200-201 Practice Exam 3 — 20 Questions

Question 1

A SOC analyst is tuning an IPS rule that detects SQL injection attempts. The rule currently generates a high number of alerts, most of which are false positives caused by legitimate web application traffic containing SQL-like keywords. The analyst wants to reduce false positives without missing actual attacks. Which approach is most effective?

Accepted Answer

Implement a whitelist of known good SQL queries from the application.. Option A is correct because implementing a whitelist of known good SQL queries from the application allows the IPS to ignore benign traffic that matches SQL-like patterns, reducing false positives while still alerting on any SQL injection attempt that deviates from the whitelist. This approach leverages application-specific knowledge to distinguish legitimate queries from malicious ones, maintaining detection coverage for actual attacks.

Answer

Reduce the rule's sensitivity to only match exact attack patterns.

Answer

Disable the rule and rely on web application firewall logs.

Answer

Exclude all HTTP GET requests from inspection.

Question 2

Refer to the exhibit. A security analyst is analyzing a Windows host that is communicating with an external server at 192.168.1.50. Based on the output, which process is likely malicious?

Accepted Answer

powershell.exe (PID 2792) because it has an established HTTPS connection to an external server.. PowerShell.exe (PID 2792) is the likely malicious process because it has an established HTTPS connection (TCP port 443) to an external server at 192.168.1.50. PowerShell is a powerful scripting tool often abused by attackers to execute arbitrary code, download payloads, or establish command-and-control (C2) channels over encrypted HTTPS, which can evade detection by traditional signature-based security tools.

Answer

svchost.exe (PID 1420) because it is connecting to an external IP on port 80.

Answer

cmd.exe (PID 2568) because it could be used to launch other processes.

Answer

notepad.exe (PID 2344) because it is not expecting to make any network connections.

Question 3

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Accepted Answer

HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.. The ACL applied outbound on the external interface permits TCP traffic from the 192.168.1.0/24 network to any destination on ports 80 (HTTP) and 443 (HTTPS), and denies all other traffic, including SSH (port 22). Since the ACL has an implicit deny at the end, only HTTP and HTTPS are allowed; SSH is explicitly denied because it does not match any permit statement. Therefore, HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.

Answer

All outbound traffic is denied except HTTP and HTTPS.

Answer

Only HTTP and HTTPS traffic is allowed.

Answer

SSH traffic is only denied if it originates from the 192.168.1.0/24 network.

Question 4

A security analyst observes a sudden spike in outbound traffic from a critical server to an external IP address on TCP port 443. The server is a web application server that normally only receives inbound connections. Which type of intrusion is most likely occurring?

Accepted Answer

Command-and-control (C2) communication from malware on the server. A sudden spike in outbound traffic from a server that normally only receives inbound connections is a classic indicator of command-and-control (C2) communication. Malware on the server often establishes outbound HTTPS (TCP 443) connections to a C2 server to exfiltrate data or receive instructions, bypassing firewalls that typically allow outbound web traffic.

Answer

Distributed denial-of-service (DDoS) attack from the server

Answer

Brute-force attack on the server's SSH service

Answer

SQL injection attack against the server

Question 5

An analyst needs to determine if a host is infected with malware that is attempting to contact a known malicious domain. Which log source is most appropriate for this analysis?

Accepted Answer

DNS server logs. DNS server logs are the most appropriate source because they record all DNS queries made by hosts on the network. If a host is attempting to contact a known malicious domain, the DNS query for that domain will appear in the logs, allowing the analyst to identify the infected host by its source IP address and the timestamp of the query.

Answer

Syslog from the host

Answer

NetFlow records

Answer

Data loss prevention (DLP) logs

Question 6

A security analyst is reviewing the incident response plan for a small business. The plan states that after an incident is contained, the next step is to preserve evidence. The CISO wants to ensure that the plan follows NIST guidelines. Which step should be added between containment and evidence preservation according to NIST?

