200-201 Practice Test 17 — 15 Questions

Question 1

An organization uses Cisco AMP for Endpoints. A file with a low prevalence score is executed on multiple endpoints, and AMP identifies it as malicious after behavioral analysis. The analyst needs to ensure that all endpoints are protected from this file. Which action should be taken?

Accepted Answer

Create a custom IOC for the file hash and apply it to an outbreak policy.. Creating a custom IOC for the file hash and applying it to an outbreak policy is correct because Cisco AMP for Endpoints uses outbreak policies to rapidly deploy protections across all endpoints. Once behavioral analysis identifies the file as malicious, the IOC (based on the file's SHA-256 hash) can be pushed via an outbreak policy to block execution, quarantine, or remediate the file on every endpoint, regardless of prior prevalence. This ensures immediate, global protection without waiting for cloud signature updates.

Answer

Isolate all endpoints that executed the file.

Answer

Disable cloud connectivity for AMP to prevent recurrence.

Answer

Run a scan on each endpoint using the local AMP engine.

Question 2

Refer to the exhibit. An analyst observes that the router's ACL is allowing all traffic to the web server at 192.168.1.100 on ports 80 and 443, but blocking all other TCP ports below 1024. However, the web server is also running an SSH service on port 22. What will happen to SSH traffic from the outside?

Accepted Answer

SSH will be denied because of the deny line range.. The ACL denies all TCP ports below 1024 except ports 80 and 443, which are explicitly permitted. Since SSH uses TCP port 22, which falls within the denied range (below 1024) and is not explicitly permitted, it is blocked by the deny line. The last line 'permit ip any any' only applies to traffic not already denied, but SSH traffic is already denied by the earlier rule, so it never reaches that permit statement.

Answer

SSH will be permitted because of the last line 'permit ip any any'.

Answer

SSH will be denied because the ACL does not have an explicit permit for SSH.

Answer

SSH will be permitted because it is not blocked by any rule.

Question 3

A SOC analyst is reviewing a firewall log and sees a large number of outbound connections from an internal server to a known command-and-control (C2) domain. The connections are on port 443, and the packets have irregular timing. What should the analyst do first?

Accepted Answer

Isolate the server from the network and escalate to incident response.. The irregular timing and outbound connections to a known C2 domain on port 443 strongly indicate a compromised host using HTTPS to blend in with normal traffic. Isolating the server first prevents further data exfiltration or lateral movement while preserving forensic evidence, which aligns with the NIST incident response framework. Escalating to incident response ensures proper handling and analysis.

Answer

Check the server's logs for signs of compromise.

Answer

Ignore the alert because port 443 is normal traffic.

Answer

Block the domain at the firewall immediately.

Question 4

A security analyst is monitoring network traffic and notices a sudden increase in outbound connections from a single workstation to multiple IP addresses on port 443 at regular intervals. The workstation is used for standard office applications. Which action should the analyst take first?

Accepted Answer

Correlate the connections with firewall logs and endpoint telemetry. Option A is correct because the sudden increase in outbound connections to multiple IPs on port 443 (HTTPS) from a single workstation could indicate command-and-control (C2) traffic, data exfiltration, or a compromised system. The first step should be to correlate these connections with firewall logs and endpoint telemetry to gather contextual evidence—such as process names, parent processes, and connection durations—before taking any disruptive action. This aligns with the NIST incident response process (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes containment.

Answer

Immediately block all outbound traffic from the workstation

Answer

Escalate to the incident response team immediately

Answer

Isolate the workstation from the network

Question 5

Which THREE of the following are key elements of a security monitoring and analysis strategy? (Choose three.)

Accepted Answer

Establishing a feedback loop for continuous improvement. Establishing a feedback loop for continuous improvement (A) is a key element because security monitoring is not a static process; it requires iterative refinement based on lessons learned from incidents, false positives, and changes in the threat landscape. This loop ensures that detection rules, response playbooks, and monitoring configurations evolve to maintain effectiveness against new attack vectors and reduce noise over time.

Answer

Focusing only on network-based monitoring to reduce complexity

Answer

Automating all incident response decisions to eliminate human error

Question 6

Which TWO of the following are valid reasons to use a proxy server for security monitoring? (Choose two.)

Accepted Answer

To inspect encrypted traffic by acting as a man-in-the-middle with SSL decryption. Options A and C are correct. A proxy can decrypt SSL traffic for inspection (with proper consent) and filter outbound traffic to block malware C2. Option B is incorrect because proxies generally increase latency. Option D is incorrect because anti-malware scanning is typically done on endpoints or at the gateway, not solely as a proxy function. Option E is incorrect because while proxies can log, they are not the only tool; specialized monitoring tools may be more effective.

Answer

To reduce network latency for monitored traffic

Answer

To provide a complete log of all network traffic for forensics

Answer

To replace the need for endpoint anti-malware software

Question 7

Which TWO of the following are key components of a security policy framework according to Cisco? (Choose two.)

