200-201 Practice Exam 1 — 20 Questions

Question 1

A security analyst is triaging an alert about a user downloading a suspicious file. According to the NIST SP 800-61 Rev 2 incident response process, in which phase does initial triage occur?

Accepted Answer

Detection and Analysis. Initial triage is part of the Detection and Analysis phase, where alerts are evaluated to determine if they are actual incidents.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 2

A network intrusion detection system (NIDS) generates an alert for a known exploit against a web server. The analyst verifies that the server is patched. What is the next best step?

Accepted Answer

Investigate if the exploit was actually attempted. The alert indicates a known exploit signature was triggered against the web server. Even though the server is patched, the NIDS alert means the exploit attempt was observed on the network. The next best step is to investigate whether the exploit was actually attempted, because the patch may have blocked it, but the attempt itself is still a security event that warrants investigation. This aligns with the incident response process: verify, contain, and remediate. Dismissing or tuning without investigation could miss a real attack or a compromised system.

Answer

Reconfigure the NIDS to block the traffic

Answer

Tune the signature to ignore the server

Answer

Dismiss the alert as a false positive

Question 3

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 4

An analyst is investigating a Windows host that likely has malware persistence via the registry. Which TWO registry hives are commonly used to store Run keys for user logon persistence? (Select 2)

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Run keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run are standard locations where Windows executes programs automatically at user logon. Malware commonly writes entries to these keys to achieve persistence, making them critical for host-based analysis.

Answer

HKEY_CLASSES_ROOT\*\shell

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Question 5

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

Accepted Answer

Remove the USB drive and use a different approved method of file transfer.. The security policy mandates scanning all external media before use. Because the USB drive has hardware write-protect, the antivirus scan cannot complete. Therefore, the employee should not use this USB drive and should instead use an alternative approved method (e.g., network share, email, or cloud storage) to transfer the file. This ensures compliance with the policy. Option A is incorrect because manually checking file extensions does not replace a proper malware scan. Option C is incorrect because disabling write protection may compromise security and the scan still might not be reliable. Option D is incorrect because bypassing the scan violates the policy.

Answer

Manually check each file for suspicious extensions.

Answer

Disable write protection and rescan.

Answer

Proceed with the file transfer since the scan failed due to hardware issue.

Question 6

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location

Question 7

Which type of malware is designed to spread automatically across networks without user interaction?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself to spread to other computers over a network, often exploiting vulnerabilities without any user intervention. Unlike viruses, worms do not require a host file or user action to propagate, making them capable of rapid, automated spread across networks.

Answer

Ransomware

Answer

Virus

Answer

Trojan

Question 8

During the containment phase of an incident, the IR team decides to power off a compromised server to prevent further damage. However, they later realize that this action may have destroyed volatile evidence. According to best practices, what should the team have done instead?

Accepted Answer

Perform a live forensic image of the server's memory before powering off. Short-term containment should preserve evidence; live imaging captures volatile data before power-off.

Answer

Disconnect the server from the network but leave it running

Answer

Immediately power off the server without any imaging

Answer

Skip evidence collection and focus solely on containment

Question 9

Which tool can be used to extract files from a PCAP file for further analysis?

Accepted Answer

Wireshark (Export Objects). Wireshark's 'Export Objects' feature allows you to extract files (e.g., HTTP objects, SMB files, or other application-layer payloads) from a PCAP file. This is essential for further analysis of malware or data exfiltration, as it reconstructs the original files from the captured network streams without needing to replay the traffic.

Answer

Snort

Answer

tcpdump

Answer

nmap

Question 10

In a Linux system, an analyst wants to check for unauthorized cron jobs. Which of the following is a common location for user-specific cron jobs?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (or /var/spool/cron/ on some distributions), named after the user.

Answer

/var/log/cron

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 11

In a PCAP, an analyst sees a large outbound data transfer over FTP to an external IP address during non-business hours. The source host is a database server. Which phase of the Cyber Kill Chain does this represent?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's 'Actions on Objectives' phase is where the attacker achieves their ultimate goal, such as exfiltrating data. In this scenario, a large outbound FTP transfer from a database server to an external IP during non-business hours directly indicates data theft, which is the final objective of the intrusion. FTP (port 21/20) is used here as the exfiltration protocol, moving sensitive data out of the network.

