200-201 Practice Exam 4 — 20 Questions

Question 1

An analyst needs to establish a normal traffic pattern baseline for the network. Which activity is most appropriate for this purpose?

Accepted Answer

Capture traffic over a period of normal operation, such as a week. Establishing a baseline requires capturing traffic during a period of normal operation, typically over a week, to account for daily and weekly usage patterns. This baseline represents the typical volume, protocol mix, and flow characteristics, enabling the analyst to later detect deviations that may indicate security incidents. Using a representative sample from normal conditions is the foundational step in anomaly-based monitoring.

Answer

Capture traffic during a known attack to identify anomalies

Answer

Use only firewall logs as they are the most reliable

Answer

Average traffic from multiple different organizations

Question 2

An analyst detects HTTPS traffic to a domain that was registered only 24 hours ago and has no web content. The traffic occurs at odd hours and with consistent packet sizes. What technique is likely being used for C2?

Accepted Answer

HTTPS beaconing to a malicious domain. Attackers often use newly registered domains (DGAs or manually registered) for C2 to avoid blacklists. HTTPS provides encryption to hide the beaconing.

Answer

DNS tunneling

Answer

HTTP POST exfiltration

Answer

Domain Generation Algorithm (DGA)

Question 3

Which of the following is an example of an Indicator of Compromise (IoC)?

Accepted Answer

A file hash (SHA-256). An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Answer

A SIEM dashboard

Answer

A firewall rule

Answer

A network baseline

Question 4

You are a security analyst for a medium-sized enterprise. The network includes a DMZ with a web server (10.0.1.10) and a database server (10.0.2.10) in the internal network. Users access the web server via HTTPS from the internet. The web server queries the database server on TCP 3306. Recently, users reported that the web application sometimes returns database errors. You review firewall logs and see the following:

- Allowed inbound HTTPS to 10.0.1.10 from various external IPs.
- Denied outbound from 10.0.1.10 to 10.0.2.10 on port 3306.
- Allowed outbound from 10.0.1.10 to external IPs on port 443.

You also notice that the web server's outbound traffic to the database server is being blocked. The firewall has a default deny rule. Which action should you take to restore normal operation while maintaining security?

Accepted Answer

Create a rule allowing outbound traffic from the web server IP (10.0.1.10) to the database server IP (10.0.2.10) on TCP 3306.. The firewall logs show that outbound traffic from the web server (10.0.1.10) to the database server (10.0.2.10) on TCP 3306 is being denied, which causes the database errors. Since the web server initiates the connection to the database, a rule allowing this specific outbound traffic from the web server to the database server on port 3306 restores functionality while maintaining the default-deny posture. This is the most secure approach because it permits only the necessary traffic between the two specific hosts and port, without opening broader access.

Answer

Create a rule allowing inbound traffic on TCP 3306 to the database server from any source.

Answer

Move the database server to the DMZ to avoid firewall restrictions.

Answer

Create a rule allowing all outbound traffic from the DMZ to the internal network.

Question 5

A security policy states that all portable media must be encrypted. An employee loses a USB drive containing customer data. The drive was encrypted with AES-256. Which of the following is true regarding policy compliance?

Accepted Answer

The policy was followed, but the incident still needs to be reported per incident response procedures. The security policy mandates encryption for portable media, and AES-256 encryption was applied to the USB drive, so the policy was technically followed. However, the loss of a device containing customer data still triggers incident response procedures, as the encryption key or the possibility of decryption could be compromised, and reporting is required to assess risk and comply with breach notification laws.

Answer

The employee violated policy because the drive was lost

Answer

The policy was followed because the data was encrypted, so a breach is not reportable

Answer

Encryption is not sufficient, the employee should have used a different media

Question 6

An organization uses Windows 10 Enterprise workstations with standard user accounts (no local admin). Users run daily tasks including web browsing, document editing, and accessing a corporate intranet. Recently, the security team detected anomalous outbound traffic from one workstation to an IP address in a foreign country. The workstation's host-based firewall shows that a process named 'svch0st.exe' initiated the connection. Additionally, a scheduled task named 'UpdateTask' runs every hour with SYSTEM privileges, executing a script from a hidden folder. The user reports no unusual behavior except occasional system slowdowns. The analyst must determine the best immediate course of action. Which action should the analyst take first?

