200-201 Practice Test 13 — 15 Questions

Question 1

A SIEM correlation rule triggers an alert when more than 10 failed login attempts from the same source IP occur within 60 seconds. Which attack is this rule designed to detect?

Accepted Answer

Brute force attack. This SIEM rule detects a brute force attack by correlating a high volume of failed login attempts (more than 10) from the same source IP within a short time window (60 seconds). Brute force attacks rely on rapid, repeated authentication attempts to guess credentials, and this threshold-based correlation is a classic detection method for such behavior.

Answer

Phishing attack

Answer

Man-in-the-middle

Answer

SQL injection

Question 2

During incident response on a Linux server, an analyst runs 'ss -tlnp' and sees an SSH service listening on a non-standard high port. Which step should the analyst take next to investigate potential unauthorized access?

Accepted Answer

Examine /var/log/auth.log for successful logins.. The correct next step is to examine /var/log/auth.log because it records authentication events, including successful SSH logins. Since the SSH service is listening on a non-standard high port, an attacker may have modified the SSH configuration to evade detection and then logged in. Reviewing auth.log will reveal if any unauthorized successful logins occurred, along with source IPs, usernames, and timestamps, which are critical for determining the scope of the incident. This directly addresses the potential unauthorized access indicated by the unusual listening port.

Answer

Review the bash history of root user.

Answer

Check /etc/crontab for malicious scheduled tasks.

Answer

Run 'ps aux' to list all processes.

Question 3

An incident response plan specifies that containment must be completed before eradication. A security analyst identifies a malware infection on a critical server. What should be done first?

Accepted Answer

Disconnect the server from the network. According to the incident response plan, containment must be completed before eradication. Disconnecting the server from the network (Option A) is the immediate containment action that prevents the malware from spreading laterally to other hosts, preserving the integrity of the network and allowing for forensic analysis. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized to limit damage before any eradication or recovery steps are taken.

Answer

Run antivirus scans

Answer

Notify law enforcement

Answer

Reinstall the operating system

Question 4

Drag and drop the steps to configure SSH access on a Cisco IOS switch into the correct order.

Accepted Answer

1. Configure hostname and domain name
2. Generate RSA keys
3. Create a local user account
4. Configure VTY lines to use SSH transport. SSH configuration requires domain name, RSA keys, a local user, and enabling SSH on vty lines.

Answer

1. Generate RSA keys
2. Configure hostname and domain name
3. Create a local user account
4. Configure VTY lines to use SSH transport

Answer

1. Create a local user account
2. Configure hostname and domain name
3. Generate RSA keys
4. Configure VTY lines to use SSH transport

Answer

1. Configure VTY lines to use SSH transport
2. Generate RSA keys
3. Configure hostname and domain name
4. Create a local user account

Question 5

A security administrator is implementing a privileged access management (PAM) solution. Which practice best enforces the principle of least privilege for administrators?

Accepted Answer

Use Just-in-Time administration to grant temporary privileges. Just-in-Time (JIT) administration is the correct practice because it dynamically grants elevated privileges only for the duration of a specific task, then automatically revokes them. This directly enforces the principle of least privilege by ensuring administrators have no standing, permanent access beyond what is immediately needed. In contrast, shared accounts, permanent rights, or mere monitoring all leave excessive or uncontrolled privileges in place.

Answer

Create shared admin accounts for the team

Answer

Grant permanent admin rights to all senior administrators

Answer

Monitor admin activity without restricting access

Question 6

A SOC analyst is analyzing NetFlow data and notices a sudden spike in outbound traffic from a single internal host to an external IP address during non-business hours. The traffic volume is significantly higher than the baseline. Which suspicion is most likely?

Accepted Answer

Data exfiltration is occurring. A sudden increase in outbound traffic to a single external IP, especially outside business hours, often indicates data exfiltration.

Answer

The host is running a backup to cloud storage

Answer

The host is part of a botnet performing DDoS attack

Answer

The host is performing legitimate software updates

Question 7

Drag and drop the steps for the TCP three-way handshake into the correct order.

Accepted Answer

Step 1: SYN, Step 2: SYN-ACK, Step 3: ACK. The TCP three-way handshake must occur in the order: SYN, SYN-ACK, ACK. This sequence synchronizes sequence numbers and establishes a reliable connection before data transfer. Any deviation breaks protocol rules and prevents connection setup.

Answer

Step 1: SYN, Step 2: ACK, Step 3: SYN-ACK

Answer

Step 1: SYN-ACK, Step 2: SYN, Step 3: ACK

Answer

Step 1: ACK, Step 2: SYN, Step 3: SYN-ACK

Question 8

Which Linux log file is most appropriate for reviewing failed SSH login attempts?

Accepted Answer

/var/log/auth.log. /var/log/auth.log is the standard Linux log file that records authentication events, including successful and failed SSH login attempts, sudo usage, and PAM-related messages. On Debian/Ubuntu systems, sshd logs authentication failures here via the authpriv facility. This makes it the most appropriate file for reviewing failed SSH logins.

