200-201 Practice Test 14 — 15 Questions

Question 1

Which THREE are examples of social engineering attacks? (Select three.)

Accepted Answer

Smishing. Smishing is a form of social engineering attack that uses SMS (Short Message Service) text messages to trick recipients into revealing sensitive information or clicking malicious links. Unlike technical attacks that exploit system vulnerabilities, smishing relies on psychological manipulation, making it a classic social engineering vector.

Answer

Man-in-the-middle

Answer

SQL injection

Question 2

A SOC analyst is investigating a suspicious file on a Windows host. The file hash matches a known malware variant in a threat intelligence feed. What is the next best step for host-based analysis?

Accepted Answer

Check for persistence mechanisms such as registry Run keys or scheduled tasks. After confirming a file hash matches a known malware variant, the immediate priority for host-based analysis is to determine how the malware maintains persistence on the system. Persistence mechanisms such as Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or scheduled tasks (via schtasks.exe) allow malware to survive reboots and re-establish execution. Identifying these artifacts is critical for containment and eradication, as it reveals the malware's foothold and prevents re-infection after removal.

Answer

Run a full antivirus scan on the host

Answer

Disable the network adapter to prevent further communication

Answer

Reboot the host to clear the malware from memory

Question 3

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains a sense of urgency. Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 4

Which type of malware is designed to replicate itself and spread to other systems without user intervention?

Accepted Answer

Worm. A worm is malware that self-replicates and spreads to other systems automatically, without requiring user interaction or a host program. It typically exploits network vulnerabilities or weak credentials to propagate across networks. This autonomous spreading behavior is the defining characteristic that distinguishes worms from other malware types.

Answer

Virus

Answer

Ransomware

Answer

Trojan

Question 5

Match each Linux command to its function.

Accepted Answer

ls: List directory contents. These commands are essential for Linux system administration and security analysis.

Answer

chmod: Display current running processes

Answer

ps: Change file permissions

Question 6

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following are common indicators that data exfiltration may be occurring over DNS? (Choose two.)

Accepted Answer

High volume of DNS queries to a single domain not normally visited. Option C is correct because DNS tunneling and exfiltration tools typically generate a high volume of queries to a single attacker-controlled domain that is not normally seen in the environment, as the malware encodes stolen data into the query names and needs many requests to move the data out. Option D is correct because DNS TXT records can carry arbitrary payloads, so unusually large TXT responses are a classic sign of data being returned or acknowledged over DNS, often used by tunneling utilities like iodine or dnscat2. Options A, B, and E are not valid indicators: multiple IP addresses in a response is normal for load balancing or round-robin DNS, AAAA queries from an IPv4-only network are common on dual-stack clients and OS resolvers, and high TTL values simply reflect caching policy and have no direct relationship to exfiltration.

Answer

DNS responses with a large number of IP addresses

Answer

DNS queries for AAAA records (IPv6) from an IPv4-only network

Answer

DNS query responses with high TTL values

Question 7

Refer to the exhibit. A network administrator notices that remote SSH logins to the router succeed, but the router is not sending accounting records. Based on the configuration, what is the most likely cause?

Accepted Answer

The accounting command references a TACACS+ group that is not defined.. The `accounting exec default` command references a TACACS+ server group named 'tacacs_server_group' that is not defined in the configuration. Without a defined server group, the router cannot send accounting records to any TACACS+ server, even though SSH authentication succeeds via the local database.

Answer

The AAA authorization method is set to local, not TACACS+.

Answer

The TACACS+ server key is not configured correctly.

Answer

The AAA authentication method uses local database instead of TACACS+.

Question 8

A security analyst discovers that an attacker is using a vulnerability scanning tool to identify open ports on the company's network. Which type of attack is being performed?

Accepted Answer

Active reconnaissance. Active reconnaissance involves directly interacting with the target system to gather information, such as port scanning, vulnerability scanning, or banner grabbing. Using a vulnerability scanning tool to identify open ports sends packets to the target and elicits responses, which is the definition of active reconnaissance. This contrasts with passive reconnaissance, which collects information without direct interaction.

Answer

Social engineering

Answer

Passive reconnaissance

Answer

Denial of Service

Question 9

Which NIST Cybersecurity Framework function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function of the NIST Cybersecurity Framework involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services. It covers access control, awareness training, data security, protective technology, and maintenance. This function limits or contains the impact of a potential cybersecurity event.

Answer

Respond

Answer

Detect

Answer

Identify

Question 10

A security policy requires that all remote access be authenticated using a one-time password (OTP) token. Which technology should be implemented?

Accepted Answer

RADIUS with token server. RADIUS with a token server is the correct choice because RADIUS is the standard protocol for carrying authentication requests from network access devices to an authentication server, and integrating a token server (e.g., RSA SecurID, Duo) enables one-time password validation. The token server generates or validates the OTP, and RADIUS relays the credentials, satisfying the policy requirement for OTP-based remote access authentication.

Answer

SSH key pairs

Answer

LDAP with username and password

Answer

VPN with pre-shared key

Question 11

An organization is conducting a risk assessment and wants to assign numerical values to the likelihood and impact of risks. Which type of risk assessment is being performed?

Accepted Answer

Quantitative risk assessment. Quantitative risk assessment uses numerical values (e.g., monetary, percentages) to calculate risk.

Answer

Operational risk assessment

Answer

Qualitative risk assessment

Answer

Hybrid risk assessment

Question 12

In a PKI, what is the role of a Certificate Authority (CA)?

Accepted Answer

Issues and validates digital certificates. A Certificate Authority (CA) is a trusted entity that issues and validates digital certificates. It verifies the identity of certificate applicants and signs the certificates with its private key, thereby binding a public key to an identity. This is the core function of a CA in a PKI.

Answer

Generates private keys for users

Answer

Provides symmetric keys for session encryption

Answer

Encrypts data for secure transmission

Question 13

Which element of the CIA triad is primarily compromised when an attacker successfully intercepts and reads encrypted network traffic without authorization?

Accepted Answer

Confidentiality. Confidentiality ensures data is not disclosed to unauthorized parties. When an attacker intercepts and reads encrypted traffic, the confidentiality of that data is breached because the adversary gains access to information they were not authorized to see. Integrity concerns unauthorized modification, and availability concerns disruption of access, neither of which is the primary impact of a read-only interception.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 14

A NetFlow report shows that host 10.0.0.5 has sent 1 GB of data to external IP 198.51.100.10 over port 443 in the last hour, while other hosts average 100 MB. This anomaly is most indicative of:

Accepted Answer

Data exfiltration. The sudden, disproportionate egress of 1 GB of data from a single host to an external IP over port 443 (HTTPS) is a classic indicator of data exfiltration. While HTTPS traffic is common, the volume anomaly—10x the average of other hosts—suggests unauthorized copying of sensitive data, as attackers often use encrypted channels to blend in with normal traffic.

Answer

Port scan activity

Answer

Normal video streaming

Answer

DNS amplification attack

Question 15

A critical security patch for a widely exploited vulnerability is released. The patch requires a system reboot during business hours. According to change management policy, what is the best procedure?

Accepted Answer

Submit an emergency change request for immediate approval. When a critical security patch addresses a widely exploited vulnerability, the immediate risk to the organization outweighs standard change windows. Change management policy typically includes an emergency change process that bypasses normal scheduling to allow rapid deployment with expedited approval, even if a reboot during business hours is required. This aligns with the principle of prioritizing security over availability in high-severity scenarios.

Answer

Deploy the patch only at the end of the business day

Answer

Wait for the next scheduled change window

Answer

Install the patch without approval