Accepted Answer

Disable the scheduled task and terminate the svch0st.exe process, then collect a forensic image of the workstation for further analysis. The immediate priority is to contain the threat by disabling the scheduled task and terminating the malicious process (svch0st.exe) to stop further outbound communication, while preserving the system state for forensic analysis. Collecting a forensic image ensures that evidence (e.g., the script, scheduled task artifacts, and network logs) is not destroyed, allowing the security team to perform root-cause analysis and determine the full scope of the compromise. This approach balances containment with evidence preservation, which is critical in incident response.

Answer

Run an antivirus scan and if nothing is found, ignore the alert as a false positive

Answer

Immediately disconnect the workstation from the network and perform a full system restore from a known good backup

Answer

Delete the scheduled task and the script from the hidden folder, then reboot the workstation

Question 7

A security analyst is selecting a symmetric encryption algorithm for encrypting data at rest. Which of the following is a suitable symmetric algorithm?

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric block cipher, meaning it uses the same key for both encryption and decryption, making it suitable for encrypting data at rest. It is widely adopted, standardized by NIST, and available in 128-, 192-, and 256-bit key lengths. AES is the de facto standard for symmetric encryption in modern systems.

Answer

ECC

Answer

RSA

Answer

SHA-256

Question 8

An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?

Accepted Answer

Use a write blocker when creating the forensic image. A write blocker prevents any writes to the original drive, preserving its integrity during imaging. Option D is correct because computing a cryptographic hash (e.g., SHA-256) of the original drive before imaging creates a digital fingerprint that can be used later to verify that the forensic image is an exact copy and that no alterations occurred during acquisition or analysis. Both actions are essential to maintain evidence integrity and admissibility.

Answer

Store the original drive in a Faraday bag

Answer

Copy files directly to an external drive using the operating system

Answer

Boot the system from the hard drive to collect volatile data

Question 9

An analyst finds an unknown scheduled task on a Windows system that runs a PowerShell script at system startup. Which tool is best for examining the task's trigger and actions?

Accepted Answer

Task Scheduler. Task Scheduler is the native Windows tool that displays scheduled tasks along with their triggers (e.g., 'At system startup') and actions (e.g., running a PowerShell script). It provides a GUI and command-line interface (schtasks) to inspect, modify, or disable suspicious tasks, making it the best fit for examining the task's configuration.

Answer

Services.msc

Answer

Event Viewer

Answer

Registry Editor

Question 10

An attacker sends an email posing as the company's IT department, asking employees to click a link and enter their credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. B is correct because the attack uses email as the delivery vector to trick recipients into revealing credentials, which is the classic definition of phishing. Phishing is a broad category of social engineering that employs deceptive electronic communications (typically email) to steal sensitive information.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 11

An analyst receives an alert for 'ET WEB_SERVER Possible SQL Injection Attempt' triggered by a URL parameter containing ' OR 1=1--'. After investigating, the analyst confirms that the web application is not vulnerable to SQL injection and the request was a benign test. How should this alert be classified?

Accepted Answer

False positive. A false positive occurs when an alert is triggered but the activity is actually benign. Here, the SQL injection attempt was a benign test and the application is not vulnerable, so the alert is a false positive. This classification is correct because the detection system incorrectly flagged legitimate activity as malicious.

Answer

True negative

Answer

False negative

Answer

True positive

Question 12

An organization's security policy requires that all traffic between the corporate network and the internet be inspected by an IPS. However, encrypted traffic (HTTPS) cannot be inspected without breaking encryption. Which solution best meets the policy requirement?

Accepted Answer

Implement SSL/TLS interception using a proxy with a trusted certificate. SSL/TLS interception using a proxy with a trusted certificate allows the IPS to decrypt, inspect, and re-encrypt HTTPS traffic. The proxy acts as a man-in-the-middle, presenting a certificate trusted by internal clients, so the IPS can apply security policies to the decrypted content before forwarding it to the internet.

