200-201 Practice Test 2 — 10 Questions

Question 1

In a PCAP, an analyst sees a large outbound data transfer over FTP to an external IP address during non-business hours. The source host is a database server. Which phase of the Cyber Kill Chain does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's 'Actions on Objectives' phase is where the attacker achieves their ultimate goal, such as exfiltrating data. In this scenario, a large outbound FTP transfer from a database server to an external IP during non-business hours directly indicates data theft, which is the final objective of the intrusion. FTP (port 21/20) is used here as the exfiltration protocol, moving sensitive data out of the network.

Answer

Installation

Answer

Weaponization

Answer

Exploitation

Question 2

A network analyst finds a PCAP with a series of DNS queries for subdomains like "data12345.example.com" and "data67890.example.com" where the subdomain names appear to contain encoded base64 data. This pattern suggests:

Accepted Answer

DNS tunnelling for exfiltration. DNS tunnelling for exfiltration encodes stolen data into DNS query names (often base64) and sends it to an attacker-controlled authoritative DNS server. The pattern of many subdomains with encoded-looking labels under the same domain is a classic indicator of data being smuggled out via DNS, which is frequently allowed through firewalls.

Answer

Port scan via DNS

Answer

Normal DNS resolution

Answer

DGA-based C2

Question 3

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 4

A security analyst detects a host infected with ransomware on the corporate network. According to incident response procedures, what should be the first action?

Accepted Answer

Isolate the host from the network. The first action when a host is infected with ransomware is to isolate it from the network to prevent lateral movement and further encryption of shared resources. Ransomware often uses SMB, RDP, or other network protocols to spread, so disconnecting the host (e.g., by disabling the switch port or unplugging the cable) stops the propagation immediately. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the attack before any remediation.

Answer

Reimage the host immediately

Answer

Update antivirus signatures

Answer

Notify the IT management team

Question 5

An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?

Accepted Answer

DNS tunnelling for C2 communication. DNS tunnelling encodes data in subdomain queries, and periodic beaconing is common for C2. High entropy subdomains and regular intervals suggest DNS tunnelling for C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for a dynamic DNS service

Answer

DNS cache poisoning attempt

Question 6

Which compliance framework specifically addresses the protection of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the compliance framework specifically designed to protect cardholder data — including credit card numbers, expiration dates, and cardholder names — for any organization that stores, processes, or transmits payment card information. It is mandated by the major card brands and enforced through acquirers and payment processors.

Answer

GDPR

Answer

ISO 27001

Answer

HIPAA

Question 7

A network analyst is examining a PCAP and sees a large number of ICMP echo request packets sent from a single internal host to multiple external IP addresses, with varying payload sizes and no corresponding echo replies. The analyst suspects the host is being used for reconnaissance or data exfiltration. Which characteristic of the ICMP traffic would most strongly indicate that it is being used for data exfiltration rather than simple reconnaissance?

Accepted Answer

The ICMP packets contain non-standard payload data that is base64-encoded and varies in length.. The presence of non-standard, base64-encoded payload data that varies in length is a classic sign of ICMP tunneling for data exfiltration. Normal ping requests have predictable payloads, often just a repeating pattern or timestamp. When ICMP is used as a covert channel, the payload carries encoded stolen data, making the traffic anomalous. The other options describe patterns more consistent with reconnaissance or benign monitoring.

Answer

The payload sizes are consistent and small, matching standard ping requests.

Answer

The source IP address is spoofed to match the destination IP address.

Answer

The ICMP echo requests are sent at a constant rate of one per second to a single external IP.

Question 8

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Accepted Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Apply access-list to interface
5. Verify configuration. The correct order for basic Cisco ASA configuration is: global configuration mode, interface configuration (nameif, IP address, security-level), ACL creation, ACL application to interface, and verification. This sequence ensures interfaces are ready, ACLs exist before being applied, and verification confirms the policy is active. Common mistakes include creating or applying ACLs before interfaces are configured, or verifying before applying the ACL.

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Configure interfaces (nameif, ip address, security-level)
4. Apply access-list to interface
5. Verify configuration

Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Verify configuration
5. Apply access-list to interface

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Apply access-list to interface
4. Configure interfaces (nameif, ip address, security-level)
5. Verify configuration

Question 9

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal web server and was blocked.. The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.

Answer

The access-group 'OUTSIDE_IN' permitted the traffic.

Answer

An internal host attempted to connect to an external web server.

Answer

The ASA allowed the connection because it is a stateful firewall.

Question 10

An organization is developing an Acceptable Use Policy (AUP). Which of the following topics is typically covered in an AUP?

Accepted Answer

Prohibition of using company resources for illegal activities. An AUP defines acceptable use of IT resources, including prohibiting unauthorized access, personal use guidelines, and security responsibilities.

Answer

Password complexity requirements

Answer

Incident reporting procedures

Answer

Data classification levels