Accepted Answer

Guidelines. In Cisco's security policy framework, guidelines and standards are foundational components. Guidelines offer recommended practices and flexible advice for implementing security controls, while standards define mandatory, specific technical requirements (e.g., encryption algorithms, password complexity) that must be followed. Together, they provide the structure for consistent security enforcement across an organization.

Answer

Incident Response Plan

Answer

Audit Logs

Answer

Firewalls

Question 8

A security policy states that all portable media must be encrypted. An employee loses a USB drive containing customer data. The drive was encrypted with AES-256. Which of the following is true regarding policy compliance?

Accepted Answer

The policy was followed, but the incident still needs to be reported per incident response procedures. Option A is correct because the security policy mandates encryption for portable media, and AES-256 encryption was applied to the USB drive, so the policy was technically followed. However, the loss of a device containing customer data still triggers incident response procedures, as the encryption key or the possibility of decryption could be compromised, and reporting is required to assess risk and comply with breach notification laws.

Answer

The employee violated policy because the drive was lost

Answer

The policy was followed because the data was encrypted, so a breach is not reportable

Answer

Encryption is not sufficient, the employee should have used a different media

Question 9

An investigator seizes a laptop as evidence from a crime scene. At the scene, the laptop is turned on and a log file is open. What should the investigator do to preserve evidence according to chain of custody procedures?

Accepted Answer

Photograph the screen and create a forensic image. Option A is correct because photographing the screen captures the state, and creating a forensic image preserves the data. Option B is wrong because closing the file may alter metadata or memory. Option C is wrong because shutting down may lose volatile data. Option D is wrong because executing the file could modify evidence.

Answer

Close the log file and copy it to a USB drive

Answer

Shut down the laptop and remove the hard drive

Answer

Execute the log file to ensure it is legitimate

Question 10

A company's data classification policy defines "Confidential" data. Which of the following is an example of Confidential data?

Accepted Answer

Customer payment card information. Customer payment card information is typically classified as Confidential due to regulatory requirements like PCI DSS. The other options are lower sensitivity.

Answer

Public marketing brochures

Answer

Company cafeteria menu

Answer

Employee phone numbers

Question 11

Refer to the exhibit. A security policy states that all remote desktop (RDP) and Telnet access from external networks must be blocked. Does the above access-list comply with the policy?

Accepted Answer

Yes, because it denies RDP and Telnet.. The ACL explicitly denies RDP (port 3389) and Telnet (port 23) and permits all other traffic, which fully meets the policy requirement. The policy does not require blocking other services.

Answer

Yes, because it denies TCP ports 3389 and 23.

Answer

No, because it permits all other traffic.

Answer

No, because it should deny HTTP traffic as well.

Question 12

A security analyst is creating a policy for handling sensitive customer data. The policy must ensure data is encrypted at rest and in transit. Which type of policy most directly addresses this requirement?

Accepted Answer

Data Protection Policy. A data protection policy specifically covers encryption, storage, and transmission controls. Option B is correct. Option A (access control) is about permissions. Option C (incident response) is about breaches. Option D (physical security) is about facilities.

Answer

Incident Response Policy

Answer

Access Control Policy

Answer

Physical Security Policy

Question 13

A security auditor reviews a company's security policies and finds that the password policy requires a minimum length of 8 characters and complexity including uppercase, lowercase, digit, and special character. However, the policy does not mandate password expiration. Which of the following is the most significant risk due to this omission?

Accepted Answer

Stolen credentials could be used for extended periods without detection. Option B is correct because without expiration, compromised credentials remain valid indefinitely, increasing risk. Option A is less likely if complexity is enforced. Option C is not directly related. Option D is a minor inconvenience compared to credential theft.

Answer

Users may choose weak passwords that are easy to guess

Answer

Help desk will receive an increased number of password reset requests

Answer

Users might reuse passwords across different systems

Question 14

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Accepted Answer

Incoming BitTorrent traffic using ports 6881-6889 is blocked. Option D is correct. The ACL denies TCP and UDP on ports 6881-6889 and permits everything else. BitTorrent uses these ports, so it is blocked in the inbound direction. Option A is wrong because it only denies those ports. Option B is wrong because it blocks only those specific ports. Option C is wrong because the permit any any allows all other traffic.

Answer

All TCP traffic is blocked

Answer

Only outgoing BitTorrent traffic is blocked

Answer

All BitTorrent traffic is permitted

Question 15

A security analyst detects a host infected with ransomware on the corporate network. According to incident response procedures, what should be the first action?

Accepted Answer

Isolate the host from the network. Option A is correct because isolating the host prevents the ransomware from spreading to other systems. Option B is wrong because reimaging without isolation could fail if network propagation continues. Option C is wrong because notifying management is important but not the immediate technical first step. Option D is wrong because updating signatures is a preventive measure, not a containment step.

Answer

Reimage the host immediately

Answer

Update antivirus signatures

Answer

Notify the IT management team