200-201 Practice Exam 4 — 20 Questions

Question 1

A security policy requires that all endpoints have host-based firewalls enabled. A user reports that an application stopped working after a recent update. What should the analyst do?

Accepted Answer

Create an exception rule for the application.. Creating an exception maintains firewall policy while allowing the app. Option A violates policy. Option C may revert security patches. Options D and E are less direct.

Answer

Escalate to the application vendor.

Answer

Roll back the update.

Answer

Disable the host firewall for that user.

Answer

Reinstall the application.

Question 2

A SOC analyst receives an alert from the SIEM indicating a high number of outbound DNS queries from an internal host to a domain known for malicious activity. The analyst reviews the logs and finds that the host is a DNS server. What should be the analyst's first action?

Accepted Answer

Isolate the DNS server from the network and escalate to incident response.. The correct first action is to isolate the DNS server from the network and escalate to incident response. A DNS server generating outbound DNS queries to a known malicious domain indicates a likely compromise (e.g., DNS tunneling or malware command-and-control), not normal recursive resolution. Immediate containment prevents further data exfiltration or lateral movement, aligning with incident response best practices.

Answer

Check the baseline of DNS traffic to confirm it is anomalous.

Answer

Block the domain at the firewall and close the alert.

Answer

Restart the DNS service on the server and monitor.

Question 3

A security analyst notices repeated failed login attempts from a single IP address against multiple user accounts. What is the best immediate action to take?

Accepted Answer

Block the source IP address on the firewall.. Blocking the source IP address on the firewall is the best immediate action because it stops the ongoing brute-force attack at the network perimeter, preventing further authentication attempts from that IP without disrupting legitimate users. This aligns with the principle of containment before investigation, as the firewall ACL can be updated quickly to deny traffic from the offending source.

Answer

Increase logging verbosity for the authentication server.

Answer

Change all user passwords immediately.

Answer

Disable the affected user accounts.

Question 4

During memory analysis with Volatility, the 'cmdline' plugin shows a process with no command-line arguments. Which plugin could help recover the original command line if it was truncated or hidden?

Accepted Answer

cmdscan. The 'cmdscan' plugin scans the memory for command-line history that might not be captured by cmdline. It can recover previously typed commands.

Answer

consoles

Answer

malfind

Answer

dlllist

Question 5

An analyst is analyzing a PCAP and sees multiple ICMP port unreachable responses from a target host when scanning UDP ports. What does this indicate about the scanned ports?

Accepted Answer

The ports are closed.. When a UDP scan sends a packet to a closed port, the target responds with an ICMP port unreachable message.

Answer

The scan is a SYN scan.

Answer

The ports are filtered by a firewall.

Answer

The ports are open.

Question 6

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

Accepted Answer

Perform initial triage and prioritize the incident based on severity and impact.. According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Answer

Disconnect the server from the network immediately to contain the threat.

Answer

Escalate the incident to Tier 3 for advanced malware analysis.

Answer

Notify legal counsel and PR to prepare for potential data breach.

Question 7

A security analyst is reviewing firewall logs and notices a rule that denies traffic from source IP 10.0.0.5 to destination port 3389. What service is being blocked?

Accepted Answer

RDP. Port 3389 is the default port for Remote Desktop Protocol (RDP), which is used for remote graphical desktop access to Windows systems. The firewall rule denying traffic from 10.0.0.5 to this port blocks RDP connections, preventing that host from initiating remote desktop sessions.

Answer

SNMP

Answer

SMTP

Answer

SSH

Question 8

A security administrator needs to ensure that data transmitted between a web browser and a web server is encrypted. Which technology should be implemented?

Accepted Answer

TLS. TLS (Transport Layer Security) is the correct technology because it operates at the transport layer and provides encryption for data in transit between a web browser and a web server. HTTPS is not a separate encryption protocol but rather HTTP over TLS, meaning TLS is the underlying technology that actually performs the encryption. Therefore, the question asks for the technology to implement, and TLS is the direct answer.

Answer

HTTPS

Answer

SSH

Answer

IPsec

Question 9

During an incident response, the SOC needs to determine the scope of a compromise by identifying all hosts that communicated with a known malicious IP in the last 30 days. Which data source would best support this analysis?

Accepted Answer

NetFlow records from the router. NetFlow records capture metadata about all IP traffic flows traversing a router, including source and destination IP addresses, ports, and timestamps. This allows the SOC to query for any host that communicated with the known malicious IP over the past 30 days, providing a complete picture of the compromise's scope. Unlike logs that only record denied traffic or administrative events, NetFlow records all successful communications, making it the ideal data source for this analysis.

Answer

SNMP traps from routers

Answer

Syslog from the DHCP server

Answer

Firewall deny logs

Question 10

In a Zeek/Bro log, an analyst observes a connection with 'service' field set to 'dns' and 'query' field containing a long, random-looking subdomain. This could be indicative of which type of activity?

Accepted Answer

DNS tunneling for data exfiltration. A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

Answer

DNS amplification attack

Answer

DNS cache poisoning

Answer

Normal DNS resolution for a legitimate service

Question 11

An analyst is investigating a Linux system and wants to view the current network connections. Which command is most appropriate to list listening TCP ports along with the associated processes?

