200-201 Practice Exam 3 — 20 Questions

Question 1

An analyst is investigating a Windows host for malware persistence. Which TWO registry locations are commonly abused for persistence by modifying the 'Run' key? (Select TWO)

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Both HKLM and HKCU Run keys are commonly used for persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\System\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Question 2

A company uses Cisco Stealthwatch to monitor network traffic. Which type of data does Stealthwatch primarily rely on for visibility?

Accepted Answer

NetFlow data. Cisco Stealthwatch is designed for network traffic analysis and relies on NetFlow data (including IPFIX and other flow protocols) to provide visibility into network behavior, traffic patterns, and anomalies. Unlike full packet captures, NetFlow metadata (source/destination IP, ports, protocols, byte counts) is lightweight and scalable for monitoring large networks, making it the primary data source for Stealthwatch's behavioral analytics and threat detection.

Answer

SNMP traps

Answer

Full packet captures

Answer

Syslog messages

Question 3

An analyst is performing memory forensics on a Windows machine using Volatility. Which command would be most useful to identify hidden or injected code within a process?

Accepted Answer

malfind. The `malfind` plugin in Volatility is specifically designed to detect hidden or injected code in process memory. It scans for memory regions that are both executable and writable (or have no file backing on disk), which are common indicators of code injection techniques like process hollowing or reflective DLL injection. By identifying these suspicious memory pages, `malfind` helps analysts uncover malware that attempts to hide within legitimate processes.

Answer

dlllist

Answer

netscan

Answer

pslist

Question 4

An analyst examining a Linux server notices an unusual cron job in /etc/crontab that runs a script every 5 minutes. Which of the following describes the best approach to determine if this cron job is malicious?

Accepted Answer

Check the script's content, owner, and compare its hash with known threats.. Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.

Answer

Ignore it because cron jobs are always legitimate.

Answer

Delete the cron job immediately to stop potential malicious activity.

Answer

Run the script in a sandbox to see what it does.

Question 5

When analyzing a suspicious PE file, the analyst calculates the file's entropy and finds it to be 7.8. What does a high entropy value typically indicate, and why is it relevant to malware analysis?

Accepted Answer

The file is likely packed or encrypted to evade signature-based detection.. A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Answer

The file contains no executable code.

Answer

The file is likely a legitimate application with high compression.

Answer

The file's imports are all standard Windows DLLs.

Question 6

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

Accepted Answer

Isolate the host from the network.. The correct first step is to isolate the host from the network (C) because the alert indicates active malware ('invoice.exe' in Downloads). Containment is the immediate priority in incident response to prevent lateral movement and data exfiltration. Isolating the host stops any ongoing C2 communication or propagation over the network, aligning with the NIST SP 800-61 containment strategy.

Answer

Escalate to a senior analyst.

Answer

Run a full antivirus scan.

Answer

Delete the file immediately.

Question 7

A PCAP contains an HTTP POST request with a parameter containing "UNION SELECT username, password FROM users". This is evidence of:

Accepted Answer

SQL injection. SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.

Answer

Cross-site scripting

Answer

Path traversal

Answer

Command injection

Question 8

A network administrator is using Cisco ISE to monitor endpoint authentication. Which report provides details on failed authentication attempts and the reasons?

Accepted Answer

RADIUS Authentication Report. The RADIUS Authentication Report in Cisco ISE specifically logs all authentication attempts, including failures, and provides detailed reasons for each failure (e.g., invalid credentials, user not found, or authorization policy mismatch). This report is the primary tool for troubleshooting failed authentications because it captures the RADIUS Access-Reject messages and the corresponding failure reasons from the ISE policy evaluation.

Answer

Endpoint Profiler Report

Answer

RADIUS Accounting Report

Answer

Active Session Report

Question 9

A Linux administrator checks authentication logs to investigate a possible brute-force attack. Which log file typically contains records of successful and failed SSH login attempts?

Accepted Answer

/var/log/auth.log. On Debian/Ubuntu Linux systems, /var/log/auth.log records authentication-related events including successful and failed SSH logins, sudo usage, and PAM activity. It is the primary log file for investigating brute-force attacks against SSH. This matches the question's requirement.

Answer

/var/log/kern.log

Answer

/var/log/messages

Answer

/var/log/syslog

Question 10

A company uses a SIEM that collects logs from firewalls, servers, and endpoints. The SIEM is generating a high volume of low-priority events, causing analysts to miss critical alerts. Which approach would best improve the signal-to-noise ratio?

Accepted Answer

Implement event filtering and correlation rules to reduce false positives.. The SIEM's high volume of low-priority events indicates a poor signal-to-noise ratio, where benign or irrelevant events drown out critical alerts. Implementing event filtering and correlation rules directly reduces false positives by discarding known noise (e.g., repeated benign scans) and grouping related events into meaningful alerts, allowing analysts to focus on genuine threats. This is the standard approach in SIEM tuning to improve detection fidelity without adding resources or data.

Answer

Deploy additional sensors to collect more data.

Answer

Hire more analysts to review all events.

Answer

Increase the storage capacity of the SIEM.

