200-201 Practice Test 12 — 15 Questions

Question 1

Which TWO are common sources of security event data in a Security Information and Event Management (SIEM) system?

Accepted Answer

NetFlow records. NetFlow records (B) are a common SIEM data source because they provide flow-level metadata—source/destination IP, ports, protocol, byte/packet counts, and timestamps—that SIEMs use for traffic analysis, anomaly detection, and threat hunting. Syslog from network devices (D) is also a core source, as routers, switches, and firewalls send event messages (e.g., RFC 5424/3164 format) to a SIEM for correlation and alerting. SMTP logs (A) are email-server logs and, while they can be ingested, they are not a common primary SIEM source category in the same way as flow and syslog data. SNMP traps (C) are asynchronous device notifications used mainly for network management/monitoring, not a standard SIEM event-data source. DNS queries (E) can be logged and analyzed for security (e.g., DNS tunneling), but they are a specialized telemetry type rather than one of the two common sources identified here.

Answer

SMTP logs

Answer

SNMP traps

Answer

DNS queries

Question 2

An organization uses STIX and TAXII to share threat intelligence with an ISAC. What is the purpose of TAXII in this scenario?

Accepted Answer

It provides a method to transport threat intelligence. TAXII is a protocol for exchanging STIX data.

Answer

It stores threat intelligence locally

Answer

It is a platform for malware analysis

Answer

It defines the format for threat indicators

Question 3

A network administrator has configured a SPAN port to send traffic to an intrusion detection system (IDS). However, the IDS is not seeing traffic from a specific VLAN. What is the most likely cause?

Accepted Answer

The SPAN source does not include that VLAN.. A SPAN (Switched Port Analyzer) port copies traffic from specified source interfaces or VLANs to a destination port. If the IDS is not seeing traffic from a specific VLAN, the most likely cause is that the SPAN configuration does not include that VLAN as a source. The administrator must explicitly specify the VLAN(s) to monitor using the `monitor session` command with the `vlan` keyword; otherwise, traffic from that VLAN will not be forwarded to the IDS.

Answer

The IDS interface is set to promiscuous mode.

Answer

The SPAN destination port is in trunk mode.

Answer

The IDS is in inline mode.

Question 4

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 5

An organization wants to ensure that security logs are tamper-proof and available for forensic analysis. Which logging best practice should be implemented?

Accepted Answer

Forward logs to a centralized, hardened log server with access controls. Forwarding logs to a centralized, hardened log server with access controls ensures tamper resistance and preserves forensic integrity. Centralization removes logs from the source device where an attacker with local access could alter or delete them, and hardening plus access controls prevents unauthorized modification. This is a core logging best practice for forensic readiness.

Answer

Retain logs for only 30 days to reduce storage costs

Answer

Encrypt logs before sending them to a remote server

Answer

Store logs locally on each device with read-only permissions

Question 6

Which security principle ensures that a user cannot deny having performed an action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In network security, this is often implemented through protocols like PKI (Public Key Infrastructure) where a sender signs data with their private key, and the receiver verifies it with the corresponding public key, providing irrefutable proof of origin.

Answer

Availability

Answer

Confidentiality

Answer

Integrity

Question 7

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Accepted Answer

Smart card. Smart card (Option B) is a valid MFA factor because it falls under the 'something you have' category. Multi-factor authentication requires at least two different categories from 'something you know' (e.g., password), 'something you have' (e.g., smart card, token), and 'something you are' (e.g., biometric). A smart card stores a digital certificate and private key, used for cryptographic authentication, typically requiring a PIN (knowledge factor) to unlock it, thus providing two-factor authentication when combined.

Answer

IP address whitelist

Answer

Password

Answer

Security question

Question 8

A security policy requires that all mobile devices connecting to corporate email must have a screen lock and be able to be remotely wiped. An employee's personal phone is lost. The employee reports the loss immediately. The phone is enrolled in MDM with remote wipe capability. However, the employee has not set a screen lock, violating policy. The phone contains synced email and contacts. What should the security team do?

Accepted Answer

Remotely wipe the phone immediately.. Remote wipe is the most critical action to protect corporate data. Option B is wrong because wiping should be done; Option C delays protection; Option D is impossible as the phone is lost.

