200-201 Practice Exam 2 — 20 Questions

Question 1

Which type of traffic is most prominent in this NetFlow data?

Accepted Answer

HTTP. HTTP traffic is most prominent because the NetFlow data shows a high volume of packets and bytes on TCP port 80, which is the default port for HTTP. NetFlow records summarize traffic flows, and the large number of flows and bytes on port 80 indicates that HTTP is the dominant protocol in the captured data.

Answer

SSH

Answer

DNS

Answer

HTTPS

Question 2

A security analyst observes a large number of SYN packets sent to various ports on a target host, receiving RST responses for closed ports and no response for open ports. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Reconnaissance. The observed behavior—sending a large number of SYN packets to various ports and analyzing RST responses (closed ports) versus no response (open ports)—is a classic port scan, specifically a SYN scan. This activity maps the target's attack surface by identifying live hosts and open ports, which aligns with the Reconnaissance phase of the Cyber Kill Chain, where the adversary gathers information to plan an attack.

Answer

Weaponisation

Answer

Exploitation

Answer

Delivery

Question 3

A SOC analyst needs to create a SIEM correlation rule to detect a brute force attack against SSH on a server. Which of the following would be the most effective rule logic?

Accepted Answer

Alert when more than 10 failed SSH logins from the same source IP occur within 1 minute.. A brute force attack is characterized by a high volume of failed authentication attempts from a single source within a short time window. By alerting on more than 10 failed SSH logins from the same source IP within 1 minute, the rule effectively distinguishes malicious automated guessing from isolated user errors, minimizing false positives while capturing the core behavior of a brute force attempt.

Answer

Alert when a single failed SSH login occurs.

Answer

Alert when successful SSH logins occur outside business hours.

Answer

Alert when multiple failed SSH logins from various IPs occur in one hour.

Question 4

In the Cyber Kill Chain model, which phase involves delivering the exploit to the target, such as via email attachment or malicious link?

Accepted Answer

Delivery. The delivery phase is where the weaponized payload is transmitted to the victim, e.g., via phishing email or drive-by download.

Answer

Installation

Answer

Exploitation

Answer

Weaponization

Question 5

A security policy states that user activity logs must be retained for at least one year. What is the primary purpose of this requirement?

Accepted Answer

To support forensic investigations of security incidents. The primary purpose of retaining user activity logs for at least one year is to support forensic investigations of security incidents. When a breach or policy violation occurs, security analysts need historical log data to reconstruct the timeline of events, identify the initial compromise vector, and determine the scope of damage. Without long-term retention, critical evidence may be overwritten or purged before an incident is discovered, making root cause analysis impossible.

Answer

To improve system performance through log analysis

Answer

To comply with regulatory requirements only

Answer

To enable real-time monitoring of user behavior

Question 6

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

Accepted Answer

Periodic connections at regular intervals to an external IP. Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.

Answer

Large data transfers to a known cloud provider

Answer

ICMP echo requests to multiple hosts

Answer

Random intervals with varying packet sizes

Question 7

Which security policy defines the process for reporting discovered security vulnerabilities to the organization?

Accepted Answer

Vulnerability Disclosure Policy. A Vulnerability Disclosure Policy (VDP) defines how external researchers and the public should report security vulnerabilities to an organization, including the scope, reporting channel, and expected response timeline. It is the formal mechanism that governs the inbound reporting process, distinct from internal incident response procedures.

Answer

Acceptable Use Policy

Answer

Incident Response Policy

Answer

Change Management Policy

Question 8

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 9

An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?

Accepted Answer

Command and Control. The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Answer

Delivery

Answer

Actions on Objectives

Answer

Installation

Question 10

A company uses Cisco Firepower NGFW with intrusion prevention. An analyst notices that many legitimate HTTPS connections are being blocked by an IPS rule. What is the best approach to reduce false positives?

Accepted Answer

Create a custom rule exception for the specific destination IPs.. Creating a custom rule exception for the specific destination IPs is the best approach because it allows the IPS to continue blocking malicious traffic while exempting legitimate HTTPS connections that are incorrectly flagged. This maintains security posture by not weakening the rule globally, and it directly addresses the false positive without affecting detection of other threats.

Answer

Increase the severity threshold of the rule.

Answer

Disable the IPS rule entirely.

Answer

Change the rule action from 'Drop' to 'Alert'.

Question 11

An analyst is analyzing a PCAP and sees multiple ICMP port unreachable responses from a target host when scanning UDP ports. What does this indicate about the scanned ports?

Accepted Answer

The ports are closed.. When a UDP scan sends a packet to a closed port, the target responds with an ICMP port unreachable message.

Answer

The scan is a SYN scan.

Answer

The ports are filtered by a firewall.

Answer

The ports are open.

