200-201 Practice Test 20 — 15 Questions

Question 1

An organization wants to ensure that a message has not been altered during transmission. Which cryptographic technique should be used?

Accepted Answer

Hashing. Hashing creates a fixed-size digest; any change in data changes the hash, verifying integrity.

Answer

Asymmetric encryption

Answer

Digital signature

Answer

Symmetric encryption

Question 2

A security analyst is examining a log file and notices that the hash value of a configuration file does not match the expected value. Which security goal has been violated?

Accepted Answer

Integrity. Integrity ensures that data has not been altered. A mismatched hash indicates the file has been modified.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 3

An attacker intercepts communication between a client and a server, allowing the attacker to read, insert, and modify messages in both directions. Which type of network attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MitM) attack places the attacker between two parties to intercept and manipulate traffic.

Answer

Denial of Service

Answer

ARP spoofing

Answer

DNS poisoning

Question 4

An analyst is reviewing web server logs and sees the following entries: 'GET /admin/login.php HTTP/1.1' returning 404, followed by 'GET /admin/login.html' returning 404, then 'GET /admin/login.asp' returning 200. Which TWO observations are most relevant?

Accepted Answer

The attacker is probing for valid login page paths. The sequence of requests probing different file extensions for the login page suggests a directory traversal or file enumeration attack. The fact that the attacker tried multiple extensions and succeeded with .asp may indicate the web server is running ASP. The 200 response is the successful access.

Answer

The requests indicate a brute-force login attempt

Answer

The source IP is likely performing a SQL injection

Answer

The server is misconfigured to reveal directory listings

Question 5

An organization implements encryption for all sensitive data at rest and in transit to prevent unauthorized access. Which element of the CIA triad is being primarily addressed?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals or systems.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 6

In Wireshark, an analyst follows a TCP stream and sees plaintext usernames and passwords. Which protocol is likely in use?

Accepted Answer

FTP. FTP transmits credentials in plaintext. Other protocols (HTTPS, SSH, SFTP) encrypt traffic.

Answer

HTTPS

Answer

SFTP

Answer

SSH

Question 7

A security analyst is investigating a network breach. Which TWO activities are examples of passive reconnaissance? (Choose two.)

Accepted Answer

Reviewing LinkedIn profiles of employees. Passive reconnaissance involves gathering information without directly interacting with the target, such as searching public records and social media.

Answer

Sending ping sweeps to identify live hosts

Answer

Using a vulnerability scanner to find weaknesses

Answer

Performing a port scan on the target network

Question 8

During an incident, a SOC Tier 1 analyst identifies a series of failed login attempts from an internal IP address. The analyst escalates the alert. What is the primary role of a Tier 2 analyst in this scenario?

Accepted Answer

Perform deeper investigation and correlate events. Tier 2 analysts perform deeper investigation, correlation, and analysis beyond initial triage.

Answer

Monitor alerts and perform initial triage

Answer

Make decisions on business impact and notification

Answer

Conduct threat hunting and advanced forensics

Question 9

During an incident response on a Linux server, an analyst runs 'ps aux' and notices a process named 'cryptominer' with high CPU usage. The process PPID is 1. Which tool would best help the analyst examine the parent-child relationship and find how the process was started?

Accepted Answer

pstree. The pstree command shows the process hierarchy in a tree format, clearly displaying parent-child relationships. This helps trace how the malicious process was launched.

Answer

netstat

Answer

lsof

Answer

crontab -l

Question 10

During forensic analysis of a Windows host, an analyst finds a file in C:\Windows\Prefetch with the name 'MALWARE.EXE-3F2A1B0C.pf'. Which type of information can be extracted from this prefetch file to assist the investigation?

Accepted Answer

The number of times the executable has been run and the last execution timestamp. Prefetch files (.pf) contain the last run time, run count, and paths of files loaded by the executable. This helps determine how many times the malware was executed and when.

Answer

The file's SHA256 hash and digital signature status

Answer

The registry keys modified by the executable during execution

Answer

The command-line arguments used when the executable was launched

Question 11

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Accepted Answer

/etc/systemd/system/. Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Answer

/var/log/auth.log

Answer

~/.bash_history

Question 12

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the MZ header (4D 5A). The file's entropy is calculated as 7.8. What does the high entropy most likely indicate?

Accepted Answer

The file is likely packed or obfuscated. High entropy (close to 8) suggests the file is packed or encrypted, as compressed or encrypted data has high randomness. This is often used by malware to evade signature detection.

Answer

The file is a legitimate signed binary

Answer

The file is corrupted

Answer

The file contains mostly plain text strings

Question 13

An analyst finds a suspicious service named 'UpdateSvc' running on a Windows system. Which tool or command would best help determine the service's binary path and start type?

Accepted Answer

sc query UpdateSvc. The 'sc query' command with the service name provides detailed information including binary path and start type.

Answer

net start

Answer

tasklist /svc

Answer

Get-Service UpdateSvc

Question 14

A Windows Event Log analysis reveals Event ID 4720 and 4726 occurrences for the same account within a short time. Which TWO actions were performed? (Select 2)

Accepted Answer

User account was deleted. Event ID 4720 indicates account creation, and 4726 indicates account deletion. The rapid creation and deletion may indicate an attempt to avoid detection or create a temporary account.

Answer

User account was locked

Answer

Group policy was updated

Answer

User logged on successfully

Question 15

An analyst is investigating a Windows host suspected of malware persistence. Which registry key is commonly used by malware to run a program every time a user logs in, located under both HKLM and HKCU?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The Run and RunOnce keys under HKLM and HKCU are common persistence mechanisms. Malware often adds entries here to execute automatically at user logon.

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options