Accepted Answer

Eradication. According to NIST SP 800-61 Rev. 2, the incident response lifecycle includes Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (Lessons Learned). Eradication (option D) must follow containment to remove artifacts such as malware, backdoors, or compromised accounts before evidence is preserved for legal or forensic purposes. Without eradication, residual threats could tamper with or destroy evidence during collection.

Answer

Lessons learned

Answer

Recovery

Answer

Evidence collection and analysis

Question 7

An organization wants to classify data based on its sensitivity and impact if disclosed. Which security principle is being applied?

Accepted Answer

Confidentiality, integrity, and availability (CIA). The organization's goal is to classify data based on sensitivity and impact if disclosed, which directly aligns with the confidentiality component of the CIA triad. Confidentiality ensures that sensitive information is accessed only by authorized individuals, and classification is the foundational step to enforce this principle. The CIA triad (Confidentiality, Integrity, Availability) is the core security model that governs how data is protected based on its value and risk.

Answer

Defense in depth

Answer

Least privilege

Answer

Data loss prevention

Question 8

Which TWO are goals of a security operations center (SOC)? (Choose two.)

Accepted Answer

Continuous monitoring of security events. Option A is correct because continuous monitoring of security events is a primary goal of a SOC, ensuring real-time detection of threats through log aggregation and analysis from sources like firewalls, IDS/IPS, and endpoints. This aligns with the SOC's responsibility to maintain situational awareness and identify indicators of compromise (IoCs) as part of the NIST incident response lifecycle.

Answer

Managing user passwords

Answer

Developing software applications

Answer

Performing penetration tests

Question 9

A SOC analyst notices repeated failed login attempts from a single IP address against multiple user accounts. Which type of attack is most likely occurring?

Accepted Answer

Password spraying. Password spraying (C) is correct because the attack involves a single IP address attempting the same common password against multiple user accounts. This technique avoids account lockout policies that typically trigger after a few failed attempts on a single account, making it distinct from brute force attacks that target one account with many passwords.

Answer

Credential stuffing

Answer

Brute force attack

Answer

Man-in-the-middle attack

Question 10

Refer to the exhibit. A network analyst sees these firewall logs. What is the most likely interpretation?

Accepted Answer

An attacker is performing a port scan on internal hosts from the outside. The firewall logs show multiple denied TCP connection attempts from a single external IP to various internal IPs on different ports (e.g., 80, 443, 22). This pattern of sequential probes across multiple destinations and ports is characteristic of a port scan, where an attacker systematically probes for open services. The rule OUTSIDE_IN is correctly logging and blocking these attempts, indicating the firewall is functioning as designed to prevent reconnaissance.

Answer

The firewall rule OUTSIDE_IN is misconfigured and blocking all traffic

Answer

A malware is trying to phone home to an external C2 server

Answer

A user is trying to access internal web servers legitimately but is blocked by ACL

Question 11

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Accepted Answer

Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal. Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Answer

Place both servers on the internal network with host-based firewalls

Answer

Use a VPN between the web server and database server

Answer

Place both servers on the same VLAN with a firewall between them

Question 12

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Accepted Answer

It allows MySQL traffic from DMZ to internal network and blocks all other traffic. The ACL is applied inbound on the DMZ interface, meaning it filters traffic arriving from the DMZ (10.0.1.0/24) destined for the internal network (10.0.2.0/24). The first line permits TCP traffic from the DMZ to the internal network on port 3306 (MySQL). The second line is an explicit deny all, which blocks any other traffic from the DMZ to the internal network. Therefore, the ACL allows only MySQL traffic from the DMZ to the internal network and denies everything else.

Answer

It allows MySQL traffic from internal network to DMZ

Answer

It blocks all traffic from DMZ to internal network

Answer

It allows any traffic from DMZ to internal network

Question 13

Which TWO security concepts are fundamental to the principle of least privilege? (Choose two.)

