200-201 Practice Exam 1 — 20 Questions

Question 1

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Successful authentication event. A successful authentication event following multiple failed attempts is a key indicator of a brute-force or password-spraying attack. The analyst must correlate the failed attempts with the eventual success to identify that the attacker gained access after guessing or cracking the credentials.

Answer

Network share access event

Answer

Account creation event

Question 2

A network engineer is configuring a Cisco Firepower IPS. To reduce false positives from legitimate updates, which action should be taken?

Accepted Answer

Enable adaptive profile. Enabling adaptive profile allows the IPS to learn normal traffic patterns and reduce false positives. Whitelisting is also useful but adaptive profiles are specifically designed to reduce false positives dynamically.

Answer

Use a whitelist for the update server

Answer

Disable the signature

Answer

Set the signature to generate only alert

Question 3

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Accepted Answer

powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.. PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.

Answer

svchost.exe (PID 1420) because it is connecting to an external IP on port 80.

Answer

cmd.exe (PID 2568) because it could be used to launch other processes.

Answer

notepad.exe (PID 2344) because it is not expecting to make any network connections.

Question 4

A network intrusion detection system (NIDS) generates an alert for a known exploit against a web server. The analyst verifies that the server is patched. What is the next best step?

Accepted Answer

Investigate if the exploit was actually attempted. Even if the server is patched, the exploit attempt may indicate a broader attack or reconnaissance. Investigating the attempt helps determine intent and identify other compromised systems.

Answer

Reconfigure the NIDS to block the traffic

Answer

Tune the signature to ignore the server

Answer

Dismiss the alert as a false positive

Question 5

During a security awareness training session, an employee reports they clicked a link in a phishing email but did not enter credentials. Which policy violation is most likely involved?

Accepted Answer

Incident reporting policy. Clicking a suspected phishing link without reporting it violates the incident reporting policy. Option A is wrong because the employee did not enter credentials, so password policy is intact. Option B is wrong because the link itself is not necessarily prohibited by AUP unless it involves inappropriate content. Option D is wrong because data classification policy is about handling data, not email links.

Answer

Data classification policy

Answer

Acceptable use policy

Answer

Password policy

Question 6

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 7

An analyst is examining a YARA rule that contains the condition: 'uint16(0) == 0x5a4d and filesize < 500KB'. What type of file is this rule targeting?

Accepted Answer

Windows executable files. 0x5A4D is the MZ header for Windows executables (PE files). The rule looks for files starting with 'MZ' and less than 500KB, likely targeting small malware executables.

Answer

PDF files

Answer

JPEG images

Answer

Linux ELF files

Question 8

A security analyst is creating a policy for handling sensitive customer data. The policy must ensure data is encrypted at rest and in transit. Which type of policy most directly addresses this requirement?

Accepted Answer

Data Protection Policy. A data protection policy specifically covers encryption, storage, and transmission controls. Option B is correct. Option A (access control) is about permissions. Option C (incident response) is about breaches. Option D (physical security) is about facilities.

Answer

Incident Response Policy

Answer

Access Control Policy

Answer

Physical Security Policy

Question 9

You are a security analyst at a medium-sized company. A user reports that their workstation is running slowly and the network is sluggish. You check the firewall logs and see a large number of outgoing connections from the user's workstation to an external IP address (198.51.100.23) on port 4444. The connections are short-lived and occur every few seconds. The workstation has standard corporate antivirus installed, which is up-to-date and shows no threats. You have also noticed that the workstation is making DNS queries to an unusual domain (malicious.example.com) that resolves to the same external IP. What is the most appropriate immediate action?

Accepted Answer

Isolate the workstation by disconnecting it from the network immediately.. The workstation exhibits classic signs of a command-and-control (C2) infection: periodic outbound connections to an external IP on a non-standard port (4444) and DNS queries to a suspicious domain. Isolating the workstation immediately (Option B) is the most appropriate action because it stops the potential data exfiltration and prevents the malware from receiving further commands, containing the threat before any analysis or remediation.

Answer

Block the external IP address on the firewall and continue monitoring.

Answer

Run a full forensic analysis on the workstation without disconnecting it.

Answer

Update the antivirus signatures and run a full scan on the workstation.

Question 10

Refer to the exhibit. A security analyst reviews the access list. Senior management has authorized SSH access (port 22) to external servers only from the 10.1.1.0/24 and 10.1.2.0/24 subnets. What is the most significant security flaw in this ACL?

Accepted Answer

The permit ip any any at the end allows all unexamined traffic, potentially bypassing other security controls. The ACL permits all other traffic (line 40) after denying SSH from other sources. This bypasses any additional restrictions; the intent might be to allow only specific IPs for SSH, but the permit ip any any at the end allows all other traffic, which could include other unwanted protocols. Option A is incorrect because line 40 permits everything. Option B is wrong because the source is correctly the internal subnets. Option C is wrong because ACLs are sequence-dependent, but line 30 only denies SSH from other sources.

Answer

The destination 'any' allows SSH to any external server, which is too permissive

Answer

The ACL permits SSH from unauthorized IP addresses

Answer

The ACL sequence is illogical; line 30 should be before lines 10 and 20

Question 11

A security analyst is investigating a PCAP that shows multiple failed SMB authentication attempts from a single host to different IP addresses, followed by a successful authentication. Which TWO techniques are likely being used?