Question 11

An analyst sees a Snort alert with the message 'ET POLICY Outbound connection to known malicious IP'. What does this indicate?

Accepted Answer

An internal host is connecting to an IP that is on a threat intelligence blacklist.. Snort signature-based IDS alerts on matching rules. This alert indicates a connection from an internal host to a known malicious IP address, likely a command-and-control server.

Answer

A malicious IP is connecting to an internal host.

Answer

The firewall blocked the connection.

Answer

The connection is encrypted and safe.

Question 12

What is the primary goal of the 'integrity' pillar of the CIA triad?

Accepted Answer

Protect data from unauthorized modification. The 'integrity' pillar of the CIA triad ensures that data is not altered or tampered with by unauthorized parties. This is achieved through mechanisms such as hashing (e.g., SHA-256), checksums, and digital signatures that detect any unauthorized modification. Option D correctly identifies this goal, as protecting data from unauthorized modification is the core purpose of integrity controls.

Answer

Keep data secret from unauthorized users

Answer

Ensure data is accessible when needed

Answer

Provide proof that a user performed an action

Question 13

Refer to the exhibit. Which security protocol is being configured?

Accepted Answer

IPsec VPN (IKE phase 1). The exhibit shows the configuration of an IPsec VPN IKE phase 1 policy using the `crypto isakmp policy` command. The parameters set—encryption algorithm (e.g., aes), hash algorithm (e.g., sha), Diffie-Hellman group (e.g., 2), and authentication method (e.g., pre-share)—are all specific to IKE phase 1, which establishes a secure authenticated channel for further key exchange. This is not used for SSL VPN, MACsec, or SSH, as those protocols have distinct configuration syntax and purposes.

Answer

SSL VPN

Answer

MACsec

Answer

SSH

Question 14

A SOC analyst is reviewing proxy logs and wants to identify indicators of potential data exfiltration over HTTP. Which two patterns should the analyst treat as suspicious? (Choose two.)

Accepted Answer

Large outbound POST requests to a single external IP address at regular intervals.. Exfiltration over HTTP often appears as large outbound uploads, especially to new or untrusted destinations. Regular large POST requests and high-volume uploads to newly registered domains both indicate data leaving the environment in a manner inconsistent with normal business traffic. These patterns warrant deeper investigation.

Answer

HTTP 404 errors generated by users mistyping URLs in the browser.

Answer

Repeated GET requests to the same internal web server for static images.

Answer

Downloading software updates from a known vendor's HTTPS site.

Question 15

During network intrusion analysis, an analyst reviews logs and observes an alert for a TCP SYN scan. Which characteristic of a SYN scan would the analyst look for in packet captures?

Accepted Answer

The scan sends SYN packets and, upon receiving SYN-ACK, sends RST packets.. A SYN scan sends a SYN packet and, upon receiving a SYN-ACK from the target, responds with a RST instead of completing the handshake. This avoids a full connection and is stealthier.

Answer

The scan sends SYN packets and expects ICMP unreachable messages for open ports.

Answer

The scan sends SYN packets and waits for a timeout on closed ports.

Answer

The scan sends SYN packets and completes the three-way handshake for open ports.

Question 16

Which of the following is a common indicator of a brute-force attack on an SSH server?

Accepted Answer

Repeated login attempts with different usernames and passwords in a short period.. A brute-force attack on an SSH server is characterized by a high volume of authentication attempts, typically using different usernames and passwords, in a short time window. This pattern aims to guess valid credentials through repeated trial and error, which is distinct from a single failure or a few successful logins. The rapid, automated nature of the attempts is the key indicator that distinguishes brute-force activity from normal user behavior.

Answer

A single failed login attempt.

Answer

Multiple successful logins from the same user.

Answer

High CPU usage on the server.

Question 17

An analyst detects an attack where the attacker uses NTLM authentication with a hashed password instead of the plaintext password. This technique is known as:

Accepted Answer

Pass-the-hash. Pass-the-hash is the technique where an attacker uses a captured NTLM password hash directly to authenticate without knowing the plaintext password. Because NTLM authentication accepts the hash as the credential, the attacker can replay it to access systems.

Answer

Password spraying

Answer

Brute force

Answer

Kerberos ticket reuse

Question 18

An organization must comply with a regulation that requires protecting the privacy of EU citizens' personal data. Which compliance framework applies?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the EU regulation specifically designed to protect the privacy and personal data of EU citizens. It applies to any organization that processes or controls the personal data of individuals in the EU, regardless of where the organization is based. This makes GDPR the correct compliance framework for the scenario described.

Answer

HIPAA

Answer

ISO 27001

Answer

PCI DSS

Question 19

What is the purpose of a security baseline?

Accepted Answer

To define the minimum acceptable security posture. A security baseline defines the minimum acceptable security posture for systems, networks, and devices. It establishes a standard configuration that must be met to ensure a consistent level of security across the organization, such as requiring specific patch levels, disabling unnecessary services, and enforcing password policies. Without a baseline, there is no reference point to measure compliance or identify deviations that could indicate a security weakness.

Answer

To respond to security incidents

Answer

To encrypt sensitive data

Answer

To detect malware infections

Question 20

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet