200-201 Practice Test 21 — 15 Questions

Question 1

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing decisions that determine the best path for data packets across interconnected networks. Protocols such as OSPF, BGP, and ICMP operate at this layer to manage routing tables and forward packets between different subnets or autonomous systems.

Answer

Application layer

Answer

Data link layer

Answer

Transport layer

Question 2

An organization is implementing a threat intelligence sharing program. They want to exchange both structured indicators and full reports with other members of their ISAC. Which combination of standards/protocols should they choose? (Choose two.)

Accepted Answer

TAXII. STIX (Structured Threat Information Expression) is the standard for representing structured threat indicators and full reports, enabling both machine-readable indicators and human-readable context. TAXII (Trusted Automated Exchange of Indicator Information) is the transport protocol that defines how STIX content is exchanged over HTTPS. Together, they allow ISAC members to share threat intelligence in a standardized, automated manner. Snort rules are signatures for intrusion detection, not a sharing standard. OpenIOC is a format for indicators but lacks the report capability and transport protocol. MISP is a platform that can use STIX/TAXII but is not itself a standard or protocol.

Answer

Snort rules

Answer

OpenIOC

Answer

MISP

Question 3

A security analyst is investigating an alert from a Windows system log that shows multiple failed logon attempts for the same user account within a short period, followed by a successful logon. Which type of attack does this pattern suggest?

Accepted Answer

Brute-force attack. A burst of failed logons for one account followed by a success is the classic signature of a brute-force (or password-spraying) attack that eventually guessed the correct credential. Windows Security log events 4625 (failed logon) repeated, then 4624 (successful logon), from the same source within a short window confirm this. The pattern indicates the attacker iterated passwords until one worked.

Answer

Pass-the-hash attack

Answer

Denial-of-service attack

Answer

Phishing attack

Question 4

An analyst is reviewing Sysmon logs on a Windows host and sees Event ID 1 (process creation) with a signed parent process but an unsigned child. The child has a CommandLine that includes 'powershell -EncodedCommand'. What is the most likely threat?

Accepted Answer

PowerShell-based malware using encoded commands to evade detection. Event ID 1 with a signed parent process and an unsigned child using 'powershell -EncodedCommand' strongly indicates PowerShell-based malware. Attackers use Base64-encoded commands to obfuscate malicious actions and bypass simple string-based detection, as the encoded payload is decoded and executed by PowerShell at runtime.

Answer

Privilege escalation attempt

Answer

Process hollowing attack

Answer

Phishing email attachment

Question 5

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

Accepted Answer

Search the SIEM for events with destination port 22 and source IP.. A SIEM indexes and correlates log data from multiple sources, allowing an analyst to quickly filter events by destination port 22 (SSH) and source IP without manually sifting through raw logs. This approach leverages the SIEM's search capabilities to retrieve only relevant events from the past hour, making it the most efficient method for targeted threat hunting.

Answer

Review all firewall logs for the past hour.

Answer

Run a packet capture on the server's network interface.

Answer

Check the server's auth.log file manually.

Question 6

Which TWO of the following are examples of malware that rely on user interaction to spread? (Select two.)

Accepted Answer

Trojan. Option C (Trojan) is correct because a Trojan horse is malware disguised as legitimate software, and it requires the user to download and execute the file before it can infect the system — the user's action is the trigger for the infection. Option D (Virus) is correct because a virus must attach itself to a host file or program and typically needs the user to run that infected file or share it (e.g., via email attachment or USB drive) for it to propagate. By contrast, Option B (Worm) is incorrect because worms self-replicate and spread across networks automatically without any user interaction. Option A (Rootkit) is incorrect because it is a stealth tool for maintaining privileged access, not a self-spreading mechanism, and Option E (Ransomware) is incorrect because it is defined by its payload (encrypting data for extortion) rather than by a user-interaction-dependent spreading method.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 7

A company processes credit card payments and must comply with a framework that mandates specific security controls for protecting cardholder data. Which compliance framework applies?

Accepted Answer

PCI DSS. PCI DSS (Payment Card Industry Data Security Standard) is the framework specifically mandated for organizations that store, process, or transmit cardholder data. It defines 12 requirement categories covering network security, access control, encryption, monitoring, and policy. Any company processing credit card payments must comply with PCI DSS.

Answer

ISO 27001

Answer

GDPR

Answer

HIPAA

Question 8

A security analyst discovers that a malicious actor is using a technique to gather information about employees by searching social media sites. Which type of attack is being performed?

Accepted Answer

Passive reconnaissance. Passive reconnaissance involves gathering information about a target without directly interacting with its systems, such as searching public social media sites for employee details. Because the attacker only observes publicly available data and does not send packets or queries to the target's infrastructure, it is classified as passive. This contrasts with active reconnaissance, which involves direct interaction (e.g., port scanning).

Answer

Active reconnaissance

Answer

Denial of Service

Answer

Social engineering

Question 9

Which THREE of the following are common types of security policies that organizations typically implement?

Accepted Answer

Data Classification Policy. A Data Classification Policy (B) is a common security policy because it defines how data is categorized (e.g., public, internal, confidential, restricted) and the handling, labeling, and protection requirements for each tier. A Password Policy (C) is a standard security policy that specifies authentication requirements such as minimum length, complexity, expiration, reuse limits, and lockout thresholds. An Acceptable Use Policy (E) is a foundational security policy that defines how employees may use organizational IT assets, networks, and data, including prohibited activities and consequences for violations. The ISO 27001 Standard (A) is not a policy but an international standard/framework for establishing an information security management system (ISMS), and a Patch Management Procedure (D) is a procedural/operational document describing steps and schedules for vulnerability remediation, not a policy type.

Answer

ISO 27001 Standard

Answer

Patch Management Procedure

Question 10

During incident response, a security analyst reviews a PCAP file and sees TCP packets with only the SYN flag set, followed by RST packets upon receiving a SYN-ACK. No connection is established. Which scanning technique is being used?

Accepted Answer

Half-open scan (SYN scan). The described behavior—sending a SYN packet, receiving a SYN-ACK, and immediately replying with an RST—is the hallmark of a half-open (SYN) scan. This technique never completes the three-way handshake, so the target does not log an established connection, making it stealthier than a full connect scan. The RST sent after the SYN-ACK terminates the handshake before it can be fully established, confirming the port is open without creating a full session.

Answer

FIN scan

Answer

Christmas tree scan

Answer

Full connect scan

Question 11

Refer to the exhibit. A host-based analyst reviews auth.log. What does the accepted password log entry indicate?

Accepted Answer

The admin account was accessed by an attacker after brute-forcing root. The log entry shows 'Accepted password for admin from 10.10.10.10 port 22 ssh2' followed by 'Failed password for root from 10.10.10.10 port 22 ssh2'. The sequence indicates that the attacker first successfully logged in as 'admin' (accepted password), then attempted to escalate privileges by brute-forcing the 'root' account. Option D correctly identifies that the admin account was accessed by an attacker who then attempted to brute-force root, as evidenced by the failed root attempts after a successful admin login.

Answer

The root account was successfully compromised

Answer

The system prevented a brute-force attack on the admin account

Answer

The admin login is legitimate because it was accepted

Question 12

A security analyst is reviewing Zeek connection logs and sees the following entry: '192.168.1.10:12345 > 10.0.0.1:80 (tcp) duration 0.001 sec, service http, bytes 60, state S0'. Based on the state 'S0', what does this indicate about the connection?

Accepted Answer

A SYN packet was sent but no reply was received.. In Zeek, S0 indicates that a SYN packet was sent but no SYN-ACK was received (connection attempt without completion). This could be part of a port scan or a half-open connection.

Answer

Data was transferred successfully and the connection closed normally.

Answer

The connection was established successfully.

Answer

The connection was reset by the remote host.

Question 13

An investigator seizes a laptop as evidence from a crime scene. At the scene, the laptop is turned on and a log file is open. What should the investigator do to preserve evidence according to chain of custody procedures?

Accepted Answer

Photograph the screen and create a forensic image. The investigator must first document the volatile state of the evidence by photographing the screen (capturing the open log file) and then create a forensic image (bit-for-bit copy) of the entire hard drive. This preserves the original data integrity and adheres to chain of custody procedures, ensuring that the evidence is not altered and can be verified later via hash verification (e.g., MD5 or SHA-256).

Answer

Close the log file and copy it to a USB drive

Answer

Shut down the laptop and remove the hard drive

Answer

Execute the log file to ensure it is legitimate

Question 14

A network administrator is tasked with creating a security policy for handling sensitive data. Which of the following is the most critical element to include?

Accepted Answer

Data classification and handling procedures.. A security policy for sensitive data must first define what data is sensitive and how it must be handled, which is exactly what data classification and handling procedures provide. Classification labels (e.g., Public, Internal, Confidential, Restricted) drive the controls, retention, encryption, and access rules that follow. Without classification, no other policy element can be consistently applied.

Answer

Detailed network topology diagrams.

Answer

List of antivirus software versions.

Answer

Vendor contact information.

Question 15

Which two are best practices for deploying network-based intrusion detection systems? (Choose two.)

Accepted Answer

Use tap or SPAN ports to ensure traffic visibility.. Network-based intrusion detection systems (NIDS) must have full visibility into network traffic to detect malicious activity. Using a network tap or a SPAN (Switched Port Analyzer) port on a switch provides a copy of all traffic traversing a segment without introducing latency or single points of failure, ensuring the sensor can inspect packets without interfering with production traffic.

Answer

Place sensors behind firewalls to reduce false positives.

Answer

Enable all signatures to maximize detection.

Answer

Use inline mode for all sensors to enable blocking.