on UDP port 4444, which is unusual because svchost.exe typically hosts Windows services over TCP or named pipes, not raw UDP. Additionally, an established TCP connection to 203.0.113.5 with cmd.exe as the associated process indicates an active command shell session, which is a classic sign of a backdoor. The combination of a non-standard UDP listener and an active cmd.exe connection strongly suggests the host is compromised with a backdoor providing remote command execution.

Answer

The svchost.exe process on UDP port 4444 indicates a Windows service that should be monitored.

Answer

The established TCP connection to 203.0.113.5 indicates data exfiltration to a known malicious IP.

Answer

The host is running a legitimate remote administration tool on port 4444.

Question 12

Which TWO actions are examples of false positive reduction techniques? (Choose two.)

Accepted Answer

Adding destination IP to whitelist. Adding a destination IP to a whitelist (option C) reduces false positives by excluding known benign traffic from triggering alerts. Increasing the signature threshold (option E) reduces false positives by requiring a higher number of matches or a larger event count before an alert is generated, filtering out low-level noise.

Answer

Changing signature action from drop to alert

Answer

Removing the sensor

Answer

Disabling all signatures

Question 13

As a SOC analyst, you are reviewing alerts from a network-based IDS. One alert is for 'ET TROJAN Zeus Trojan Check-in' triggered by traffic from an internal host to an external IP on port 8080. The IDS packet capture shows the traffic is encrypted. You check the host's antivirus logs and find that the host has not been scanned in 30 days. The host belongs to the HR department and typically accesses only internal resources and a few external HR portals. What should be your first action?

Accepted Answer

Perform a full antivirus scan on the host and review recent process activity.. Option C is correct because the alert indicates possible trojan activity; verifying with a scan and process review is appropriate before taking more drastic action. Option A is too aggressive without confirmation. Option B may be done but first need to verify host compromise. Option D is dangerous.

Answer

Ignore the alert because it is encrypted and likely a false positive.

Answer

Block the external IP address at the firewall.

Answer

Immediately isolate the host from the network by disabling its switch port.

Question 14

An analyst receives a syslog message with facility 'authpriv' and severity '3'. What does severity 3 indicate?

Accepted Answer

Error. Syslog severity levels range from 0 (Emergency) to 7 (Debug). Severity 3 corresponds to 'Error', which indicates error conditions that require attention but are not immediately critical. This is defined in RFC 5424, where level 3 is explicitly labeled 'Error' and is used for conditions such as configuration failures or service degradation.

Answer

Emergency

Answer

Critical

Answer

Alert

Question 15

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

Accepted Answer

NTP traffic. The syslog message %ASA-4-106023 shows a UDP deny from source 192.0.2.1 port 123 to destination 10.0.0.5 port 123. Port 123 is the well-known port for Network Time Protocol (NTP), which is used for clock synchronization. Therefore, the denied traffic is NTP traffic.

Answer

HTTP traffic

Answer

SNMP traffic

Answer

DNS traffic