200-201 Practice Test 17 — 15 Questions

Question 1

An analyst is performing memory forensics on a Windows machine using Volatility. Which command would be most useful to identify hidden or injected code within a process?

Accepted Answer

malfind. malfind identifies suspicious memory regions, such as injected code. pslist lists processes, netscan shows network connections, and dlllist lists loaded DLLs.

Answer

dlllist

Answer

netscan

Answer

pslist

Question 2

A security analyst is investigating a Windows workstation that experienced a series of failed logon attempts followed by a successful logon. Which TWO Windows Event IDs should the analyst examine to understand this activity?

Accepted Answer

4624 - An account was successfully logged on. 4625 is failed logon, 4624 is successful logon. These are the standard events for logon success/failure.

Answer

4720 - A user account was created

Answer

4648 - A logon was attempted using explicit credentials

Answer

4776 - The domain controller attempted to validate the credentials for an account

Question 3

During incident response, a Linux server is found to have an unknown process listening on a high TCP port. The process is not listed in any systemd unit files. Which command will best help identify the process parent and its command-line arguments?

Accepted Answer

cat /proc/[pid]/cmdline && cat /proc/[pid]/status. The /proc filesystem contains per-process directories. Checking /proc/[pid]/cmdline and /proc/[pid]/status reveals the command line and parent PID.

Answer

ps aux | grep [pid]

Answer

journalctl -u unknown.service

Answer

ss -tlnp | grep [pid]

Question 4

A security analyst is examining a Linux system suspected of compromise. Which THREE artifacts should be reviewed to identify potential persistence mechanisms?

Accepted Answer

Cron jobs in /etc/crontab and /var/spool/cron/. Cron jobs, systemd services, and bash history are key for persistence detection. SSH keys can also be used. /proc/cpuinfo is hardware info, not persistence.

Answer

Authorized SSH keys in ~/.ssh/authorized_keys

Answer

/proc/cpuinfo

Question 5

An analyst is reviewing Windows Event Logs and finds Event ID 4648. What does this event typically indicate?

Accepted Answer

A logon using explicit credentials. Event ID 4648 indicates that a logon was attempted using explicit credentials, meaning a user supplied credentials to run a program or access a resource.

Answer

A failed logon attempt

Answer

An account creation event

Answer

A successful logon event

Question 6

During a Linux incident response, an analyst runs 'ps aux' and sees a process with a suspicious name. The analyst wants to gather more information. Which TWO commands can provide the process's network connections?

Accepted Answer

cat /proc/[pid]/net/tcp. ss -tlnp shows listening TCP sockets with the process PID. /proc/[pid]/net/tcp contains TCP connection info for that process.

Answer

lsof -i

Answer

cat /var/log/syslog

Answer

netstat -antp

Question 7

An incident responder is analyzing a Windows machine for evidence of malware persistence. Which TWO registry keys are commonly abused to achieve automatic execution at user logon?

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. HKLM\...\Run and HKCU\...\Run are common persistence locations. RunOnce keys also exist but are for one-time execution. AppInit_DLLs is for DLL injection, and Image File Execution Options are for debugging.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

Question 8

An analyst is examining a suspicious PE file. The file's entropy is very high (close to 8.0) and the import table is almost empty. What does this indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy and a sparse import table strongly suggest the file is packed or encrypted. Packers often compress the original code, raising entropy and obfuscating imports.

Answer

The file is a DLL file

Answer

The file is a standard Windows executable with many imports

Answer

The file has been digitally signed

Question 9

A security analyst observes repeated failed login attempts from a single external IP address, causing the authentication server to become unresponsive. Which type of attack is occurring?

Accepted Answer

Denial of Service. A Denial of Service (DoS) attack aims to make a system or service unavailable by overwhelming it with requests.

Answer

Reconnaissance

Answer

Brute force attack

Answer

Man-in-the-middle

Question 10

During a security audit, it is discovered that an organization’s network is vulnerable to ARP spoofing attacks. Which type of attack could result from exploiting this vulnerability?

Accepted Answer

Man-in-the-middle. ARP spoofing can be used to perform man-in-the-middle attacks by associating the attacker's MAC address with the IP address of a legitimate host.

Answer

DNS poisoning

Answer

Phishing

Answer

DoS

Question 11

A security analyst is reviewing network logs and identifies several failed login attempts followed by a successful login from an unusual geographic location. Which TWO security concepts are most directly related to this scenario? (Choose two.)

Accepted Answer

Exploit. The failed attempts indicate an active attempt to exploit a vulnerability (threat), and the unusual location suggests unauthorized access (exploitation).

Answer

Non-repudiation

Answer

Risk

Answer

Vulnerability

Question 12

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. Integrity protects data from unauthorized alteration. Confidentiality prevents disclosure, availability ensures access.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Question 13

Which compliance framework specifically addresses the protection of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is designed to secure credit card transactions and protect cardholder data.

Answer

GDPR

Answer

ISO 27001

Answer

HIPAA

Question 14

A security analyst discovers that an employee's computer is infected with malware that encrypts files and demands payment. What type of malware is this?

Accepted Answer

Ransomware. Ransomware encrypts files and demands a ransom for decryption.

Answer

Spyware

Answer

Worm

Answer

Rootkit

Question 15

An analyst identifies a series of SMB authentication attempts from a compromised host to multiple internal servers. The authentication uses NTLM hashes. Which TWO techniques are most likely being used for lateral movement? (Select 2)

Accepted Answer

SMB relay. SMB relay (B) is correct because the attacker can intercept NTLM authentication attempts from the compromised host and relay them to other internal servers, gaining unauthorized access without needing to crack the hash. This technique leverages the SMB protocol's lack of channel binding in older implementations, allowing the relayed hash to authenticate to multiple targets.

Answer

Kerberoasting

Answer

Brute force

Answer

Golden ticket