200-201 Practice Test 20 — 15 Questions

Question 1

An analyst detects a large outbound FTP transfer from a sensitive server to an external IP address not previously seen. The file being transferred is a compressed archive containing database dumps. Which Cyber Kill Chain phase is most directly indicated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Actions on Objectives. Exfiltration of sensitive data is part of 'Actions on Objectives', where the attacker achieves their goal of stealing data.

Answer

Installation

Answer

C2

Answer

Exploitation

Question 2

An analyst reviews network logs and sees a large outbound FTP transfer of 500 MB from a workstation to an external IP at 2:00 AM. The workstation regularly sends 10 MB daily. What should the analyst suspect?

Accepted Answer

Data exfiltration. Large outbound data transfers outside normal patterns, especially at odd hours, are typical of data exfiltration.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Software update

Question 3

Which of the following is a primary goal of the CIA triad?

Accepted Answer

Availability. The CIA triad's primary goals are confidentiality, integrity, and availability. Availability ensures that authorized users have reliable and timely access to data and resources when needed, which is a core security objective. Option C is correct because availability is explicitly one of the three pillars of the CIA triad.

Answer

Redundancy

Answer

Scalability

Answer

Maintainability

Question 4

A company's security policy requires that all system logs be retained for at least one year. A security analyst discovers that log files are being overwritten after 30 days. What is the most likely cause?

Accepted Answer

The log rotation policy is set to 30 days. Log files being overwritten after exactly 30 days is the classic signature of a log rotation policy configured with a 30-day retention window. Rotation tools such as logrotate, Windows Event Log auto-archive, or SIEM retention settings delete or overwrite the oldest data once the configured age or size threshold is reached. The fix is to adjust the rotation/retention configuration to meet the one-year policy requirement.

Answer

Logs are being manually deleted by an administrator

Answer

Malware infection

Answer

Insufficient disk space

Question 5

An organization's security policy requires that all network traffic be inspected by an intrusion prevention system. However, encrypted traffic is bypassing inspection. Which change to the policy would best address this issue?

Accepted Answer

Implement SSL/TLS decryption at the network perimeter. Implementing SSL/TLS decryption at the network perimeter allows the IPS to inspect the plaintext content of encrypted traffic. By terminating the encrypted session at a dedicated decryption device (e.g., a next-generation firewall or proxy), the device can re-encrypt the traffic after inspection, ensuring that threats hidden in HTTPS, SMTPS, or other TLS-encrypted flows are detected without violating the policy's requirement that all traffic be inspected.

Answer

Allow encrypted traffic to bypass the IPS

Answer

Require all internal traffic to use unencrypted protocols

Answer

Exclude encrypted traffic from the security policy scope

Question 6

A security analyst notices a sudden spike in NetFlow data from a single workstation to multiple external IP addresses on port 443. What is the most likely explanation for this traffic pattern?

Accepted Answer

Potential data exfiltration. A single workstation sending a sudden spike of NetFlow data to multiple external IP addresses on port 443 (HTTPS) is a classic indicator of data exfiltration. Attackers often encrypt stolen data in HTTPS tunnels to evade detection, and the abrupt increase in outbound connections to many distinct external hosts is not typical of normal user behavior. NetFlow records showing a high volume of flows from one source to many destinations on the same port strongly suggest an automated process, such as a data theft tool, rather than legitimate traffic.

Answer

Internal network scanning

Answer

Normal web browsing activity

Answer

A scheduled software update

Question 7

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

Accepted Answer

Command-and-control (C2) communication from malware on the server. A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.

Answer

Distributed denial-of-service (DDoS) attack from the server

Answer

Brute-force attack on the server's SSH service

Answer

SQL injection attack against the server

Question 8

During a host-based analysis, a Windows system is found to have a suspicious service that starts automatically. Which command-line tool can be used to query the status and configuration of services, particularly to identify non-standard service names or paths?

Accepted Answer

sc query. The 'sc query' command queries the Service Control Manager for service status and configuration, and with 'sc qc' it reveals the binary path, start type, and service account — exactly what's needed to spot non-standard service names or paths. It works from the command line, making it suitable for scripted forensic triage. Analysts use 'sc query state= all' to enumerate all services and 'sc qc <name>' to inspect suspicious ones.

