200-201 Practice Test 14 — 15 Questions

Question 1

You are a cybersecurity analyst at a large enterprise. The NOC team reports that users are experiencing intermittent connectivity to the company's internal web application hosted on 192.168.1.100:443. You review the IPS logs and see repeated alerts for signature 'ET WEB_SERVER Possible HTTP Response Splitting' triggered by traffic from the web server to internal clients. The signature fires on responses containing CRLF sequences. You examine a packet capture and observe that the web server sends HTTP responses with legitimate headers but occasionally includes extra CRLF sequences in the body. The application developers confirm that the web application is custom and uses unfiltered user input in HTTP headers. The security policy requires that all internal traffic be inspected and blocked by the IPS. What is the best course of action?

Accepted Answer

Request that the development team sanitize user input in HTTP headers to prevent CRLF injection, and in the meantime, create a custom signature that ignores CRLF sequences in the response body but alerts on header injection.. Option D is correct because the root cause is a vulnerability in the custom web application that allows CRLF injection into HTTP headers, which the IPS correctly detects as a potential HTTP Response Splitting attack. Simply disabling or bypassing the signature (options A, B, C) would leave the network exposed to a real security risk. The best course is to fix the application code to sanitize user input, and in the interim, create a custom IPS signature that differentiates between benign CRLF sequences in the response body (which are not exploitable) and malicious CRLF sequences in headers, thus maintaining security while reducing false positives.

Answer

Increase the threshold for the signature to require multiple occurrences before alerting, but keep blocking enabled.

Answer

Disable the HTTP Response Splitting signature entirely to restore connectivity, as the issue is a false positive.

Answer

Whitelist the web server IP address in the IPS policy so that traffic from that server is not inspected.

Question 2

Refer to the exhibit. Based on the intrusion event, what is the likely intent of the traffic?

Accepted Answer

Buffer overflow attempt. The intrusion event shows a long string of 'A' characters (0x41) being sent to an HTTP server, which is a classic pattern for a buffer overflow attack. The intent is to overflow a buffer in the web server software, potentially overwriting memory and executing arbitrary code, making D the correct answer.

Answer

Denial of service

Answer

Normal web browsing

Answer

Port scan

Question 3

An analyst is investigating an alert triggered by a Snort rule that matches traffic on port 445 (SMB). The analyst sees that the signature has a high false positive rate. Which THREE factors should the analyst evaluate to tune the signature for better accuracy? (Choose three.)

Accepted Answer

Creating a rule exception for internal subnets that use SMB for file sharing.. Option C is correct because creating a rule exception for internal subnets that legitimately use SMB for file sharing reduces false positives by excluding known benign traffic. This allows the Snort rule to focus on external or anomalous SMB traffic on port 445, improving detection accuracy without disabling the rule entirely.

Answer

Implementing a behavioral analysis heuristic to detect anomalous SMB activity.

Answer

Disabling the rule to eliminate false positives.

Question 4

An IDS generates an alert for a signature that matches HTTP traffic containing 'cmd.exe' in the URI. The analyst checks the packet and sees the URI is actually 'cmd.exe?help'. What should the analyst do?

Accepted Answer

Tune the signature to reduce false positives. The IDS signature triggered on the presence of 'cmd.exe' in the URI, but the actual traffic was 'cmd.exe?help', which is a legitimate help request and not an exploitation attempt. Tuning the signature to account for the query string reduces false positives without losing detection capability for actual attacks. This aligns with best practices for IDS management, where signatures are adjusted to match real threat patterns rather than exact strings.

Answer

Block the source IP

Answer

Disable the signature

Answer

Escalate to incident response

Question 5

Which TWO actions are characteristic of a port scan performed by an attacker? (Choose two.)

Accepted Answer

Using TCP SYN packets without completing the three-way handshake.. A is correct because a TCP SYN scan sends a SYN packet to initiate a connection but never completes the three-way handshake by sending the final ACK. This allows the attacker to determine if a port is open (SYN-ACK received) or closed (RST received) without establishing a full connection, which helps evade some logging mechanisms.

Answer

Randomly selecting target ports without any pattern.

Answer

Spoofing the source IP address to evade detection.

Answer

Sending packets at a very low rate to avoid triggering threshold-based alerts.

Question 6

What is the meaning of this syslog message?

Accepted Answer

A TCP connection from outside to inside was denied.. The syslog message indicates that a TCP connection attempt from an outside (lower-security) zone to an inside (higher-security) zone was denied by the ASA's implicit or explicit access control. By default, the Cisco ASA denies all inbound traffic from a lower security level to a higher security level unless explicitly permitted by an access-list applied to the interface. The message 'denied' confirms the packet was dropped, not allowed.

Answer

A TCP connection from inside to outside was denied.

Answer

The access group name is incorrect.

Answer

A TCP connection was allowed from inside to outside.

