200-201 Practice Test 15 — 15 Questions

Question 1

A security analyst is reviewing a Snort alert that triggered on the signature 'ET TROJAN Win.Trojan.Generic'. What is the most likely reason this alert fired?

Accepted Answer

A system infected with a trojan. The Snort signature 'ET TROJAN Win.Trojan.Generic' is designed to detect network traffic patterns or payloads associated with known Trojan malware. When this alert fires, it indicates that the sensor observed data matching the signature's characteristics, most likely from a system that is infected with a Trojan and is communicating with a command-and-control server or performing malicious activity.

Answer

A legitimate Windows update

Answer

A misconfigured firewall

Answer

An attacker attempting to exploit a buffer overflow

Question 2

Which encryption method uses a single key for both encryption and decryption of data?

Accepted Answer

Symmetric encryption. Symmetric encryption uses a single shared key for both encryption and decryption of data. This is the defining characteristic of symmetric algorithms like AES, DES, and 3DES, where the same secret key must be known to both sender and receiver to protect confidentiality.

Answer

Asymmetric encryption

Answer

Digital signature

Answer

Hashing

Question 3

Match each Cisco CyberOps concept to its description.

Accepted Answer

IoC: Evidence that suggests a potential security incident or intrusion.. The correct matches are: IoC = evidence of intrusion, SIEM = log aggregation and analysis system, IPS = traffic monitoring and blocking device. Common confusions include swapping definitions between similar-sounding terms or confusing tools with indicators.

Answer

IoC: A system that aggregates logs for analysis.

Answer

SIEM: Evidence of compromise.

Answer

IPS: A device that translates private IP addresses to public.

Question 4

An analyst notices that a host is sending large amounts of data to an external IP address on TCP port 22 during non-business hours. What is the most likely activity?

Accepted Answer

Data exfiltration via SSH. SSH (TCP port 22) is commonly used for secure remote administration, but the scenario describes large data transfers to an external IP during non-business hours, which is a classic indicator of data exfiltration. Attackers often use SSH tunneling to bypass security controls and exfiltrate data because SSH encrypts the traffic, making it difficult for network monitoring tools to inspect the payload. The combination of high volume, external destination, and off-hours activity strongly suggests malicious data theft rather than legitimate administrative tasks.

Answer

Remote administration

Answer

DNS query

Answer

FTP file transfer

Question 5

A healthcare organization must comply with HIPAA. Which THREE security measures are typically required under HIPAA? (Choose three.)

Accepted Answer

Encryption of electronic protected health information (ePHI). HIPAA requires encryption of ePHI, access controls, and audit controls to ensure confidentiality, integrity, and availability of protected health information.

Answer

Regular vulnerability scanning of all internet-facing systems

Answer

Annual penetration testing by an external firm

Question 6

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the ASCII string 'MZ' at the beginning. What does this indicate?

Accepted Answer

The file is a Windows Portable Executable. The 'MZ' magic bytes (0x4D 0x5A) are the signature of a Portable Executable (PE) file, indicating it is a Windows executable. This is the first step in file identification.

Answer

The file is a plain text file

Answer

The file is a Linux ELF binary

Answer

The file is a PDF document

Question 7

An analyst is examining a Linux system for signs of an attacker establishing persistence. Which TWO of the following locations should the analyst check? (Choose two.)

Accepted Answer

/etc/systemd/system/. Common persistence mechanisms on Linux include cron jobs and systemd services. Bash history only records commands, not persistence. /proc is a virtual filesystem. /etc/passwd lists users but doesn't directly show persistence.

Answer

/etc/passwd

Answer

/proc/self/status

Answer

/home/user/.bash_history

Question 8

An analyst uses Volatility on a memory dump and runs the 'pstree' command. What specific information does this provide compared to 'pslist'?

Accepted Answer

It displays the process tree hierarchy.. pstree shows parent-child relationships between processes, which pslist does not.

Answer

It shows only hidden processes.

Answer

It extracts command line arguments.

Answer

It lists loaded kernel modules.

Question 9

A security analyst is analyzing a memory dump using Volatility. The command 'volatility -f mem.dump malfind' returns several results with VAD tags 'VadS' and 'Vadl'. What does this indicate?

Accepted Answer

The process likely has injected code, as these VAD tags indicate executable writable memory. Malfind detects injected code by scanning for VADs with specific protection flags. 'VadS' indicates a VAD with PAGE_EXECUTE_READWRITE protection, common for shellcode injection. 'Vadl' is for large pages. The presence of these tags strongly suggests code injection.

Answer

The process has no suspicious memory regions

Answer

The process has legitimate DLLs loaded in memory

Answer

The process is a kernel-mode driver

Question 10

A security analyst is investigating a Windows host suspected of malware infection. Which tool would allow the analyst to view parent-child relationships of running processes and inspect command line arguments?

Accepted Answer

Process Explorer. Process Explorer provides detailed process tree view and command line information, unlike Task Manager's default view or tasklist.

Answer

Task Manager

Answer

tasklist command

Answer

Resource Monitor

Question 11

An analyst finds a registry modification under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'. What is the primary use of this registry key?

Accepted Answer

To set a debugger that runs when the image is executed. Image File Execution Options (IFEO) allow setting debuggers for executables. Malware can abuse this for persistence or to inject code by setting a debugger that launches the malware when the legitimate executable is run.

Answer

To configure network firewall rules for the image

Answer

To change the file extension association for the image

Answer

To log all execution of the image to the Event Log

Question 12

During memory analysis using Volatility, an analyst suspects code injection. Which THREE commands would be most useful to identify injected code? (Select THREE)

Accepted Answer

malfind. malfind detects injected code, dlllist/ldrmodules show loaded modules anomalies, and pslist/pstree identify suspicious processes.

Answer

netscan

Answer

hashdump

Question 13

A forensic analyst is examining a suspicious file. The file has a high entropy score (close to 8.0) and the PE section names are obfuscated. Which tool or technique would best help determine if the file is packed?

Accepted Answer

Analyze the PE sections and calculate entropy to detect packing. High entropy suggests compressed or encrypted data, common in packed executables. Tools like PEiD or manual analysis using 'strings' and entropy calculation can confirm packing. Hash comparison with VirusTotal can also help.

Answer

Use the 'strings' command to extract readable strings

Answer

Check the file's digital signature

Answer

Run the 'file' command in Linux

Question 14

An analyst discovers a suspicious service on a Windows host. Which command can be used to query the status and details of services from the command line?

Accepted Answer

sc query. sc query displays service status and configuration. services.msc is GUI-based, tasklist shows processes, and net start lists running services but with less detail.

Answer

services.msc

Answer

net start

Answer

tasklist /svc

Question 15

During a host-based analysis, a Windows system is found to have a suspicious service that starts automatically. Which command-line tool can be used to query the status and configuration of services, particularly to identify non-standard service names or paths?

Accepted Answer

sc query. sc query displays detailed service information including name, display name, and binary path.

Answer

services.msc

Answer

tasklist /svc

Answer

net start