200-201 Practice Test 16 — 15 Questions

Question 1

An analyst uses Wireshark to examine network traffic and wants to see only packets that contain the string 'password'. Which type of filter should be applied?

Accepted Answer

Display filter. A Wireshark display filter is applied after capture to narrow what is shown from already-captured packets, and it supports string matching operators like contains. The filter frame contains "password" (or tcp contains "password") is a display filter that shows only packets whose payload includes that string. Capture filters use BPF syntax and cannot perform arbitrary string matching on payload content.

Answer

Protocol filter

Answer

Capture filter

Answer

BPF filter

Question 2

A security analyst is investigating a network breach. Which TWO activities are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Reviewing LinkedIn profiles of employees. It is passive reconnaissance: the analyst gathers publicly available employee information from social media without directly interacting with the target's systems, so no packets are sent to the organization's infrastructure. Option D (Searching WHOIS records for domain registration details) is also correct because WHOIS queries retrieve publicly registered domain ownership, contact, and nameserver data from third-party registries, again without touching the target network. By contrast, option B (ping sweeps) and option E (port scans) are active reconnaissance techniques that send ICMP echo requests or TCP/UDP probes directly to target hosts, and option C (vulnerability scanning) is active because it transmits crafted probes to identify weaknesses on the target systems.

Answer

Sending ping sweeps to identify live hosts

Answer

Using a vulnerability scanner to find weaknesses

Answer

Performing a port scan on the target network

Question 3

A healthcare organization uses an online patient portal where patients can view their medical records. Recently, it was discovered that patient records were being modified by an unauthorized insider, and the system suffered a ransomware attack that encrypted the database, making it inaccessible for three days. Which TWO security principles were primarily violated? (Choose two.)

Accepted Answer

Integrity. Option C (Integrity) is correct because an unauthorized insider modified patient records, which is a direct violation of data integrity—the assurance that data has not been altered or tampered with by unauthorized parties. Option D (Availability) is correct because the ransomware attack encrypted the database and rendered it inaccessible for three days, directly violating availability, which ensures systems and data are accessible to authorized users when needed. Option A (Confidentiality) is not marked correct because the scenario describes modification and encryption-for-ransom rather than unauthorized disclosure or exposure of patient data. Option B (Authentication) is not marked correct because no failure of identity verification is described; the insider was authorized but acted improperly, and the ransomware is not framed as an authentication bypass. Option E (Non-repudiation) is not marked correct because the scenario does not involve disputing the origin or receipt of a transaction or proving that a specific party performed an action.

Answer

Confidentiality

Answer

Authentication

Answer

Non-repudiation

Question 4

Which OSI layer is responsible for logical addressing and routing, and is commonly targeted by IP spoofing attacks?

Accepted Answer

Network layer. The Network layer (Layer 3) handles logical addressing (IP addresses) and routing. IP spoofing involves falsifying the source IP address at this layer.

Answer

Application layer

Answer

Transport layer

Answer

Data Link layer

Question 5

A SOC analyst is reviewing a NetFlow record and sees that a single internal IP has communicated with multiple external IPs on port 445 (SMB) within a short time frame. Which type of activity is most likely indicated?

Accepted Answer

SMB scanning or worm propagation. Port 445 is used by SMB for file sharing, but a single internal IP communicating with many external IPs in a short time frame is characteristic of scanning or worm propagation. Worms like EternalBlue exploit SMB vulnerabilities to spread rapidly, generating many outbound connections to random or sequential external IPs on port 445. This pattern is not typical of normal file sharing, which involves sustained connections to known servers.

Answer

Normal file sharing activity

Answer

Data exfiltration over SMB

Answer

DNS tunneling

Question 6

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices without their knowledge. Which type of attack is this?

Accepted Answer

Man-in-the-middle (MitM). This scenario describes an attacker intercepting and modifying communications between two devices without their knowledge, which is the defining characteristic of a Man-in-the-Middle (MitM) attack. In a MitM attack, the attacker positions themselves between the two communicating parties, allowing them to eavesdrop, capture, and alter data in transit while both endpoints believe they are communicating directly with each other.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Denial of Service (DoS)

Question 7

An security auditor finds that the company's backup policy does not include offsite storage. The security policy requires that backups be stored in a geographically separate location. What should the company do?

Accepted Answer

Use encrypted cloud backup in a different region. The security policy requires backups to be stored in a geographically separate location. Using encrypted cloud backup in a different region satisfies both the offsite requirement and adds encryption for security. This approach ensures data is stored in a separate geographic location, meeting the policy, while also protecting data in transit and at rest.

Answer

Store backups in a fireproof safe on-site

Answer

Implement RAID on the backup server

Answer

Increase backup retention period

Question 8

A security analyst is reviewing firewall logs and notices a rule that denies traffic from source IP 10.0.0.5 to destination port 3389. What service is being blocked?

Accepted Answer

RDP. Port 3389 is the default port for Remote Desktop Protocol (RDP), which is used for remote graphical desktop access to Windows systems. The firewall rule denying traffic from 10.0.0.5 to this port blocks RDP connections, preventing that host from initiating remote desktop sessions.