Answer

Installation

Answer

Weaponization

Answer

Exploitation

Question 12

A network analyst finds a PCAP with a series of DNS queries for subdomains like "data12345.example.com" and "data67890.example.com" where the subdomain names appear to contain encoded base64 data. This pattern suggests:

Accepted Answer

DNS tunnelling for exfiltration. DNS tunnelling for exfiltration encodes stolen data into DNS query names (often base64) and sends it to an attacker-controlled authoritative DNS server. The pattern of many subdomains with encoded-looking labels under the same domain is a classic indicator of data being smuggled out via DNS, which is frequently allowed through firewalls.

Answer

Port scan via DNS

Answer

Normal DNS resolution

Answer

DGA-based C2

Question 13

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 14

A security analyst detects a host infected with ransomware on the corporate network. According to incident response procedures, what should be the first action?

Accepted Answer

Isolate the host from the network. The first action when a host is infected with ransomware is to isolate it from the network to prevent lateral movement and further encryption of shared resources. Ransomware often uses SMB, RDP, or other network protocols to spread, so disconnecting the host (e.g., by disabling the switch port or unplugging the cable) stops the propagation immediately. This aligns with the NIST incident response framework's containment phase, which prioritizes stopping the attack before any remediation.

Answer

Reimage the host immediately

Answer

Update antivirus signatures

Answer

Notify the IT management team

Question 15

An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?

Accepted Answer

DNS tunnelling for C2 communication. DNS tunnelling encodes data in subdomain queries, and periodic beaconing is common for C2. High entropy subdomains and regular intervals suggest DNS tunnelling for C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for a dynamic DNS service

Answer

DNS cache poisoning attempt

Question 16

Which compliance framework specifically addresses the protection of cardholder data?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the compliance framework specifically designed to protect cardholder data — including credit card numbers, expiration dates, and cardholder names — for any organization that stores, processes, or transmits payment card information. It is mandated by the major card brands and enforced through acquirers and payment processors.

Answer

GDPR

Answer

ISO 27001

Answer

HIPAA

Question 17

A network analyst is examining a PCAP and sees a large number of ICMP echo request packets sent from a single internal host to multiple external IP addresses, with varying payload sizes and no corresponding echo replies. The analyst suspects the host is being used for reconnaissance or data exfiltration. Which characteristic of the ICMP traffic would most strongly indicate that it is being used for data exfiltration rather than simple reconnaissance?

Accepted Answer

The ICMP packets contain non-standard payload data that is base64-encoded and varies in length.. The presence of non-standard, base64-encoded payload data that varies in length is a classic sign of ICMP tunneling for data exfiltration. Normal ping requests have predictable payloads, often just a repeating pattern or timestamp. When ICMP is used as a covert channel, the payload carries encoded stolen data, making the traffic anomalous. The other options describe patterns more consistent with reconnaissance or benign monitoring.

Answer

The payload sizes are consistent and small, matching standard ping requests.

Answer

The source IP address is spoofed to match the destination IP address.

Answer

The ICMP echo requests are sent at a constant rate of one per second to a single external IP.

Question 18

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Accepted Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Apply access-list to interface
5. Verify configuration. The correct order for basic Cisco ASA configuration is: global configuration mode, interface configuration (nameif, IP address, security-level), ACL creation, ACL application to interface, and verification. This sequence ensures interfaces are ready, ACLs exist before being applied, and verification confirms the policy is active. Common mistakes include creating or applying ACLs before interfaces are configured, or verifying before applying the ACL.

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Configure interfaces (nameif, ip address, security-level)
4. Apply access-list to interface
5. Verify configuration

Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Verify configuration
5. Apply access-list to interface

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Apply access-list to interface
4. Configure interfaces (nameif, ip address, security-level)
5. Verify configuration

Question 19

Refer to the exhibit. An analyst sees this syslog message from a Cisco ASA. What does this log entry indicate?

Accepted Answer

An external host attempted to connect to an internal web server and was blocked.. The syslog message shows a deny action for traffic from an external IP (10.10.10.10) to an internal IP (192.168.1.100) on TCP port 443 (HTTPS). The access-group 'OUTSIDE_IN' is applied to the outside interface, and the deny indicates the packet was blocked by an ACL entry. This matches the scenario of an external host attempting to connect to an internal web server and being blocked.

Answer

The access-group 'OUTSIDE_IN' permitted the traffic.

Answer

An internal host attempted to connect to an external web server.

Answer

The ASA allowed the connection because it is a stateful firewall.

Question 20

An organization is developing an Acceptable Use Policy (AUP). Which of the following topics is typically covered in an AUP?

Accepted Answer

Prohibition of using company resources for illegal activities. An AUP defines acceptable use of IT resources, including prohibiting unauthorized access, personal use guidelines, and security responsibilities.

Answer

Password complexity requirements

Answer

Incident reporting procedures

Answer

Data classification levels