200-201 Practice Test 14 — 15 Questions

Question 1

During an intrusion analysis, a SOC analyst reviews logs showing an outbound connection from an internal host to an external IP at 03:00 AM every 60 seconds. The traffic is HTTPS to a suspicious domain with a high entropy name. Which phase of the Cyber Kill Chain does this activity represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Command and Control (C2). Regular beaconing to an external domain indicates command and control (C2) communication.

Answer

Actions on Objectives

Answer

Delivery

Answer

Weaponisation

Question 2

An analyst reviews an alert that triggered on a network signature for 'shellcode' in a payload. The payload contains a sequence of NOP sleds followed by executable code. Which type of exploitation technique does this indicate?

Accepted Answer

Buffer overflow with NOP sled. A NOP sled is used to increase the chance of landing in the shellcode, commonly used in buffer overflow exploits.

Answer

Return-oriented programming (ROP)

Answer

Heap spray

Answer

Format string attack

Question 3

An analyst is triaging alerts and encounters a scenario where an IDS alerted on a network scan, but further investigation reveals the traffic was from a legitimate vulnerability scanner. Which TWO terms best describe this alert?

Accepted Answer

Benign trigger. The alert triggered but there is no actual attack (false positive). Since the scanner is legitimate, it is not malicious.

Answer

True negative

Answer

False negative

Answer

True positive

Question 4

During an incident response, an analyst identifies a PCAP containing an HTTP POST request to a suspicious external IP with a large payload. The response is not typical for web applications. What type of activity is most likely occurring?

Accepted Answer

Data exfiltration. Large outbound data transfers via HTTP POST to external IPs are indicative of data exfiltration.

Answer

SQL injection attack

Answer

Normal web browsing

Answer

Command and control beaconing

Question 5

A Linux server has been compromised. The analyst checks for persistence mechanisms. Which THREE of the following are common Linux persistence techniques that should be examined? (Select THREE)

Accepted Answer

Creating a systemd service unit. Creating a systemd service unit is a common Linux persistence technique because systemd is the default init system for most modern Linux distributions. An attacker can place a malicious service file (e.g., /etc/systemd/system/evil.service) that automatically starts the malware at boot or after a crash, ensuring continued access even after a reboot.

Answer

Changing the system timezone

Answer

Modifying the /etc/hosts file

Question 6

An analyst reviews IDS alerts and sees multiple alerts for the same signature from different internal IPs targeting the same external server. One common cause is...

Accepted Answer

A worm spreading internally. A worm spreading internally (option C) is the most likely cause because worms self-replicate and propagate across a network, generating identical IDS alerts from multiple internal IPs as each infected host attempts to connect to the same external server (e.g., for command-and-control or payload delivery). This pattern—same signature, multiple internal sources, single external target—is a classic indicator of worm activity, where the worm's propagation logic causes each compromised host to initiate similar outbound connections.

Answer

A false positive

Answer

A DDoS attack

Answer

A misconfigured server

Question 7

Which Wireshark display filter would an analyst use to view only HTTP packets that contain the word 'password' in the packet payload?

Accepted Answer

http contains "password". The `http contains "password"` display filter instructs Wireshark to match any HTTP packet whose payload includes the literal string 'password'. The `contains` operator performs a case-sensitive substring search across the entire HTTP protocol data (headers and body), which is exactly what an analyst needs to locate credentials or sensitive terms in HTTP traffic.

Answer

http.request.uri contains "password"

Answer

data contains "password"

Answer

tcp.port == 80 and frame contains "password"

Question 8

To protect sensitive data at rest, a company uses AES-256 encryption. This primarily ensures which security goal?

Accepted Answer

Confidentiality. AES-256 encryption transforms plaintext data into ciphertext using a 256-bit symmetric key, rendering it unreadable without the correct decryption key. This directly ensures confidentiality by preventing unauthorized access to the stored data, even if the storage medium is compromised.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 9

A company uses Cisco Firepower NGFW with intrusion prevention. An analyst notices that many legitimate HTTPS connections are being blocked by an IPS rule. What is the best approach to reduce false positives?

Accepted Answer

Create a custom rule exception for the specific destination IPs.. Creating a custom rule exception for the specific destination IPs is the best approach because it allows the IPS to continue blocking malicious traffic while exempting legitimate HTTPS connections that are incorrectly flagged. This maintains security posture by not weakening the rule globally, and it directly addresses the false positive without affecting detection of other threats.