Accepted Answer

ss -tlnp. The 'ss' command with options -t (TCP), -l (listening), -n (numeric), -p (process) shows listening TCP ports and the corresponding processes.

Answer

netstat -anp

Answer

cat /proc/net/tcp

Answer

lsof -i TCP

Question 12

Which type of malware is designed to spread automatically across networks without user interaction?

Accepted Answer

Worm. A worm is a standalone malware program that replicates itself to spread to other computers over a network, often exploiting vulnerabilities without any user intervention. Unlike viruses, worms do not require a host file or user action to propagate, making them capable of rapid, automated spread across networks.

Answer

Ransomware

Answer

Virus

Answer

Trojan

Question 13

A SIEM correlation rule triggers an alert when more than 10 failed login attempts from the same source IP occur within 60 seconds. Which attack is this rule designed to detect?

Accepted Answer

Brute force attack. This SIEM rule detects a brute force attack by correlating a high volume of failed login attempts (more than 10) from the same source IP within a short time window (60 seconds). Brute force attacks rely on rapid, repeated authentication attempts to guess credentials, and this threshold-based correlation is a classic detection method for such behavior.

Answer

Phishing attack

Answer

Man-in-the-middle

Answer

SQL injection

Question 14

A security analyst is reviewing the company's incident response plan. The plan states that 'all incidents must be contained within 30 minutes.' During a recent ransomware incident, the analyst identified the affected systems but could not contain them because the containment procedures required manual steps that took over an hour. What is the most likely gap in the plan?

Accepted Answer

The plan does not provide automated containment options.. The plan's requirement to contain incidents within 30 minutes is unachievable because the containment procedures rely solely on manual steps that take over an hour. The most likely gap is the absence of automated containment options, such as pre-configured firewall ACLs, host-based IPS policies, or SOAR playbooks that can isolate affected systems in seconds. Without automation, the response time objective (RTO) for containment is fundamentally mismatched with the procedural capability.

Answer

The ransomware was too sophisticated.

Answer

The analyst lacked proper training.

Answer

The analyst did not have proper authorization.

Question 15

Which TWO of the following are typically included in a security policy's scope statement?

Accepted Answer

List of systems and networks covered. The scope statement of a security policy defines the boundaries of the policy's applicability. Option C is correct because explicitly listing the systems and networks covered ensures that all stakeholders understand which assets fall under the policy's requirements, preventing gaps or overlaps in security controls.

Answer

Threat intelligence sources to be used

Answer

Encryption algorithms to be used

Answer

Minimum password length requirements

Question 16

A company's security policy prohibits the use of shared accounts. However, a legacy application requires a shared administrative account to run. What is the best approach?

Accepted Answer

Use a privileged access management solution to control and monitor the shared account. A privileged access management (PAM) solution allows the shared administrative account to be used while enforcing security controls. PAM tools can vault the shared credentials, require check-in/check-out workflows, rotate passwords automatically, and provide full session recording and auditing. This satisfies the security policy's prohibition on shared accounts by eliminating direct shared access and replacing it with monitored, temporary, and revocable privileged sessions.

Answer

Create a policy exception

Answer

Disable the application

Answer

Ignore the policy because it's a legacy system

Question 17

An analyst needs to collect volatile data from a live host before performing a memory dump. Which data is most volatile?

Accepted Answer

Network connections. Network connections are the most volatile data because they change rapidly as packets flow and sessions are established or torn down. In live response, the current state of TCP/UDP connections (e.g., via netstat -ano) can be lost the instant the system is powered off or the network cable is pulled, making them more ephemeral than registry data, file system metadata, or event logs.

Answer

Registry data

Answer

File system metadata

Answer

Event logs

Question 18

A security analyst is reviewing IDS alerts and notices multiple TCP resets sent from an internal host with IP 10.10.10.25 to various external IPs on port 443. The alerts indicate that these resets occur immediately after the corresponding SYN-ACK from the external server, before any data exchange. The analyst suspects a TCP reset attack. Which action is most likely occurring?

Accepted Answer

An attacker is spoofing the client IP to send forged RST packets.. The described behavior—TCP RST packets sent immediately after the SYN-ACK, before any data exchange, from an internal host to multiple external IPs on port 443—is characteristic of a TCP reset attack. In this attack, an adversary spoofs the source IP of the legitimate client (10.10.10.25) and sends forged RST segments to the external servers, causing them to abort the TCP handshake prematurely. This prevents the completion of the three-way handshake and disrupts the connection before any application data can be exchanged.

Answer

A firewall is sending RST packets to block outbound traffic.

Answer

A client is properly closing a session after receiving data.

Answer

The client is retransmitting lost TCP segments.

Question 19

During an incident response, an analyst extracts a suspicious file and computes its MD5 hash: d41d8cd98f00b204e9800998ecf8427e. Upon checking a threat intelligence feed, this hash is known as a malicious indicator. What does this hash represent?

Accepted Answer

A false positive; the hash corresponds to an empty file.. The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.

Answer

An invalid hash; the file may be corrupt.

Answer

A known malicious executable that should be quarantined.

Answer

A hash of a benign system file.

Question 20

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location