Answer

services.msc

Answer

tasklist /svc

Answer

net start

Question 9

Refer to the exhibit. A network analyst sees these firewall logs. What is the most likely interpretation?

Accepted Answer

An attacker is performing a port scan on internal hosts from the outside. The firewall logs show multiple denied TCP connection attempts from a single external IP to various internal IPs on different ports (e.g., 80, 443, 22). This pattern of sequential probes across multiple destinations and ports is characteristic of a port scan, where an attacker systematically probes for open services. The rule OUTSIDE_IN is correctly logging and blocking these attempts, indicating the firewall is functioning as designed to prevent reconnaissance.

Answer

The firewall rule OUTSIDE_IN is misconfigured and blocking all traffic

Answer

A malware is trying to phone home to an external C2 server

Answer

A user is trying to access internal web servers legitimately but is blocked by ACL

Question 10

An analyst is investigating lateral movement and observes SMB authentication attempts from host A to multiple other hosts using NTLM authentication with a hash value instead of a password. Which attack technique is most likely being used?

Accepted Answer

Pass-the-hash attack. Pass-the-hash exploits the NTLM challenge-response protocol by replaying a captured NTLM hash directly to authenticate, without ever needing the plaintext password. The tell-tale sign is SMB authentication where the credential material is a hash rather than a password, especially when one host authenticates to many others in a fan-out pattern typical of lateral movement. Tools like Mimikatz, Impacket's psexec.py, and CrackMapExec perform this by injecting the hash into the NTLM authentication exchange.

Answer

Brute force attack

Answer

Kerberos golden ticket attack

Answer

SMB relay attack

Question 11

What is the primary difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric uses a single shared key; asymmetric uses a key pair. Symmetric encryption uses a single shared key for both encryption and decryption, while asymmetric encryption uses a key pair: a public key for encryption and a private key for decryption. This fundamental difference in key usage is the primary distinction.

Answer

Asymmetric encryption is used only for hashing

Answer

Symmetric uses two keys, asymmetric uses one

Answer

Symmetric is slower than asymmetric

Question 12

A threat hunter identifies a binary that uses a Domain Generation Algorithm (DGA) to create domain names like 'eksdghf23.com', 'mzncxv89.net' each day. The malware contacts these domains over HTTPS. Which phase of the Cyber Kill Chain is most directly associated with this technique?

Accepted Answer

Command and Control. The use of a DGA to generate domain names that the malware contacts over HTTPS is the defining characteristic of the Command and Control (C2) phase. The malware is attempting to reach its operator's infrastructure to receive instructions or send data. This occurs after the malware is installed and before the attacker achieves their objectives.

Answer

Installation

Answer

Exploitation

Answer

Actions on Objectives

Question 13

During the Cyber Kill Chain, which phase involves sending a malicious attachment to a target user via email?

Accepted Answer

Delivery. Delivery is the phase where the attacker transmits the weaponized payload to the target, such as via email attachments.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 14

An analyst detects multiple SMB authentication attempts from a single internal host to several other internal hosts using NTLM hashes instead of plaintext passwords. Which technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash is the technique where an attacker uses a captured NTLM hash to authenticate to remote systems without knowing the plaintext password. The scenario — one internal host authenticating to many others using NTLM hashes — is the canonical lateral-movement signature of pass-the-hash, typically executed with tools like Mimikatz, CrackMapExec, or Impacket. The fan-out pattern from a single source to multiple targets is a strong indicator of automated credential reuse.

Answer

Brute force

Answer

Kerberoasting

Answer

Golden ticket attack

Question 15

During an intrusion analysis, a SOC analyst reviews logs showing an outbound connection from an internal host to an external IP at 03:00 AM every 60 seconds. The traffic is HTTPS to a suspicious domain with a high entropy name. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control (C2). Periodic outbound HTTPS connections to a suspicious high-entropy domain at fixed intervals are the classic signature of Command and Control (C2) beaconing, where an implant checks in with its controller for instructions. The regularity (every 60 seconds) and the high-entropy domain name (typical of DGA or attacker-registered infrastructure) are the defining indicators. This activity occurs after exploitation and installation, when the malware establishes its channel back to the attacker.

Answer

Actions on Objectives

Answer

Delivery

Answer

Weaponisation