Accepted Answer

SMB brute force. Pass-the-hash uses NTLM hashes for authentication, and SMB brute force involves trying multiple passwords or hashes. Both can produce multiple failed attempts then success.

Answer

SQL injection

Answer

ARP spoofing

Answer

DNS tunnelling

Question 12

During a merger, two companies have different security policies. Company A uses a discretionary access control (DAC) model, while Company B uses a mandatory access control (MAC) model. The merged entity must adopt a single policy. Which approach is most likely to be adopted and why?

Accepted Answer

MAC because it is more secure. MAC provides stricter, system-enforced controls based on classification, which is often adopted in higher-security environments. DAC relies on user discretion and is less secure.

Answer

DAC because it is more flexible

Answer

Both can coexist

Answer

A new hybrid model combining both

Question 13

A company's security policy requires that all system logs be retained for at least one year. A security analyst discovers that log files are being overwritten after 30 days. What is the most likely cause?

Accepted Answer

The log rotation policy is set to 30 days. The log rotation setting is likely set to 30 days, causing overwrites. Option A is wrong while disk space may contribute, the direct cause is the rotation policy. Option B is wrong because malware is less likely. Option D is wrong because an administrator deleting logs would be a deliberate act.

Answer

Logs are being manually deleted by an administrator

Answer

Malware infection

Answer

Insufficient disk space

Question 14

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Accepted Answer

HTTP and HTTPS traffic only. The ACL permits TCP traffic from 10.0.0.0/8 to any destination on ports 80 (HTTP) and 443 (HTTPS). Option B is wrong because only these two ports are permitted. Option C is wrong because it permits only HTTP and HTTPS. Option D is wrong because both HTTP and HTTPS are allowed.

Answer

All TCP traffic

Answer

All IP traffic from 10.0.0.0/8

Answer

Only HTTP traffic

Question 15

A security policy mandates that all administrative access to network devices must be encrypted. Which of the following protocols should be used to comply with this policy?

Accepted Answer

SSH. SSH (Secure Shell) encrypts all traffic, including authentication credentials and commands, between an administrator and a network device. This satisfies the policy requirement for encrypted administrative access, unlike Telnet which sends everything in plaintext.

Answer

Telnet

Answer

TFTP

Answer

SNMPv2c

Question 16

A security analyst discovers that an attacker exfiltrated data using DNS tunneling. Which TWO controls should be implemented to detect or prevent this? (Select two.)

Accepted Answer

Monitor DNS query sizes and frequencies. DNS tunneling often involves unusually large query sizes (e.g., encoded data in subdomains) and abnormal query frequencies (e.g., thousands of requests per minute). Monitoring these metrics allows analysts to spot deviations from baseline behavior, which is a key detection technique for exfiltration via DNS. Option B is correct because a DNS sinkhole redirects malicious or suspicious DNS queries to a controlled IP address, effectively blocking the resolution of domains used for tunneling and preventing data from reaching the attacker's command-and-control server.

Answer

Disable recursive DNS on the internal DNS server

Answer

Implement DNSSEC

Answer

Block all DNS queries to external servers

Question 17

An analyst receives a syslog message with facility 'authpriv' and severity '3'. What does severity 3 indicate?

Accepted Answer

Error. Syslog severity levels range from 0 (Emergency) to 7 (Debug). Severity 3 corresponds to 'Error', which indicates error conditions that require attention but are not immediately critical. This is defined in RFC 5424, where level 3 is explicitly labeled 'Error' and is used for conditions such as configuration failures or service degradation.

Answer

Emergency

Answer

Critical

Answer

Alert

Question 18

During a security assessment, a SOC analyst notices an IDS/IPS alert with a severity of 'High' for a signature named 'ET TROJAN Win32.Vobfus Checkin'. The alert shows source IP 10.0.0.5 and destination IP 203.0.113.50 on port 443. What is the most likely interpretation of this alert?

Accepted Answer

A compromised host attempting to communicate with a command-and-control server over encrypted traffic. The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

Answer

A false positive due to a web browser accessing a secure site

Answer

An attacker scanning for open HTTPS ports on the internal network

Answer

A benign HTTPS connection to a legitimate website

Question 19

An analyst needs to establish a normal traffic pattern baseline for the network. Which activity is most appropriate for this purpose?

Accepted Answer

Capture traffic over a period of normal operation, such as a week. Establishing a baseline requires capturing traffic during a period of normal operation, typically over a week, to account for daily and weekly usage patterns. This baseline represents the typical volume, protocol mix, and flow characteristics, enabling the analyst to later detect deviations that may indicate security incidents. Using a representative sample from normal conditions is the foundational step in anomaly-based monitoring.

Answer

Capture traffic during a known attack to identify anomalies

Answer

Use only firewall logs as they are the most reliable

Answer

Average traffic from multiple different organizations

Question 20

A company's security policy includes a clause that all software installed on company devices must be approved by the IT department. An employee installs an unapproved application that later causes a malware infection. Which policy was violated?

Accepted Answer

Acceptable Use Policy. The Acceptable Use Policy (AUP) defines what activities and software are permitted on company devices. By installing an unapproved application without IT authorization, the employee violated the AUP, which directly led to the malware infection. This policy is the primary control for preventing unauthorized software installations that bypass security baselines.

Answer

Incident Response Policy

Answer

Data Retention Policy

Answer

Remote Access Policy