200-201 Practice Test 22 — 15 Questions

Question 1

During memory analysis with Volatility, the 'pstree' plugin shows a parent process of 'winlogon.exe' spawning 'cmd.exe'. What is the most likely explanation for this anomaly?

Accepted Answer

A debugger or persistence mechanism like Image File Execution Options has replaced sethc.exe with cmd.exe.. Normally, winlogon.exe does not spawn cmd.exe; this could indicate a 'sticky keys' (sethc.exe) persistence or other accessibility tool abuse where cmd.exe replaces the debugger.

Answer

This is a normal occurrence when a user opens cmd after logging in.

Answer

A user is running a command prompt from the Windows login screen.

Answer

The cmd.exe is a system process running under winlogon's session.

Question 2

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 3

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 4

Which TWO standards/protocols are directly associated with threat intelligence sharing as defined by the CyberOps Associate curriculum?

Accepted Answer

TAXII. STIX and TAXII are the primary standards for threat intelligence sharing. OpenIOC and MISP are related but not the core standards defined.

Answer

ISO 27001

Answer

OpenIOC

Answer

MISP

Question 5

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 6

An analyst reviews network logs and sees a large outbound FTP transfer of 500 MB from a workstation to an external IP at 2:00 AM. The workstation regularly sends 10 MB daily. What should the analyst suspect?

Accepted Answer

Data exfiltration. Large outbound data transfers outside normal patterns, especially at odd hours, are typical of data exfiltration.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Software update

Question 7

An analyst is reviewing alerts from an IDS. A signature matched 'script' and 'alert' in HTTP request parameters. The analyst inspects the packet and sees in the URI. What is the most accurate classification of this alert?

Accepted Answer

True positive. The alert corresponds to a real attack (cross-site scripting) in the traffic, so it is a true positive.

Answer

False negative

Answer

False positive

Answer

True negative

Question 8

An analyst is analyzing a PCAP from a compromised host. Which THREE of the following are common indicators of exploitation attempts in network traffic?

Accepted Answer

Return-oriented programming (ROP) gadget chains in data. Exploitation indicators include shellcode patterns (NOP sleds, ROP gadgets) and heap spray (large blocks of similar data).

Answer

Regular HTTP GET requests to a news website

Answer

DNS requests for common websites like google.com

Question 9

An analyst observes a host making outbound connections to a server on TCP port 443, with traffic patterns showing small packets at regular 60-second intervals. The destination IP is in a country where the company does no business. Which THREE characteristics suggest this is C2 beaconing?

Accepted Answer

Small packet sizes at regular 60-second intervals. Beaconing often uses HTTPS to evade detection, has periodic regular intervals, and goes to unusual destinations. Small packets at fixed intervals are classic.

Answer

Large file downloads

Answer

DNS queries for internal domains

Question 10

After resolving a security incident, the IR team conducts a lessons learned meeting. Which of the following are typical outputs of this post-incident activity? (Choose three.)

Accepted Answer

Recommendations for policy or procedure changes. Lessons learned leads to updating the IR plan, identifying metrics to measure performance, and recommending changes to policies.

Answer

Creation of new detection signatures for future incidents

Answer

Immediate containment of the incident

Question 11

An organization has implemented a new password policy requiring 12-character passwords with complexity. Which risk treatment option is this an example of?

Accepted Answer

Risk mitigation. Implementing controls to reduce risk is mitigation.

Answer

Risk transfer

Answer

Risk acceptance

Answer

Risk avoidance

Question 12

An analyst reviewing network alerts notices a rule triggered for 'ET SCAN NMAP -sU scan' based on traffic to a Linux server. The packet capture shows multiple UDP packets to various ports, and for closed ports, the server responds with ICMP Destination Unreachable (Port Unreachable). Which type of scan is being performed, and how should the analyst classify this alert?

Accepted Answer

UDP scan; true positive. UDP scans send UDP packets; closed ports respond with ICMP Port Unreachable. This matches the alert signature, indicating a true positive for a UDP scan.

Answer

TCP SYN scan; true positive

Answer

UDP scan; false positive

Answer

TCP connect scan; true negative

Question 13

An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.

Answer

Golden ticket

Answer

Kerberoasting

Answer

Pass-the-ticket

Question 14

A SOC Tier 1 analyst is processing alerts. Which THREE tasks are typical for a Tier 1 analyst? (Select three.)

Accepted Answer

Execute basic investigation using standard tools. Tier 1 tasks include alert monitoring, initial triage, and basic investigation.

Answer

Conduct deep malware analysis

Answer

Develop new detection signatures

Question 15

An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)

Accepted Answer

ROP gadgets. Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.

Answer

NOP sled

Answer

Heap spray

Answer

DNS tunnelling