200-201 Practice Test 19 — 15 Questions

Question 1

A network analyst notices a high volume of traffic from a single external IP address to multiple internal hosts on port 443. The traffic includes incomplete TCP handshakes. Which type of reconnaissance is being performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active reconnaissance via port scanning. Active reconnaissance involves direct interaction with the target, such as port scanning, which generates traffic. Passive recon uses public data.

Answer

Social engineering attack

Answer

Denial of Service attack

Answer

Passive reconnaissance using WHOIS

Question 2

A SOC analyst is investigating a suspicious file on a Windows host. The file hash matches a known malware variant in a threat intelligence feed. What is the next best step for host-based analysis?

Accepted Answer

Check for persistence mechanisms such as registry Run keys or scheduled tasks. After confirming a file hash matches a known malware variant, the immediate priority for host-based analysis is to determine how the malware maintains persistence on the system. Persistence mechanisms such as Registry Run keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or scheduled tasks (via schtasks.exe) allow malware to survive reboots and re-establish execution. Identifying these artifacts is critical for containment and eradication, as it reveals the malware's foothold and prevents re-infection after removal.

Answer

Run a full antivirus scan on the host

Answer

Disable the network adapter to prevent further communication

Answer

Reboot the host to clear the malware from memory

Question 3

A security engineer is analyzing a recent data breach. Which TWO are examples of active reconnaissance techniques? (Select two.)

Accepted Answer

Port scanning. Active reconnaissance involves direct interaction with the target. Port scanning and ping sweeps are active; WHOIS and Google searches are passive.

Answer

LinkedIn profiling

Answer

WHOIS lookup

Answer

Google dorking

Question 4

An analyst is configuring a Snort rule to detect a known exploit targeting Apache web servers. The exploit sends a malicious HTTP POST request with a long User-Agent string. Which Snort rule header and options are most appropriate?

Accepted Answer

alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;). The rule 'alert tcp any any -> any 80' matches HTTP traffic, and 'content:"POST"' detects the method. The 'pcre' option can match the long User-Agent. The other options are incorrect because they don't specify port 80 or use wrong protocols.

Answer

alert icmp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert tcp any any -> any 443 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert udp any any -> any 80 (content:"GET"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Question 5

A security analyst is selecting a symmetric encryption algorithm for encrypting data at rest. Which of the following is a suitable symmetric algorithm?

Accepted Answer

AES. AES is a widely used symmetric encryption algorithm.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 6

What is the primary difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric uses a single shared key; asymmetric uses a key pair. Symmetric uses one shared key; asymmetric uses a public-private key pair.

Answer

Asymmetric encryption is used only for hashing

Answer

Symmetric uses two keys, asymmetric uses one

Answer

Symmetric is slower than asymmetric

Question 7

A security engineer is analyzing a recent breach. The attacker gained access by sending an email that appeared to be from the CEO, requesting the recipient to transfer funds. What type of social engineering attack is this?

Accepted Answer

Spear phishing. Spear phishing targets a specific individual with personalized content, often impersonating a trusted source.

Answer

Vishing

Answer

Phishing

Answer

Pretexting

Question 8

Which of the following best describes a vulnerability?

Accepted Answer

A weakness in a system that could be exploited. A vulnerability is a weakness in a system that can be exploited by a threat.

Answer

The act of taking advantage of a weakness

Answer

The likelihood that a threat will exploit a weakness

Answer

A potential event that could cause harm

Question 9

An organization wants to implement a security framework that includes functions such as Identify, Protect, Detect, Respond, and Recover. Which framework aligns with this structure?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework is built around these five core functions.

Answer

HIPAA Security Rule

Answer

PCI DSS

Answer

ISO 27001

Question 10

An attacker uses a tool to scan all IP addresses in a range to identify which hosts are online and what services are running. Which type of reconnaissance is this?

Accepted Answer

Active reconnaissance. Active reconnaissance involves direct interaction with the target, such as port scanning and ping sweeps.

Answer

Denial of Service

Answer

Passive reconnaissance

Answer

Social engineering

Question 11

A SIEM correlation rule is configured to alert when there are 10 failed login attempts from the same source IP within 1 minute. An analyst receives an alert for source IP 10.0.0.5. Which type of attack is most likely being detected?

Accepted Answer

Brute force attack. Multiple failed logins from the same source IP in a short time indicates a brute force attack.

Answer

Man-in-the-middle attack

Answer

DDoS attack

Answer

SQL injection attempt

Question 12

A security analyst needs to verify the authenticity and integrity of a software update. The update is signed with a digital signature. Which key is used to verify the signature?

Accepted Answer

Sender's public key. Digital signatures use asymmetric cryptography: the sender's private key signs, the public key verifies.

Answer

Sender's private key

Answer

Recipient's public key

Answer

Recipient's private key

Question 13

Which type of malware is designed to replicate itself and spread to other systems without user intervention?

Accepted Answer

Worm. A worm is a self-replicating malware that spreads automatically across networks, unlike viruses that require a host file.

Answer

Virus

Answer

Ransomware

Answer

Trojan

Question 14

Which NIST Cybersecurity Framework function involves developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services?

Accepted Answer

Protect. The Protect function supports the ability to limit or contain the impact of a potential cybersecurity event.

Answer

Respond

Answer

Detect

Answer

Identify

Question 15

Which cryptographic technique uses a public and private key pair to provide non-repudiation?

Accepted Answer

Digital signature. Digital signatures use asymmetric cryptography to provide authentication and non-repudiation, as only the signer's private key can create the signature.

Answer

Symmetric encryption

Answer

Digital certificate

Answer

Hashing