Answer

SNMP

Answer

SMTP

Answer

SSH

Question 9

A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)

Accepted Answer

Monitor DNS query sizes and frequencies. Option A is correct because DNS tunneling works by encoding stolen data into the subdomains and TXT/CNAME records of DNS queries, which produces abnormally long query names and unusually high query volumes or frequencies to a single domain; monitoring query size and rate via DNS logging or an IDS/IPS with DNS inspection detects these anomalies. Option B is correct because a DNS sinkhole redirects queries for known malicious or tunneling domains to a controlled non-routable address, breaking the attacker's command-and-control and exfiltration channel and logging the attempted lookups. Option C is not correct because disabling recursion on an internal resolver does not stop tunneling, which typically uses the resolver's normal recursive lookups to reach external authoritative servers. Option D is not correct because DNSSEC only provides origin authentication and integrity of DNS responses; it does not detect or block data hidden in query payloads. Option E is not correct because blocking all external DNS would break legitimate name resolution and is an impractical, overbroad control rather than a targeted tunneling defense.

Answer

Disable recursive DNS on the internal DNS server

Answer

Implement DNSSEC

Answer

Block all DNS queries to external servers

Question 10

A SOC Tier 2 analyst is investigating an alert that was escalated from Tier 1. The analyst suspects the malware is using a new variant of ransomware. What is the most appropriate next step for the Tier 2 analyst?

Accepted Answer

Perform malware analysis and correlate with other alerts. A Tier 2 analyst's role is to perform deeper investigation than Tier 1, including malware analysis and correlating the alert with other telemetry to determine scope and impact. Performing malware analysis and correlating with other alerts is the appropriate next step to confirm whether the ransomware is a new variant and to understand its behavior. This informs containment and escalation decisions.

Answer

Notify legal counsel immediately

Answer

Escalate directly to Tier 3 for advanced analysis

Answer

Delete the affected files to contain the spread

Question 11

A security analyst at a financial firm is investigating a potential data breach. The company uses Cisco Firepower NGFW and Stealthwatch for network visibility. Over the past week, an internal server with IP 10.10.10.50 has been sending large amounts of data to an external IP 203.0.113.55 on TCP port 443. The Stealthwatch flow records show that the server typically communicates with only internal hosts and a few known external update servers. The analyst checks the Firepower events and sees no alerts for this traffic. The server is running a custom web application that handles financial transactions. The analyst suspects data exfiltration. What should the analyst do next?

Accepted Answer

Capture a packet trace of the suspicious traffic and analyze the SSL/TLS handshake to determine if the traffic is legitimate.. The traffic is encrypted over TCP port 443 (HTTPS), so the analyst cannot determine the content or legitimacy of the data transfer without decrypting or inspecting the SSL/TLS handshake. Capturing a packet trace allows the analyst to examine the TLS handshake details, such as the server certificate, cipher suites, and SNI, which can reveal whether the external IP is a legitimate service or an unauthorized endpoint. This step is non-disruptive and provides forensic evidence before taking any blocking or quarantine actions.

Answer

Immediately block the destination IP on the firewall and quarantine the server.

Answer

Review the server's web server logs for any unusual requests or responses.

Answer

Check the server's running processes and network connections with a command line tool like netstat.

Question 12

A security analyst is using a SIEM to create a correlation rule that triggers when more than 10 failed logins are detected from the same source IP within 1 minute. This rule is designed to detect which type of attack?

Accepted Answer

Brute-force attack. A correlation rule that fires on more than 10 failed logins from the same source IP within 1 minute is the textbook signature of a brute-force attack — an attacker rapidly guessing credentials against an authentication endpoint. The high frequency and single-source pattern distinguish it from slow, distributed password spraying. SIEM correlation rules are commonly tuned to this threshold to catch credential-guessing attempts in near real time.

Answer

Phishing attack

Answer

Privilege escalation

Answer

Man-in-the-middle attack

Question 13

Which TWO locations in a Linux filesystem should be checked for evidence of malware persistence?

Accepted Answer

/var/spool/cron/crontabs. Option B (/var/spool/cron/crontabs) is correct because this directory stores per-user crontab files on Debian-based Linux systems, and attackers commonly plant scheduled jobs here to re-execute malware at recurring intervals for persistence. Option D (/etc/init.d) is correct because it holds SysV init scripts that start services at boot; malicious or modified scripts here can relaunch malware automatically on system startup. Option A (/proc) is a virtual, in-memory pseudo-filesystem exposing kernel and process state, not a persistent storage location where malware would be planted. Option C (/var/log/syslog) is a log file used for recording events and auditing, not a persistence mechanism. Option E (/etc/passwd) is the user account database; while it can be abused for account creation, it is not a standard malware persistence location in the sense of scheduled or boot-time execution.

Answer

/proc

Answer

/var/log/syslog

Answer

/etc/passwd

Question 14

A security analyst is creating a policy for handling sensitive customer data. The policy must ensure data is encrypted at rest and in transit. Which type of policy most directly addresses this requirement?

Accepted Answer

Data Protection Policy. A Data Protection Policy is the governance document that directly specifies how data must be safeguarded, including requirements for encryption at rest and in transit, classification, retention, and handling of sensitive customer data. It is the policy type whose scope explicitly covers the confidentiality controls the analyst must enforce. The other policy types address different control domains and do not directly mandate encryption of data.

Answer

Incident Response Policy

Answer

Access Control Policy

Answer

Physical Security Policy

Question 15

A security analyst is evaluating risks and calculates that a threat has a likelihood of 0.5 and an impact of $200,000. What is the risk value?

Accepted Answer

$100,000. The risk value is calculated by multiplying the likelihood (0.5) by the impact ($200,000), resulting in $100,000. This is the standard quantitative risk analysis formula used in security assessments to prioritize threats.

Answer

$50,000

Answer

$400,000

Answer

$200,000