200-201 Practice Test 18 — 15 Questions

Question 1

An attacker sends a fraudulent email that appears to come from the company's IT department, requesting that the recipient click a link and enter their login credentials. Which type of social engineering attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Phishing. This is a phishing attack because the attacker uses a fraudulent email that impersonates a trusted entity (the IT department) to trick the recipient into clicking a malicious link and entering sensitive login credentials. Phishing is a broad category of social engineering that relies on deceptive electronic communications, typically email, to harvest credentials or deliver malware.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 2

Which compliance standard specifically applies to organizations that handle credit card information?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the compliance standard specifically designed for organizations that handle credit card information. It sets requirements for securing cardholder data, including encryption, access control, and network security, and applies to all entities that store, process, or transmit card data.

Answer

HIPAA

Answer

GDPR

Answer

ISO 27001

Question 3

Which TWO of the following are indicators of a potential data exfiltration attempt?

Accepted Answer

An internal host transferring large amounts of data to an unknown external IP at 3 AM.. Data exfiltration often involves transferring large volumes of data to an unknown external IP during off-hours (e.g., 3 AM) to evade detection. This behavior deviates from normal business patterns and is a classic indicator of a data breach or insider threat.

Answer

A user accessing an internal file server during business hours.

Answer

A failed login attempt from an internal workstation.

Answer

A spike in ICMP echo requests from an external IP.

Question 4

An organization needs to ensure that a document has not been altered and to verify the sender's identity. Which combination of cryptographic techniques should be used?

Accepted Answer

Digital signature and hashing. A digital signature provides authentication (verifying the sender's identity via their private key) and integrity (proving the document was not altered), while hashing produces the fixed-length digest that the signature signs. Together they satisfy both requirements: the hash detects any modification, and the asymmetric signature binds the document to the sender's private key.

Answer

Digital signature and symmetric encryption

Answer

Symmetric encryption and hashing

Answer

Asymmetric encryption and hashing

Question 5

A Linux host has an unusual cron job that runs a script from /tmp every minute. The analyst checks /etc/crontab and /var/spool/cron/ but finds nothing. Where else could the cron job be defined?

Accepted Answer

/etc/cron.d/. The cron job is defined in /etc/cron.d/ because this directory allows system administrators to drop individual cron configuration files that are parsed by the cron daemon. Unlike /etc/crontab and /var/spool/cron/ (which contain user-specific crontabs), /etc/cron.d/ is a standard location for package-maintained or custom cron jobs that run with system privileges. The fact that the analyst found nothing in the other two locations strongly suggests the job is defined in /etc/cron.d/.

Answer

/etc/cron.hourly/

Answer

/etc/cron.allow

Answer

~/.bashrc

Question 6

An analyst is investigating a Windows system for signs of malware persistence. Which TWO registry locations are commonly used by malware to achieve automatic startup? (Choose two.)

Accepted Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. A is correct because the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key is a standard autostart location that launches programs when the current user logs in. Malware frequently writes a value here to achieve persistence without requiring administrative privileges, as it affects only the current user's session.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Question 7

A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?

Accepted Answer

tcp.port == 443. The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.

Answer

tcp.dstport == 443

Answer

https

Answer

port 443

Question 8

A security policy mandates that all administrative access to network devices must be encrypted. Which of the following protocols should be used to comply with this policy?

Accepted Answer

SSH. SSH (Secure Shell) encrypts all traffic, including authentication credentials and commands, between an administrator and a network device. This satisfies the policy requirement for encrypted administrative access, unlike Telnet which sends everything in plaintext.

Answer

Telnet

Answer

TFTP

Answer

SNMPv2c

Question 9

An analyst is examining a Linux system for persistence mechanisms. Which of the following files should be reviewed to detect cron-based persistence?

Accepted Answer

/var/spool/cron/crontabs. The correct answer is /var/spool/cron/crontabs because this directory stores user-specific cron jobs on Debian-based Linux systems. Attackers often add malicious entries here to maintain persistence by scheduling recurring tasks. Reviewing this directory reveals unauthorized scheduled jobs that could execute malware or reverse shells at regular intervals.

Answer

/var/log/auth.log

Answer

/etc/passwd

Answer

/home/user/.bash_history

Question 10

A Cisco Firepower sensor is generating an alert for a known benign application. The analyst has verified it is a false positive. What is the first step to suppress this alert?

Accepted Answer

Create a network analysis policy exception.. A network analysis policy (NAP) exception is the correct first step because it allows you to suppress alerts for specific benign applications without affecting the overall detection posture. In Cisco Firepower, NAP exceptions are applied before intrusion rules are evaluated, so they can filter out known false positives at the preprocessor level, preventing the rule from even triggering. This is more efficient than modifying the intrusion rule itself, as it avoids disabling detection for other traffic.

Answer

Increase the severity threshold.

Answer

Submit a false positive report to Talos.

Answer

Disable the intrusion rule globally.

Question 11

During a security incident, the CISO decides to contain a compromised server by isolating it from the network. Which role is primarily responsible for making this containment decision based on business impact?

Accepted Answer

CISO. The CISO is the decision-maker for business impact and authorizes containment actions.

Answer

Incident handler

Answer

Legal counsel

Answer

PR representative

Question 12

Match each Windows event log type to its description.

Accepted Answer

Application: Records events generated by software programs.. In Windows Event Viewer, the main logs are Application (software events), Security (audit events), Setup (installation events), System (system component events), and Forwarded Events (remote logs). Common confusions include mixing Application and System logs, or Security with Setup.

Answer

Application: Logs events related to system hardware failures.

Answer

Security: Logs application installation events.

Question 13

A security analyst at a medium-sized enterprise notices that an employee's workstation has been sending outbound traffic to a known malicious IP address at irregular intervals. The analyst runs a scan and finds no malware signatures. What should the analyst do next?

Accepted Answer

Escalate to the incident response team for further investigation.. Outbound traffic to a known malicious IP with no matching malware signature indicates a potential compromise that evaded signature-based detection — likely a fileless, living-off-the-land, or encrypted C2 channel. The correct next step is to escalate to the incident response team so they can perform deeper analysis (memory forensics, network capture, threat hunting) before taking disruptive action. Escalation preserves evidence and follows the incident response process.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Review the employee's recent web browsing history and email attachments.

Answer

Immediately disconnect the workstation from the network and reimage it.

Question 14

A vendor security policy requires that all third-party remote access be limited to specific IP addresses and use multi-factor authentication. During an audit, it is discovered that a vendor's entire office subnet is allowed instead of individual IPs. The vendor argues that the broader range is necessary for redundancy. What is the best way to handle this from a policy perspective?

Accepted Answer

Work with the vendor to define a list of specific IPs that cover their redundancy needs while adhering to policy. The correct approach is to work with the vendor to define specific IPs that satisfy their redundancy needs while still complying with the policy's intent. This preserves the security control (limiting access to known, specific addresses) without simply weakening the policy or ignoring the violation. It balances operational flexibility with the vendor security requirement.

Answer

Amend the policy to allow entire subnets for vendors with multi-factor authentication

Answer

Accept the subnet as long as multi-factor authentication is used

Answer

Require the vendor to comply with the existing policy exactly as written

Question 15

During an incident response, an analyst finds evidence of lateral movement. Which THREE of the following are common techniques used for lateral movement?

Accepted Answer

Remote Desktop Protocol (RDP) connections. SMB authentication attempts, pass-the-hash, and RDP are common lateral movement techniques.

Answer

DNS tunneling

Answer

ICMP echo requests