200-201 Practice Test 13 — 15 Questions

Question 1

A security policy states that all portable media must be encrypted. An employee loses a USB drive containing customer data. The drive was encrypted with AES-256. Which of the following is true regarding policy compliance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy was followed, but the incident still needs to be reported per incident response procedures. The security policy mandates encryption for portable media, and AES-256 encryption was applied to the USB drive, so the policy was technically followed. However, the loss of a device containing customer data still triggers incident response procedures, as the encryption key or the possibility of decryption could be compromised, and reporting is required to assess risk and comply with breach notification laws.

Answer

The employee violated policy because the drive was lost

Answer

The policy was followed because the data was encrypted, so a breach is not reportable

Answer

Encryption is not sufficient, the employee should have used a different media

Question 2

Which TWO of the following are valid classifications for alerts during triage?

Accepted Answer

True positive. True positive and false positive are standard alert classifications.

Answer

Indeterminate

Answer

True negative

Answer

False negative

Question 3

An analyst observes a series of DNS queries for subdomains like 'ZGVzdGluYXRpb24= .malicious.com' where the subdomain part appears base64-encoded. The volume of DNS traffic from a single host is unusually high. Which exfiltration technique is most likely in use?

Accepted Answer

DNS tunnelling. DNS exfiltration encodes data in subdomain queries to bypass traditional monitoring.

Answer

FTP exfiltration

Answer

HTTP POST exfiltration

Answer

Steganography in images

Question 4

Which log type would an analyst examine to see failed login attempts to a Windows server?

Accepted Answer

System logs. System logs (Event Logs) on a Windows server record security-related events, including failed login attempts under Event ID 4625 (Windows 10/Server 2012 R2 and later). An analyst would examine these logs in Event Viewer under 'Windows Logs > Security' to identify authentication failures, which are critical for detecting brute-force attacks or unauthorized access attempts.

Answer

DNS logs

Answer

Firewall logs

Answer

Web server logs

Question 5

During an incident, an analyst observes the following in PCAP: (1) DNS queries with random-looking subdomains to a known malicious domain, (2) large outbound FTP transfers of .zip files, (3) HTTP POST requests with Base64-encoded data in the body. Which THREE exfiltration techniques are being used? (Select 3)

Accepted Answer

FTP exfiltration. DNS queries with encoded subdomains indicate DNS tunneling. FTP transfers indicate FTP exfiltration. HTTP POST with Base64 indicates HTTP exfiltration.

Answer

ICMP exfiltration

Answer

Steganography

Question 6

A security analyst observes periodic outbound HTTPS connections to an unusual domain that resolves to different IP addresses each time. This behavior is most indicative of:

Accepted Answer

Beaconing using DGA. Domain Generation Algorithms (DGA) are used to generate many domain names to evade blocklists, and C2 servers may use HTTPS with varying IPs.

Answer

Exfiltration via FTP

Answer

DNS tunnelling

Answer

Port scanning

Question 7

An analyst detects an attack where the attacker uses NTLM authentication with a hashed password instead of the plaintext password. This technique is known as:

Accepted Answer

Pass-the-hash. Pass-the-hash allows an attacker to authenticate using the hash of a password without knowing the actual password.

Answer

Password spraying

Answer

Brute force

Answer

Kerberos ticket reuse

Question 8

An analyst observes a large outbound FTP transfer to an external IP address from a server that normally does not generate such traffic. This is most likely an indicator of:

Accepted Answer

Exfiltration. Data exfiltration often involves large transfers to external destinations not typical for the host.

Answer

Persistence

Answer

Lateral movement

Answer

C2 communication

Question 9

An analyst is monitoring network traffic and observes a host making outbound HTTPS connections to a domain that appears to be generated by a Domain Generation Algorithm (DGA). Which phase of the Cyber Kill Chain best describes this activity?

Accepted Answer

Command and Control (C2). After installation, the malware contacts C2 servers to receive commands. DGA domains are used for C2 communication.

Answer

Installation

Answer

Actions on Objectives

Answer

Exploitation

Question 10

An analyst examines a PCAP and finds a series of UDP packets sent to multiple ports on a target. The target responds with ICMP 'Destination Unreachable (Port Unreachable)' messages for each port. What type of scan is being performed?

Accepted Answer

UDP scan. UDP scan sends UDP packets to ports. When a port is closed, the target responds with an ICMP port unreachable message. Open or filtered ports may not respond.

Answer

SYN scan

Answer

Xmas scan

Answer

FIN scan

Question 11

A threat hunter identifies a binary that uses a Domain Generation Algorithm (DGA) to create domain names like 'eksdghf23.com', 'mzncxv89.net' each day. The malware contacts these domains over HTTPS. Which phase of the Cyber Kill Chain is most directly associated with this technique?

Accepted Answer

Command and Control. DGA domains are used to maintain resilient command and control infrastructure, which falls under the C2 phase.

Answer

Installation

Answer

Exploitation

Answer

Actions on Objectives

Question 12

An analyst is investigating lateral movement and observes SMB authentication attempts from host A to multiple other hosts using NTLM authentication with a hash value instead of a password. Which attack technique is most likely being used?

Accepted Answer

Pass-the-hash attack. Pass-the-hash uses NTLM hashes to authenticate without the plaintext password. SMB authentication with hashes is a classic sign.

Answer

Brute force attack

Answer

Kerberos golden ticket attack

Answer

SMB relay attack

Question 13

Which TWO of the following are typical indicators of a C2 beaconing communication?

Accepted Answer

Regular intervals of communication at consistent times. C2 beaconing often involves regular periodic callbacks and communications to unusual domains. These patterns help attackers maintain persistence.

Answer

Large outbound data transfers to an external IP

Answer

Multiple failed login attempts from a single source

Answer

ICMP echo requests to multiple hosts

Question 14

In the Cyber Kill Chain, which phase involves sending a malicious attachment to a targeted user?

Accepted Answer

Delivery. The delivery phase is when the attacker transmits the weaponized payload to the target, e.g., via email attachment.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 15

An analyst detects multiple SMB authentication attempts from a single internal host to several other internal hosts using NTLM hashes instead of plaintext passwords. Which technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash uses captured NTLM hashes to authenticate to other systems without needing the plaintext password. This is a common lateral movement technique.

Answer

Brute force

Answer

Kerberoasting

Answer

Golden ticket attack