Answer

Ask the employee to set a screen lock remotely.

Answer

Accept the risk since the phone is lost and wipe is possible.

Answer

Report the violation and suspend the employee's email access until compliance.

Question 9

Drag and drop the steps to perform a password recovery on a Cisco IOS router into the correct order.

Accepted Answer

Enter ROMmon, change confreg to 0x2142, reset router, boot router, restore config and change password. Password recovery: enter ROMmon, change confreg, reset, boot, then restore config and change password.

Answer

Reset router, boot router, change confreg to 0x2142, enter ROMmon, restore config and change password

Answer

Change confreg to 0x2142, enter ROMmon, reset router, boot router, restore config and change password

Answer

Boot router, reset router, enter ROMmon, change confreg to 0x2142, restore config and change password

Question 10

An organization's security policy requires data classification labels to be applied to all documents. A manager sends a spreadsheet containing employee PII (personally identifiable information) to the entire company without labeling. Which policy has been violated?

Accepted Answer

Data Classification Policy. The Data Classification Policy defines how data should be categorized and labeled based on sensitivity, such as PII. Sending an unlabeled spreadsheet containing PII violates this policy because it fails to apply the required classification label. The Acceptable Use Policy governs how resources can be used, not labeling.

Answer

Acceptable Use Policy

Answer

Remote Access Policy

Answer

Incident Response Policy

Question 11

An analyst receives an IDS alert with signature name 'ET TROJAN Win32.Zeus Checkin' and severity 'high'. The alert shows source IP 192.168.1.50 and destination IP 198.51.100.20 on port 443. Which action should the analyst take FIRST?

Accepted Answer

Isolate the source host from the network to prevent further communication.. The alert indicates a high-severity Zeus Trojan check-in, which is a known malware communicating with a command-and-control (C2) server. The first priority is to contain the threat by isolating the source host (192.168.1.50) to prevent further data exfiltration or lateral movement. Even though the traffic is encrypted over port 443 (HTTPS), the signature confirms malicious activity, so immediate isolation is the correct initial response per incident response best practices.

Answer

Check the host's web browsing history for suspicious websites.

Answer

Immediately block the destination IP on the firewall.

Answer

Ignore the alert because the traffic is encrypted over port 443.

Question 12

In a Zeek/Bro log, an analyst observes a connection with 'service' field set to 'dns' and 'query' field containing a long, random-looking subdomain. This could be indicative of which type of activity?

Accepted Answer

DNS tunneling for data exfiltration. A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Normal DNS resolution for a legitimate service

Question 13

An organization experiences a ransomware attack where files are encrypted and a ransom is demanded. Which element of the CIA triad is most directly impacted?

Accepted Answer

Availability. A ransomware attack encrypts files and demands payment, directly preventing users from accessing their data and systems. This loss of access is a direct impact on Availability, which ensures that information and resources are accessible when needed. The CIA triad's Availability element is most immediately compromised because the organization cannot retrieve or use its encrypted files.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality

Question 14

An IDS detected the following signature match: "ET TROJAN Zeus variant outbound connection to C2 server". The destination IP is flagged as a known malicious host. What should the analyst do FIRST?

Accepted Answer

Open the packet capture associated with the alert. The first step in incident response after an IDS alert is to validate the alert by examining the associated packet capture (PCAP). This allows the analyst to confirm whether the traffic truly matches the Zeus C2 signature, check for false positives, and gather contextual details such as payload content, timing, and protocol behavior. Without this validation, any subsequent action (blocking, isolating) could be premature or based on incomplete information.

Answer

Block the destination IP at the firewall

Answer

Ignore the alert because signatures can produce false positives

Answer

Isolate the source host from the network immediately

Question 15

An organization's security policy requires that all security incidents be reported within one hour of discovery. A junior analyst notices an unauthorized login attempt but is unsure if it qualifies as an incident. What should the analyst do first?

Accepted Answer

Report the suspicious activity immediately. Reporting suspicious activity immediately aligns with the policy, even if not confirmed. Waiting or deleting logs could violate reporting requirements.

Answer

Delete the logs to avoid false alarms

Answer

Wait until the incident is confirmed

Answer

Investigate on their own without reporting