200-201 Practice Exam 2 — 20 Questions

Question 1

Which TWO of the following are key components of a security policy? (Choose two.)

Accepted Answer

Policy statement. A security policy is a high-level document that defines an organization's overall security posture, objectives, and guiding principles. The policy statement (B) is the core component that articulates management's commitment and the policy's scope, while enforcement and compliance guidelines (C) specify how the policy will be implemented and what consequences exist for violations. These two elements are fundamental to any security policy framework.

Answer

Incident response procedures

Answer

Password complexity requirements

Answer

Network topology diagrams

Question 2

Which type of malware is designed to encrypt files on a victim's system and demand payment for the decryption key?

Accepted Answer

Ransomware. Ransomware is the correct answer because it is specifically designed to encrypt files on a victim's system using a symmetric or asymmetric encryption algorithm (e.g., AES-256, RSA-2048) and then demand a ransom payment, typically in cryptocurrency, in exchange for the decryption key. This type of malware directly targets data availability, a core component of the CIA triad, by rendering files inaccessible until the ransom is paid.

Answer

Rootkit

Answer

Worm

Answer

Trojan horse

Question 3

Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?

Accepted Answer

Visibility into local system events such as file system changes and registry modifications.. HIDS are installed directly on a host and have direct access to the host's operating system, allowing them to monitor local system events such as file system changes, registry modifications, and process activity. This granular visibility is a key advantage over NIDS, which only sees network traffic and cannot inspect internal host state.

Answer

Better suited for protecting a large number of devices simultaneously.

Answer

Less susceptible to host-based attacks.

Answer

Lower latency in detecting network attacks.

Question 4

An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)

Accepted Answer

Transport Layer Security (TLS). Symmetric encryption, asymmetric encryption, and TLS (which uses both) provide confidentiality. Hashing does not.

Answer

Digital signature

Answer

Hashing

Question 5

A security policy requires that all email attachments be scanned for malware. An employee receives a legitimate PDF from a customer that is flagged as malicious. What should the analyst do first?

Accepted Answer

Contact the customer to verify the file is intended.. The first step when a legitimate-seeming email attachment is flagged as malicious is to verify its authenticity with the sender. This aligns with the security policy's requirement to scan attachments while avoiding unnecessary disruption to business operations. Contacting the customer confirms whether the file was intentionally sent and is safe, allowing the analyst to make an informed decision before taking further action.

Answer

Allow the email through since it's from a known sender.

Answer

Quarantine the email and delete the attachment.

Answer

Escalate to the incident response team.

Answer

Update the antivirus signatures and rescan.

Question 6

Which THREE are typical sources of log data used in security monitoring? (Choose three.)

Accepted Answer

Windows Event Logs.. Windows Event Logs are a primary source of security monitoring data because they record critical security events such as logon attempts, account changes, and process creation (Event IDs 4624, 4625, 4688). Security Information and Event Management (SIEM) systems ingest these logs to detect unauthorized access, privilege escalation, and malware execution.

Answer

Printer spool logs.

Answer

HVAC system logs.

Question 7

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 8

A security analyst is reviewing network traffic and notices a high volume of small packets from an internal IP to a single external IP on port 53. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling encodes data within DNS queries and responses, often using small packets to evade detection. A high volume of small packets from an internal IP to a single external IP on port 53, without corresponding internal DNS server traffic, is a classic indicator of data exfiltration via DNS tunneling.

Answer

DNS amplification attack

Answer

Port scan

Answer

Normal DNS resolution

Question 9

A company implements a policy where users must authenticate with a password and a one-time code from a token. Which AAA component is strengthened by this policy?

Accepted Answer

Authentication. Authentication is the AAA component that verifies the identity of a user. By requiring both a password (something you know) and a one-time code from a token (something you have), the policy implements multi-factor authentication (MFA), which directly strengthens the authentication process. This ensures that even if a password is compromised, an attacker cannot authenticate without the token.

Answer

Accounting

Answer

Auditing

Answer

Authorization

Question 10

A SOC analyst is reviewing a security alert generated by the SIEM. The alert indicates a successful login from an unusual geographic location for a user who typically logs in from the corporate office. The analyst verifies that the user is currently on vacation and should not be accessing the network. What should the analyst do next?

Accepted Answer

Disable the user account and begin an investigation. The alert indicates a clear security incident: a successful login from an unusual geographic location for a user who is on vacation and should not be accessing the network. Disabling the user account immediately contains the threat by preventing further unauthorized access, and beginning an investigation allows the analyst to determine if the account was compromised or if credentials were stolen. This aligns with the NIST SP 800-61 incident response process, where containment is a priority before proceeding to eradication and recovery.