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) is fundamental to the principle of least privilege because it assigns permissions based on job functions rather than individual users, ensuring users receive only the access necessary for their roles. The 'need-to-know' concept restricts access to information strictly required for a user's tasks, directly enforcing least privilege by limiting data exposure. Together, RBAC provides a scalable framework for access management, while need-to-know ensures granular data-level control.

Answer

Mandatory access control (MAC)

Answer

Separation of duties

Answer

Defense in depth

Question 14

Refer to the exhibit. A Windows security log shows several events with Event ID 4625 (failed logon). What type of attack is indicated?

Accepted Answer

Brute force attack. Event ID 4625 indicates a failed logon attempt. A high volume of these events in a short period is characteristic of a brute force attack, where an attacker systematically tries multiple username/password combinations to gain unauthorized access. This is a direct indicator of repeated authentication failures, not a more sophisticated attack.

Answer

Pass-the-hash attack

Answer

Kerberos golden ticket attack

Answer

Man-in-the-middle attack

Question 15

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Accepted Answer

Slow network performance and service unavailability. Option A is correct because a DDoS attack floods the target with traffic from multiple sources, overwhelming network resources and causing legitimate requests to time out or be dropped. This results in slow network performance and service unavailability as the system struggles to process the excessive load. The distributed nature of the attack makes it difficult to mitigate with simple IP-based filtering.

Answer

A single IP address generating excessive traffic

Answer

Encrypted traffic from a known malware C2 server

Question 16

A security team implements a network-based IPS. During testing, they find that legitimate traffic is frequently blocked. Which tuning approach should they prioritize?

Accepted Answer

Disable or modify signatures causing false positives.. Option C is correct because false positives occur when IPS signatures incorrectly match legitimate traffic. The most direct and effective tuning approach is to disable or modify the specific signatures causing the false positives, which reduces unnecessary blocking without compromising overall security posture.

Answer

Change the IPS to fail-open mode.

Answer

Increase the number of IPS sensors.

Answer

Reduce the IPS sensitivity level to lower.

Question 17

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

Accepted Answer

Search the SIEM for events with destination port 22 and source IP.. Option A is correct because a SIEM indexes and correlates log data from multiple sources, allowing an analyst to quickly filter events by destination port 22 (SSH) and source IP without manually sifting through raw logs. This approach leverages the SIEM's search capabilities to retrieve only relevant events from the past hour, making it the most efficient method for targeted threat hunting.

Answer

Review all firewall logs for the past hour.

Answer

Run a packet capture on the server's network interface.

Answer

Check the server's auth.log file manually.

Question 18

During an incident, an analyst needs to determine if a specific user account 'jsmith' was used from a remote IP during a breach window. Which log sources should the analyst check first?

Accepted Answer

Windows Security Event Logs (Event ID 4624, 4625).. Windows Security Event Logs with Event ID 4624 (successful logon) and 4625 (failed logon) are the authoritative source for interactive and remote logon events on a Windows system. They record the target user account (jsmith), the source IP address of the remote connection, and the timestamp, making them the direct and most reliable log source to determine if a specific user account was used from a remote IP during a breach window.

Answer

NetFlow records from the core switch.

Answer

VPN concentrator logs.

Answer

File server audit logs.

Question 19

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Answer

Enable port security on all switches.

Answer

Use VLAN segmentation.

Answer

Implement 802.1X authentication.

Question 20

An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?

Accepted Answer

Fine-tune correlation rules and thresholds based on historical data.. Fine-tuning correlation rules and thresholds (option D) reduces false positives by aligning detection logic with the organization's normal baseline, derived from historical data. This directly addresses alert fatigue without disabling security coverage, as it retains the SIEM's ability to detect genuine threats while filtering out noise. In contrast, simply disabling rules or adding staff fails to address the root cause of poor alert quality.

Answer

Implement a ticketing system for alerts.

Answer

Disable all correlation rules except critical ones.

Answer

Increase the number of analysts on shift.