Question 12

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Option A is correct because implementing access control lists (ACLs) on routers and switches restricts which traffic is permitted to reach the management plane and transit the device, enforcing least-privilege filtering as a core hardening control. Option B is correct because disabling unused services (for example, CDP, LLDP, HTTP server, or unused routing protocols) reduces the attack surface by eliminating unnecessary listening ports and daemons that could be exploited. Option E is correct because SNMPv3 with strong authentication (authNoPriv or authPriv using SHA and AES) replaces insecure SNMPv1/v2c community strings with encrypted, authenticated management traffic. Option C is not a hardening practice because Telnet transmits credentials and session data in cleartext; SSH should be used instead. Option D is not a hardening practice because default credentials are widely known and must be changed immediately during initial setup.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 13

Drag and drop the steps for the DHCP DORA process (dynamic host configuration) into the correct order.

Accepted Answer

Step 1: Discover, Step 2: Offer, Step 3: Request, Step 4: Acknowledge. The DHCP DORA process stands for Discover, Offer, Request, Acknowledge. It begins with the client broadcasting a Discover message to find DHCP servers. Servers respond with an Offer of an available IP address. The client then sends a Request to accept one of the offers. Finally, the server sends an Acknowledge to confirm the lease, completing the process. This sequence ensures proper assignment of IP addresses and avoids conflicts.

Answer

Step 1: Discover, Step 2: Request, Step 3: Offer, Step 4: Acknowledge

Answer

Step 1: Offer, Step 2: Discover, Step 3: Request, Step 4: Acknowledge

Answer

Step 1: Discover, Step 2: Offer, Step 3: Acknowledge, Step 4: Request

Question 14

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Vulnerability scanning (C) is active reconnaissance because the attacker directly sends probes to the target to identify weaknesses, generating traffic the firewall can detect and block. Port scanning (D) is active reconnaissance since tools like Nmap send TCP SYN, FIN, or UDP packets to enumerate open ports on the target hosts. Ping sweeps (E) are active reconnaissance because ICMP Echo Request packets are sent across an address range to discover live hosts. WHOIS lookups (B) are passive reconnaissance, as they query public registration databases rather than the target's own systems, so a firewall cannot block them. Social engineering (A) is a human-based attack that involves no network traffic to the firewall and is therefore not a reconnaissance traffic type to filter.

Answer

Social engineering

Answer

WHOIS lookups

Question 15

During an incident response, the SOC needs to determine the scope of a compromise by identifying all hosts that communicated with a known malicious IP in the last 30 days. Which data source would best support this analysis?

Accepted Answer

NetFlow records from the router. NetFlow records capture metadata about all IP traffic flows traversing a router, including source and destination IP addresses, ports, and timestamps. This allows the SOC to query for any host that communicated with the known malicious IP over the past 30 days, providing a complete picture of the compromise's scope. Unlike logs that only record denied traffic or administrative events, NetFlow records all successful communications, making it the ideal data source for this analysis.

Answer

SNMP traps from routers

Answer

Syslog from the DHCP server

Answer

Firewall deny logs

Question 16

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

Accepted Answer

http.log. Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Answer

files.log

Answer

dns.log

Answer

conn.log

Question 17

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

Accepted Answer

GET /products?id=1 UNION SELECT * FROM users. The UNION SELECT payload is the classic SQL injection signature: it appends a second SELECT statement to the original query, allowing the attacker to retrieve data from other tables such as 'users'. The presence of SQL keywords (UNION, SELECT, FROM) inside a URL parameter that should only contain a numeric ID is a strong indicator of SQLi. This pattern targets the backend database directly, unlike script tags which target the browser.

Answer

GET /login?user=admin&pass=password123

Answer

GET /search?q=

Answer

GET /index.html HTTP/1.1

Question 18

A security analyst notices repeated failed login attempts from a single IP address to the company's VPN gateway. Which action should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.

Answer

Escalate to the incident response team immediately.

Answer

Block the IP at the firewall immediately.

Answer

Ignore the activity as it may be a user error.

Question 19

Which TWO actions should an analyst take when a critical alert is triggered?

Accepted Answer

Verify the alert with other sources. Option B is correct because verifying a critical alert against other sources (such as SIEM logs, EDR telemetry, IDS/IPS events, or host-based logs) confirms whether the alert represents a true positive before committing resources, reducing the risk of acting on a false positive. Option C is correct because once a critical alert is validated, the analyst should escalate it to the incident response team so that containment, eradication, and recovery follow the organization's documented IR process and chain-of-custody requirements. Option A is wrong because deleting alerts destroys evidence and audit trails and could mask a real compromise. Option D, while sometimes useful for context, is not one of the two primary actions required at the moment a critical alert fires. Option E is wrong because powering off a system can destroy volatile evidence in memory and may violate incident response procedures; isolation is preferred over shutdown.

Answer

Delete the alert to reduce noise

Answer

Search for similar alerts in the past

Answer

Immediately power off the affected system

Question 20

Which of the following is a valid indicator of compromise (IoC)?

Accepted Answer

A file hash (MD5). An indicator of compromise is a forensic artifact that provides evidence a system or network has been breached. A file hash such as an MD5 (or SHA-1/SHA-256) uniquely identifies a malicious file and can be searched across endpoints and threat feeds, making it a canonical host-based IoC. Hashes, IP addresses, domain names, URLs, and registry keys are all standard IoC types used in detection and threat intelligence.

Answer

The company's logo

Answer

An employee's email address

Answer

A user's full name