Answer

Ignore the alert because the user might be using a VPN

Answer

Block the IP address in the firewall

Answer

Start a full incident investigation before taking any action

Question 11

Which two Sysmon Event IDs are most commonly associated with code injection techniques?

Accepted Answer

Event ID 8 (CreateRemoteThread). Sysmon Event ID 8 (CreateRemoteThread) is directly associated with code injection because it logs when a thread is created in a remote process, a common technique used by malware to inject malicious code into a legitimate process. Event ID 10 (ProcessAccess) is also critical as it records when a process opens a handle to another process, often a precursor to injecting code via APIs like OpenProcess and WriteProcessMemory.

Answer

Event ID 3 (Network connect)

Answer

Event ID 1 (Process creation)

Answer

Event ID 7 (Image loaded)

Question 12

An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)

Accepted Answer

Large DNS response packets. Large DNS response packets (Option B) are indicative of data exfiltration because attackers often encode stolen data into DNS TXT or other record types, causing response sizes to exceed the typical 512-byte limit and triggering EDNS0 extensions. This anomaly stands out against normal DNS traffic, where most responses are small.

Answer

Use of standard DNS ports

Answer

DNSSEC enabled

Answer

Frequent DNS query retransmissions

Question 13

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet

Question 14

Given a packet capture showing TCP packets with flags: first packet SYN, second packet SYN-ACK, third packet ACK, then a fourth packet with RST flag. What should the analyst suspect?

Accepted Answer

Port scan. The three-way handshake (SYN, SYN-ACK, ACK) completes a TCP connection, but the immediate RST after the ACK indicates the client terminated the connection without sending any application data. This pattern is characteristic of a port scan (e.g., using nmap's connect scan), where the scanner verifies the port is open by completing the handshake and then immediately resets to avoid leaving the connection half-open.

Answer

Normal traffic

Answer

SYN flood

Answer

Denial of service

Question 15

Which of the following is an example of an Indicator of Compromise (IoC)?

Accepted Answer

A file hash (SHA-256). An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Answer

A SIEM dashboard

Answer

A firewall rule

Answer

A network baseline

Question 16

A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:

Accepted Answer

False positive. A false positive occurs when an alert is triggered but no actual attack exists. The file is benign, so the alert is incorrect.

Answer

True positive

Answer

False negative

Answer

True negative

Question 17

You are a security analyst at a multinational corporation. The company has implemented a security policy that requires all employees to use company-issued laptops with full disk encryption. During a routine audit, you discover that a senior executive's laptop is not encrypted. The executive claims that IT support had disabled encryption because the laptop was running slowly. The current policy does not allow exceptions without management approval. The executive's laptop contains sensitive client data. What should you do?

Accepted Answer

Report the violation to the security manager and advise that the laptop remain in use but monitored closely until encryption can be applied during next maintenance window.. It follows the security policy by reporting the violation to the security manager and proposing a monitored approach until encryption can be applied during the next maintenance window, balancing security and operational continuity. Option B is insufficient as it creates an informal exception without proper authorization. Option C is an overreaction without evidence of data exposure. Option D violates policy by taking unauthorized action.

Answer

Accept the executive's explanation and document it as an informal exception.

Answer

Escalate to the incident response team to treat this as a data breach because data may have been exposed.

Answer

Immediately re-enable encryption on the laptop and submit an exception request after the fact.

Question 18

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Accepted Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Apply access-list to interface
5. Verify configuration. The correct order for basic Cisco ASA configuration is: global configuration mode, interface configuration (nameif, IP address, security-level), ACL creation, ACL application to interface, and verification. This sequence ensures interfaces are ready, ACLs exist before being applied, and verification confirms the policy is active. Common mistakes include creating or applying ACLs before interfaces are configured, or verifying before applying the ACL.

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Configure interfaces (nameif, ip address, security-level)
4. Apply access-list to interface
5. Verify configuration

Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Verify configuration
5. Apply access-list to interface

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Apply access-list to interface
4. Configure interfaces (nameif, ip address, security-level)
5. Verify configuration

Question 19

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 20

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

Accepted Answer

A threat exploits a vulnerability, resulting in risk.. In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Answer

A vulnerability is a potential danger; a threat is a weakness; risk is the impact.

Answer

A vulnerability is a potential attack; a threat is a weakness.

Answer

Risk is eliminated when a vulnerability is patched.