Answer

Allow all HTTPS traffic without inspection

Answer

Rely on endpoint security only

Answer

Disable HTTPS for internal users

Question 13

An analyst is investigating a PCAP file and wants to reconstruct a conversation between two hosts. Which Wireshark filter would be most appropriate to follow the entire TCP stream?

Accepted Answer

tcp.stream eq 0. The filter 'tcp.stream eq 0' is used in Wireshark to follow a specific TCP stream. When you right-click on a packet and select 'Follow TCP Stream', Wireshark automatically applies this filter with the appropriate stream index. This filter displays all packets belonging to that particular TCP conversation, allowing the analyst to reconstruct the entire session between the two hosts. Other filters like 'ip.addr' show all traffic to/from an IP, which may include multiple streams, and 'http.request' only shows HTTP requests, not the full stream.

Answer

dns.qry.name

Answer

ip.addr == 10.0.0.1

Answer

http.request

Question 14

In a PCAP, an analyst sees an interactive shell session over TCP with irregular command prompts and responses. Which tool was likely used to generate this traffic?

Accepted Answer

Reverse shell payload. A reverse shell payload is the correct answer because it establishes an interactive shell session where the target machine connects back to the attacker's machine, allowing the attacker to execute commands. In a PCAP, this appears as a TCP session with irregular command prompts and responses, often with small packet sizes and interactive timing. The traffic may not follow standard protocol patterns, and the commands/responses are human-readable or encoded.

Answer

File transfer tool

Answer

Port scanner

Answer

SQL injection tool

Question 15

A Windows system's security log shows Event ID 4720 followed by 4726 for the same username within minutes. What does this sequence indicate?

Accepted Answer

An account was created and then deleted, possibly for short-term unauthorized access.. Event ID 4720 indicates a user account was created, and 4726 indicates it was deleted. The short interval suggests the account was created for temporary access, possibly malicious, and then removed to cover tracks.

Answer

A user changed their password.

Answer

The account was successfully logged on.

Answer

A group membership was changed.

Question 16

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Windows Security Event ID 4720 is logged when a user account is created. It is a key indicator for detecting unauthorized account creation, which attackers use for persistence and privilege escalation. This directly matches the question.

Answer

4726

Answer

4648

Answer

4624

Question 17

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. The Preparation phase of NIST SP 800-61 Rev 2 covers establishing the incident response capability, including developing the IR plan, acquiring tools, training staff, and exercising the plan through tabletop and functional exercises. Exercising the plan before an incident occurs is explicitly a Preparation activity, not something done during or after an event.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 18

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

Accepted Answer

Multiple DNS queries to algorithmically generated domains that result in NXDOMAIN responses. DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.

Answer

Large DNS responses indicating amplification

Answer

DNS queries to a single domain with high frequency

Answer

DNS queries with long TTL values

Question 19

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

Accepted Answer

Symmetric encryption with AES. Symmetric encryption with AES transforms plaintext into ciphertext using a shared secret key, so an attacker who intercepts the data over the internet cannot read it without the key. AES is the standard, NIST-approved symmetric cipher (FIPS 197) used in TLS, VPNs, and disk encryption. This directly satisfies the requirement that intercepted data cannot be read.

Answer

Digital signature using RSA

Answer

Hash-based message authentication code (HMAC)

Answer

Hashing with SHA-256

Question 20

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Option A (/var/spool/cron/crontabs/) is correct because this is the directory where per-user crontab files are stored on Debian/Ubuntu-style systems, and attackers commonly drop a crontab entry here to run a payload under a specific user account at scheduled intervals. Option C (/etc/crontab) is correct because it is the system-wide crontab file that supports the extra user field and is a frequent target for persistence, since a malicious line added here executes with the specified user's privileges on a recurring schedule. Option B (/etc/init.d/) is not cron-based; it holds SysV init scripts for service startup, not scheduled jobs. Option D (/var/log/cron) is a log file recording cron activity, useful for detection but not a persistence location. Option E (/etc/systemd/system/) is for systemd unit files, a separate persistence mechanism from cron.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/