Answer

Increase the severity threshold of the rule.

Answer

Disable the IPS rule entirely.

Answer

Change the rule action from 'Drop' to 'Alert'.

Question 10

You are a security analyst at a medium-sized company. The company uses a SIEM that collects logs from firewalls, IDS/IPS, and endpoint detection and response (EDR) agents. You receive an alert that a user's workstation (IP 10.0.1.25) has been making outbound connections to an IP address (198.51.100.10) on port 4444 (commonly used by malware). The alert includes a SIEM correlation rule that triggered when three or more connections to that IP occurred within 5 minutes. You check the EDR logs and see that the workstation is running a process named 'svchost.exe' that is connecting to that IP. The process path is C:\Windows\system32\svchost.exe, which is legitimate. However, you notice that the process has a digital signature from 'Microsoft Corporation', but the signature date is from 2021. The workstation's operating system is Windows 10 22H2, fully patched as of last month. The user reports that they have been experiencing slow performance and occasional pop-ups. Which action should you take FIRST to investigate this potential compromise?

Accepted Answer

Use the EDR to list all DLLs loaded by svchost.exe and look for any suspicious DLLs that are not from Microsoft.. The presence of a legitimate svchost.exe with a valid Microsoft signature does not rule out DLL sideloading or injection. By listing all DLLs loaded by the process, you can identify suspicious non-Microsoft DLLs that may be executing malicious code within the trusted svchost.exe context, which is a common technique used by malware to evade detection.

Answer

Perform a full system reimage of the workstation to ensure the malware is removed.

Answer

Immediately block the outbound connection to 198.51.100.10 at the firewall and isolate the workstation from the network.

Answer

Verify the digital signature of svchost.exe with Microsoft to ensure it has not been revoked.

Question 11

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following:

- Allowed inbound HTTPS to 10.0.1.10 from various external IPs.
- Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306.
- Allowed outbound from 10.0.1.10 to external IPs on port 443.

You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

Accepted Answer

Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.. The firewall logs show that outbound traffic from the web server (10.0.1.10) to the database server (10.0.2.10) on TCP 3306 is being denied, which causes the database errors. Since the web server initiates the connection to the database, a rule allowing this specific outbound traffic from the web server to the database server on port 3306 restores functionality while maintaining the default-deny posture. This is the most secure approach because it permits only the necessary traffic between the two specific hosts and port, without opening broader access.

Answer

Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.

Answer

Move the database server to the DMZ to avoid firewall restrictions.

Answer

Create a rule allowing all outbound traffic from the DMZ to the internal network.

Question 12

An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?

Accepted Answer

Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis. The immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.

Answer

Run an antivirus scan and if nothing is found, ignore the alert as a false positive

Answer

Immediately disconnect the workstation from the network and perform a full system restore from a known good backup

Answer

Delete the scheduled task and the script from the hidden folder, then reboot the workstation

Question 13

Which TWO are goals of a security operations center (SOC)? (Choose two.)

Accepted Answer

Continuous monitoring of security events. Continuous monitoring of security events is a primary goal of a SOC, ensuring real-time detection of threats through log aggregation and analysis from sources like firewalls, IDS/IPS, and endpoints. This aligns with the SOC's responsibility to maintain situational awareness and identify indicators of compromise (IoCs) as part of the NIST incident response lifecycle.

Answer

Managing user passwords

Answer

Developing software applications

Answer

Performing penetration tests

Question 14

A SOC analyst notices repeated failed login attempts from a single IP address against multiple user accounts. Which type of attack is most likely occurring?

Accepted Answer

Password spraying. Password spraying (C) is correct because the attack involves a single IP address attempting the same common password against multiple user accounts. This technique avoids account lockout policies that typically trigger after a few failed attempts on a single account, making it distinct from brute force attacks that target one account with many passwords.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Man-in-the-middle attack

Question 15

A company's acceptable use policy (AUP) prohibits personal devices on the corporate network. An employee is found connecting a personal tablet to access internal resources. What should the security team do?

Accepted Answer

Remind the employee of the AUP and request removal. The first step in enforcing an acceptable use policy (AUP) is to remind the employee of the policy and request voluntary compliance. This aligns with the principle of least disruption and progressive discipline: the security team should address the violation with a clear warning before escalating to technical enforcement. Blocking the device or disabling the port without prior notification could violate due process and may be disproportionate to a first-time, non-malicious violation.

Answer

Allow the device and update the policy

Answer

Block the device and investigate

Answer

Disable the network port