200-201 Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. An analyst sees these log messages on a Cisco router. The source IP 10.0.0.2 is an internal server. What is the most likely explanation?

Accepted Answer

The internal server is trying to access the router's web interface, which is blocked by an ACL.. The log messages show repeated TCP connection attempts from internal server 10.0.0.2 to the router's IP on port 443 (HTTPS) and port 80 (HTTP), which are denied by an ACL. Since the source is an internal server and the destination is the router's own IP, this indicates the server is trying to reach the router's web interface, but the ACL is blocking those packets. Option C correctly identifies this scenario.

Answer

An external host is scanning the router.

Answer

The router is under a brute-force attack on the HTTP server.

Answer

The router is infected with malware and generating traffic.

Question 2

An organization wants to ensure that security logs are tamper-proof and available for forensic analysis. Which logging best practice should be implemented?

Accepted Answer

Forward logs to a centralized, hardened log server with access controls. Option D is correct because sending logs to a centralized, hardened log server with restricted access is the best practice. Option A is wrong because storing logs locally makes them vulnerable. Option B is wrong because encryption alone doesn't prevent tampering. Option C is wrong because short retention periods hinder forensics.

Answer

Retain logs for only 30 days to reduce storage costs

Answer

Encrypt logs before sending them to a remote server

Answer

Store logs locally on each device with read-only permissions

Question 3

A SOC analyst is reviewing alerts from a network-based intrusion detection system (NIDS). An alert indicates a potential SQL injection attempt, but the destination server is a web application that accepts SQL queries as part of its normal function. What should the analyst do?

Accepted Answer

Correlate with web server logs to determine if the request was malicious.. Option D is correct because the NIDS alert alone cannot confirm malicious intent when the destination server legitimately accepts SQL queries. Correlating with web server logs allows the analyst to examine the full HTTP request (e.g., parameters, payload, referrer) to distinguish between a benign feature usage and an actual SQL injection attack, such as detecting unexpected SQL keywords or syntax in input fields that should not contain them.

Answer

Disable the alert to reduce noise.

Answer

Tune the NIDS signature to ignore that server.

Answer

Immediately block the source IP.

Question 4

An analyst needs to configure syslog to forward logs from multiple network devices to a central SIEM. Which syslog severity level should be used to ensure security-relevant events are sent while minimizing bandwidth usage?

Accepted Answer

Level 4 (Warning). Option D (Level 4, Warning) is correct because it captures security-relevant events such as authentication failures, configuration changes, and interface errors while filtering out lower-severity informational and debug messages. This balances visibility of potential threats with minimal bandwidth consumption, as Warning-level logs are typically concise and less frequent than lower severity levels.

Answer

Level 0 (Emergency)

Answer

Level 7 (Debug)

Answer

Level 6 (Informational)

Question 5

Based on the exhibit, which traffic is permitted?

Accepted Answer

All HTTPS traffic to the host 198.51.100.10.. The exhibit shows an access control list (ACL) entry 'permit tcp any host 198.51.100.10 eq 443'. This permits TCP traffic with a destination port of 443 (HTTPS) to the specific host 198.51.100.10 from any source. Therefore, only HTTPS traffic destined to that host is permitted, making option D correct.

Answer

All IP traffic from the host 198.51.100.10.

Answer

Only HTTPS traffic from the host 198.51.100.10.

Answer

All TCP traffic from any host to any host.

Question 6

A company uses a SIEM that collects logs from firewalls, servers, and endpoints. The SIEM is generating a high volume of low-priority events, causing analysts to miss critical alerts. Which approach would best improve the signal-to-noise ratio?

Accepted Answer

Implement event filtering and correlation rules to reduce false positives.. The SIEM's high volume of low-priority events indicates a poor signal-to-noise ratio, where benign or irrelevant events drown out critical alerts. Implementing event filtering and correlation rules directly reduces false positives by discarding known noise (e.g., repeated benign scans) and grouping related events into meaningful alerts, allowing analysts to focus on genuine threats. This is the standard approach in SIEM tuning to improve detection fidelity without adding resources or data.

Answer

Deploy additional sensors to collect more data.

Answer

Hire more analysts to review all events.

Answer

Increase the storage capacity of the SIEM.

Question 7

A network administrator has configured a SPAN port to send traffic to an intrusion detection system (IDS). However, the IDS is not seeing traffic from a specific VLAN. What is the most likely cause?

Accepted Answer

The SPAN source does not include that VLAN.. A SPAN (Switched Port Analyzer) port copies traffic from specified source interfaces or VLANs to a destination port. If the IDS is not seeing traffic from a specific VLAN, the most likely cause is that the SPAN configuration does not include that VLAN as a source. The administrator must explicitly specify the VLAN(s) to monitor using the `monitor session` command with the `vlan` keyword; otherwise, traffic from that VLAN will not be forwarded to the IDS.

Answer

The IDS interface is set to promiscuous mode.

Answer

The SPAN destination port is in trunk mode.

Answer

The IDS is in inline mode.

Question 8

An organization is implementing monitoring for encrypted traffic without decrypting it. Which approach would be most effective for detecting malicious activity?

Accepted Answer

Use NetFlow analysis to identify unusual connection patterns. NetFlow analysis examines metadata (source/destination IPs, ports, protocols, byte counts) without decrypting the payload. Unusual patterns like beaconing to a known C2 server, data exfiltration via non-standard ports, or unexpected volumetric flows can indicate malicious activity even when the traffic is encrypted. This approach preserves privacy and compliance while still enabling threat detection through behavioral anomalies.