Answer

/var/log/messages

Answer

/var/log/kern.log

Answer

/var/log/syslog

Question 9

Refer to the exhibit. Based on the intrusion event, what is the likely intent of the traffic?

Accepted Answer

Buffer overflow attempt. The intrusion event shows a long string of 'A' characters (0x41) being sent to an HTTP server, which is a classic pattern for a buffer overflow attack. The intent is to overflow a buffer in the web server software, potentially overwriting memory and executing arbitrary code, making D the correct answer.

Answer

Denial of service

Answer

Normal web browsing

Answer

Port scan

Question 10

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Accepted Answer

Enter global configuration mode, then create the VLAN, then name the VLAN, then assign ports to the VLAN.. The correct sequence for VLAN configuration on a Cisco switch is to first enter global configuration mode with 'configure terminal', then create the VLAN using 'vlan vlan-id', which places you in VLAN configuration mode. Next, assign a name with 'name vlan-name', and finally exit VLAN config mode and configure interfaces to belong to the VLAN using 'switchport access vlan vlan-id'. This order ensures the VLAN exists and has a meaningful identifier before ports are assigned.

Answer

Enter global configuration mode, then name the VLAN, then create the VLAN, then assign ports to the VLAN.

Answer

Create the VLAN, then enter global configuration mode, then name the VLAN, then assign ports to the VLAN.

Answer

Enter global configuration mode, then create the VLAN, then assign ports to the VLAN, then name the VLAN.

Question 11

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Accepted Answer

Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal. Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Answer

Place both servers on the internal network with host-based firewalls

Answer

Use a VPN between the web server and database server

Answer

Place both servers on the same VLAN with a firewall between them

Question 12

A security analyst is investigating an alert from a host-based intrusion detection system (HIDS) that detected a file modification in the system32 directory. Which log source should the analyst check first to understand the process that made the change?

Accepted Answer

Windows Event Logs.. Windows Event Logs (specifically Security Event ID 4656 or 4663) record detailed information about file operations, including the process that initiated the modification. Since the HIDS detected a file change in system32, the Event Logs provide the process name, user account, and timestamp needed to trace the source of the modification.

Answer

Firewall logs.

Answer

NetFlow data.

Answer

DNS logs.

Question 13

A security analyst is collecting evidence from a compromised system for legal proceedings. Which TWO actions are critical to preserve the integrity of the evidence?

Accepted Answer

Compute a cryptographic hash of the original drive before imaging. Option B is correct because computing a cryptographic hash (e.g., SHA-256 or MD5) of the original drive before imaging establishes a verifiable baseline value that can later be compared against the hash of the forensic image to prove the copy is bit-for-bit identical and unaltered, which is essential for evidence admissibility. Option E is correct because a hardware or software write-blocker prevents any write operations from reaching the source drive during imaging, ensuring the original evidence is not modified and preserving its integrity for legal proceedings. Option A is wrong because storing evidence in a public folder exposes it to tampering, unauthorized access, and contamination, destroying the chain of custody. Option C is wrong because deleting files alters the original evidence and constitutes spoliation. Option D is wrong because running the system normally modifies the drive and volatile state, contaminating the evidence rather than preserving it.

Answer

Store the evidence in a public folder for easy access

Answer

Delete any sensitive files to protect privacy

Answer

Run the system normally to capture volatile data

Question 14

Drag and drop the steps to implement a disaster recovery plan for a critical server into the correct order.

Accepted Answer

Step 1: Identify critical assets and risks, Step 2: Backup data and configurations, Step 3: Test recovery procedures, Step 4: Document the plan, Step 5: Execute recovery when needed. The correct sequence for implementing a disaster recovery plan is Identify, Backup, Test, Document, Execute. This ensures you know what to protect, create usable backups, validate recovery procedures, maintain a clear plan, and act effectively during a disaster.

Answer

Step 1: Backup data and configurations, Step 2: Identify critical assets and risks, Step 3: Test recovery procedures, Step 4: Document the plan, Step 5: Execute recovery when needed

Answer

Step 1: Identify critical assets and risks, Step 2: Backup data and configurations, Step 3: Document the plan, Step 4: Test recovery procedures, Step 5: Execute recovery when needed

Answer

Step 1: Identify critical assets and risks, Step 2: Test recovery procedures, Step 3: Backup data and configurations, Step 4: Document the plan, Step 5: Execute recovery when needed

Question 15

Drag and drop the steps to analyze a packet capture for suspicious activity into the correct order.

Accepted Answer

Open the packet capture, then Filter the traffic, then Examine the packets, then Correlate findings, then Document results.. The correct sequence for packet capture analysis starts by opening the capture file, then applying filters to isolate relevant traffic, examining the filtered packets for anomalies, correlating findings across different packets or sessions, and finally documenting the analysis results for reporting and future reference. This order ensures efficiency and accuracy.

Answer

Open the packet capture, then Examine the packets, then Filter the traffic, then Correlate findings, then Document results.

Answer

Open the packet capture, then Filter the traffic, then Document results, then Examine the packets, then Correlate findings.

Answer

Document results, then Correlate findings, then Examine the packets, then Filter the traffic, then Open the packet capture.