Question 7

A company's security policy requires that all remote access connections be authenticated using a certificate. Which type of control is this?

Accepted Answer

Preventive. Requiring a certificate for remote access authentication enforces a specific identity verification method before granting access. This is a preventive control because it stops unauthorized connections from being established by ensuring only devices with a valid certificate can initiate the session, directly blocking access before any data exchange occurs.

Answer

Corrective

Answer

Detective

Answer

Deterrent

Question 8

Refer to the exhibit. What traffic is the router permitting?

Accepted Answer

SSH. The router is permitting SSH traffic because the access control list (ACL) matches TCP port 22, which is the default port for SSH. SSH provides encrypted remote administration, and the ACL entry permits inbound TCP connections to port 22, allowing secure shell access to the router.

Answer

Telnet

Answer

HTTP

Answer

FTP

Question 9

A security analyst notices that a user's account has been used to access sensitive data outside of normal working hours. Which security concept is being violated?

Accepted Answer

Confidentiality. Option C is correct because confidential data was accessed by an unauthorized user, violating confidentiality. Option A is incorrect because availability refers to uptime, not data protection. Option B is incorrect because integrity ensures data is not altered, not that access is prevented. Option D is incorrect because non-repudiation deals with proof of action, not access control.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 10

Refer to the exhibit. An analyst examines the port security status on a switch interface. What action should the analyst take to restore connectivity to the device connected to this port?

Accepted Answer

Shut down and re-enable the interface. When a port security violation occurs (e.g., a MAC address limit is exceeded or a sticky MAC changes), the switch can be configured to err-disable the interface. The standard remediation is to administratively shut down the interface (shutdown) and then re-enable it (no shutdown), which clears the error condition and restores connectivity. This is the only action that directly addresses the err-disable state caused by the security violation.

Answer

Remove the port from the VLAN

Answer

Clear the MAC address table on the switch

Answer

Increase the maximum number of MAC addresses allowed

Question 11

A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)

Accepted Answer

Monitor DNS query sizes and frequencies. Option A is correct because DNS tunneling often involves unusually large query sizes (e.g., encoded data in subdomains) and abnormal query frequencies (e.g., thousands of requests per minute). Monitoring these metrics allows analysts to spot deviations from baseline behavior, which is a key detection technique for exfiltration via DNS. Option B is correct because a DNS sinkhole redirects malicious or suspicious DNS queries to a controlled IP address, effectively blocking the resolution of domains used for tunneling and preventing data from reaching the attacker's command-and-control server.

Answer

Disable recursive DNS on the internal DNS server

Answer

Implement DNSSEC

Answer

Block all DNS queries to external servers

Question 12

A small business uses a cloud-based email service. The IT administrator wants to protect against phishing attacks that target employees. Which security control should be implemented first?

Accepted Answer

Deploy a web application firewall (WAF). A Web Application Firewall (WAF) is the correct first control because it can inspect and filter HTTP/HTTPS traffic to the cloud-based email service, blocking malicious links, scripts, and known phishing payloads before they reach users. Since phishing attacks often rely on deceptive URLs and web-based content, a WAF provides a proactive, network-layer defense that reduces the attack surface immediately, without requiring user behavior changes or endpoint configuration.

Answer

Conduct weekly security awareness training

Answer

Install antivirus software on all endpoints

Answer

Enable multi-factor authentication (MFA) on email accounts

Question 13

A system administrator needs to grant access to a database for a new employee. According to the principle of least privilege, what should be done?

Accepted Answer

Grant only the minimum required permissions. Option B (Grant only the minimum required permissions) is correct. Option A (Grant full access) violates least privilege. Option C (Deny access until approval) is too restrictive and not a direct application of least privilege. Option D (Grant temporary admin access) is excessive.

Answer

Grant temporary admin access

Answer

Grant no access until manager approves

Answer

Grant full access and remove later

Question 14

Which THREE of the following are key principles of zero trust security? (Choose three.)

Accepted Answer

Least privilege. Least privilege is a core principle of zero trust because it ensures users, devices, and applications are granted only the minimum permissions necessary to perform their functions. This limits the blast radius of a potential compromise by restricting lateral movement and access to sensitive resources. In zero trust, least privilege is enforced through granular policies, often using micro-segmentation and identity-based access controls, rather than relying on network location.

Answer

Perimeter-based security

Answer

Implicit trust

Question 15

What is the effect of this configuration on a Cisco device?

Accepted Answer

Users are authenticated using the local database.. The configuration shown (not provided in the question, but implied by the correct answer) is a typical local authentication setup, such as 'aaa authentication login default local' or a username/password defined in the device's local database. This means the device uses its own stored credentials to authenticate users, not an external server. Option C is correct because local authentication is explicitly configured, bypassing any external AAA server.

Answer

Users are authenticated using a TACACS+ server.

Answer

Authorization is done via RADIUS.

Answer

No authentication is required.