Answer

Deploy SSL/TLS inspection to decrypt traffic

Answer

Monitor SNMP traffic from endpoints

Answer

Block all encrypted traffic except from known good sources

Question 9

During a security incident, an analyst needs to preserve network evidence for forensic analysis. Which action should be taken first?

Accepted Answer

Capture the contents of volatile memory from affected systems.. During a security incident, the first priority is to capture volatile memory (RAM) because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. Option D is correct because volatile data is ephemeral and must be collected before any action that could alter the system state, such as shutdown or isolation.

Answer

Isolate the affected systems from the network.

Answer

Create a forensic image of all hard drives.

Answer

Shut down the affected systems to prevent further damage.

Question 10

A network administrator is using Cisco ISE to monitor endpoint authentication. Which report provides details on failed authentication attempts and the reasons?

Accepted Answer

RADIUS Authentication Report. The RADIUS Authentication Report in Cisco ISE specifically logs all authentication attempts, including failures, and provides detailed reasons for each failure (e.g., invalid credentials, user not found, or authorization policy mismatch). This report is the primary tool for troubleshooting failed authentications because it captures the RADIUS Access-Reject messages and the corresponding failure reasons from the ISE policy evaluation.

Answer

Endpoint Profiler Report

Answer

RADIUS Accounting Report

Answer

Active Session Report

Question 11

Which two are best practices for deploying network-based intrusion detection systems? (Choose two.)

Accepted Answer

Use tap or SPAN ports to ensure traffic visibility.. Options A and B are correct. Deploying sensors at network choke points ensures visibility of all traffic, and using tap or SPAN ports allows passive monitoring without introducing latency or failure points. Option C is not a best practice because placing sensors behind firewalls may miss attacks that never reach the firewall. Option D is not always appropriate as inline mode can introduce latency and is not required for detection. Option E would generate excessive false positives.

Answer

Place sensors behind firewalls to reduce false positives.

Answer

Enable all signatures to maximize detection.

Answer

Use inline mode for all sensors to enable blocking.

Question 12

Which of the following is a common indicator of a brute-force attack on an SSH server?

Accepted Answer

Repeated login attempts with different usernames and passwords in a short period.. A brute-force attack on an SSH server is characterized by a high volume of authentication attempts, typically using different usernames and passwords, in a short time window. This pattern aims to guess valid credentials through repeated trial and error, which is distinct from a single failure or a few successful logins. The rapid, automated nature of the attempts is the key indicator that distinguishes brute-force activity from normal user behavior.

Answer

A single failed login attempt.

Answer

Multiple successful logins from the same user.

Answer

High CPU usage on the server.

Question 13

Which TWO of the following are characteristics of behavioral-based anomaly detection in network monitoring? (Select 2)

Accepted Answer

Establishes a baseline of normal traffic. Correct: B (establishes baseline) and C (detects unknown attacks). A is wrong because signature-based detection is not behavioral. D is wrong because rule-based is static. E is wrong because only signature-based can decode encrypted payloads (if decryption used).

Answer

Relies on predefined signatures

Answer

Can inspect encrypted traffic without decryption

Answer

Uses static rules written by administrators

Question 14

You are a SOC analyst for a financial services firm. The firm uses a combination of Cisco Firepower IPS, Windows Event Log collection, and a custom SIEM. At 10:00 AM, the SIEM generates an alert: 'Event ID 4625: Multiple failed logins for user 'jdoe' from IP 10.0.0.100'. The alert fires 10 times within 5 minutes. The source IP is a file server. You check the file server's logs and see that it is running a scheduled script that attempts to map a network drive using jdoe's credentials. The script is legitimate and has been running for months. However, the script's credentials may have expired or changed. The user jdoe is currently on leave. The file server administrator confirms that the script is part of a backup process. What is the best course of action?

Accepted Answer

Update the script with correct credentials and clear the alert. The alert is a false positive triggered by a legitimate scheduled script that has been running for months. The root cause is expired or changed credentials for user 'jdoe'. Updating the script with the correct credentials resolves the issue without disrupting operations. Clearing the alert removes the noise from the SIEM, allowing the SOC to focus on genuine threats.

Answer

Escalate the alert to the incident response team for investigation

Answer

Disable user jdoe's account immediately to prevent further attempts

Answer

Block the file server's IP address in the firewall

Question 15

An analyst is monitoring network traffic and notices a host sending ICMP echo requests to multiple hosts in the same subnet with a pattern of incrementing TTL values. What is the most likely purpose of this activity?

Accepted Answer

Traceroute to map the network topology.. The pattern of incrementing TTL values in ICMP echo requests is the hallmark of a traceroute operation. Traceroute works by sending packets with TTL=1, then TTL=2, etc., so each successive router along the path decrements the TTL to 0 and sends back an ICMP Time Exceeded message, revealing the hop-by-hop path. The target host responds with an ICMP Echo Reply when the TTL is high enough to reach it, confirming the final hop.

Answer

DNS resolution attempt.

Answer

Ping sweep to identify active hosts.

Answer

Denial of service attack against a specific host.

200-201 Practice Test 16 — 15 Questions

Exhibit

200-201 Practice Test 16 — 15 Questions

Exhibit