200-201 Practice Test 22 — 15 Questions

Question 1

Which role in the incident response process is primarily responsible for determining the business impact of an incident and making strategic decisions?

Accepted Answer

CISO. The CISO is the decision-maker who evaluates business impact and approves major actions.

Answer

HR

Answer

Legal counsel

Answer

Incident handler

Question 2

After containing a security incident, the incident response team eradicates the malware and restores systems from clean backups. Which phase of the NIST SP 800-61 Rev 2 process does this represent?

Accepted Answer

Containment, Eradication, and Recovery. Eradication removes the threat, and recovery restores normal operations.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Detection and Analysis

Question 3

Which TWO of the following are best practices for configuring syslog in a secure monitoring environment? (Choose two.)

Accepted Answer

Configure a maximum log file size to prevent disk exhaustion. Option C is correct because configuring a maximum log file size (via log rotation parameters such as maxsize in rsyslog or size in logrotate) prevents a single log file from consuming all available disk space, which would otherwise cause a denial of service on the logging host. Option E is correct because forwarding syslog messages to a centralized log server over a dedicated management network isolates log traffic from user and production traffic, protects log integrity, and ensures logs survive a compromise of the source host. Option A is wrong because UDP is connectionless and unreliable; syslog over UDP can silently drop messages, so TCP or TLS (e.g., rsyslog's omfwd with TLS) is preferred for reliable, secure delivery. Option B is wrong because overwriting log files daily destroys audit evidence and breaks retention and forensic requirements; logs should be rotated and archived, not simply overwritten. Option D is wrong because security by obscurity is not a best practice, and changing the default syslog port (514/udp, 514/tcp) can break interoperability with standard collectors without providing real protection.

Answer

Use UDP as the transport protocol to ensure reliable delivery

Answer

Set log files to overwrite daily

Answer

Change the default syslog port to avoid detection by attackers

Question 4

You are analyzing network traffic from a compromised host. The host is running Windows and is connected to a corporate network. The IDS generated an alert for a known malware signature matching traffic from the host to an external IP on port 443. However, you see that the traffic is encrypted and the destination IP is a cloud storage provider. The host also shows periodic DNS queries to a domain that closely resembles the cloud provider's domain but with a single character difference (typosquatting). The employee on that host reports no unusual activity. Which step should you take first to confirm the compromise?

Accepted Answer

Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.. Correlating DNS logs with encrypted traffic timestamps is the fastest, least intrusive way to confirm whether the host actually communicated with the typosquatted domain. If the DNS query for the lookalike domain resolved just before the encrypted session to the external IP, it strongly indicates the malware is using the typosquatted domain for command-and-control (C2) over HTTPS, bypassing simple domain-based blocklists. This step validates the alert without requiring decryption or assuming user reports are reliable.

Answer

Dismiss the alert as a false positive because the user reports no issues.

Answer

Examine the full packet capture for the encrypted session to see the payload.

Answer

Enable SSL/TLS decryption on the corporate firewall to inspect the encrypted traffic.

Question 5

During a vulnerability assessment, a security team discovers that a web application allows users to upload files without proper validation. An attacker could upload a malicious file and execute it on the server. Which type of vulnerability is this?

Accepted Answer

Remote code execution (RCE). The vulnerability allows an attacker to upload a malicious file (e.g., a web shell) and then execute it on the server, which is the definition of remote code execution (RCE). This occurs because the application fails to validate file types, contents, or execution permissions, enabling arbitrary code to run in the server's context.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Insecure direct object reference

Question 6

A system administrator needs to grant access to a database for a new employee. According to the principle of least privilege, what should be done?

Accepted Answer

Grant only the minimum required permissions. The principle of least privilege states that users should be granted only the minimum access necessary to perform their job functions, and no more. For a new employee needing database access, the correct action is to grant only the minimum required permissions (A) — scoped to the specific database objects and operations the role demands. This limits the blast radius of compromise or error and satisfies least privilege.

Answer

Grant temporary admin access

Answer

Grant no access until manager approves

Answer

Grant full access and remove later

Question 7

During a security incident, an analyst needs to preserve network evidence for forensic analysis. Which action should be taken first?

Accepted Answer

Capture the contents of volatile memory from affected systems.. During a security incident, the first priority is to capture volatile memory (RAM) because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. Option D is correct because volatile data is ephemeral and must be collected before any action that could alter the system state, such as shutdown or isolation.

Answer

Isolate the affected systems from the network.

Answer

Create a forensic image of all hard drives.

Answer

Shut down the affected systems to prevent further damage.

Question 8

In network forensics, which Wireshark filter would be used to reconstruct a TCP conversation between two hosts?

Accepted Answer

tcp.stream eq 0. The filter `tcp.stream eq 0` isolates all packets belonging to a specific TCP stream, identified by Wireshark's internal stream index. This allows you to reconstruct the full conversation between two hosts, including the three-way handshake, data transfer, and teardown. It is the standard method for following a TCP stream in Wireshark, as it groups packets by connection rather than just IP addresses or ports.

Answer

ip.addr

Answer

http.request

Answer

dns.qry.name

Question 9

A SOC analyst is investigating a potential data exfiltration incident. Which TWO indicators from NetFlow/IPFIX analysis would most strongly suggest data exfiltration?

Accepted Answer

Connection to an IP address flagged as malicious in threat intelligence. Option B is correct because a NetFlow/IPFIX record showing a connection to an IP address flagged as malicious by threat intelligence directly ties the flow to known adversary infrastructure, which is a strong contextual indicator of exfiltration (or command-and-control) rather than benign traffic. Option D is correct because a high volume of data transferred outbound to a single external IP address is a classic exfiltration signature — large byte/packet counts in one direction toward an external destination indicate bulk data movement, consistent with stolen data being sent to an attacker-controlled host. Option A is not the strongest indicator here because consistent traffic at regular intervals more typically suggests beaconing/C2 check-ins than bulk exfiltration, and it can also reflect legitimate scheduled traffic. Option C does not belong because multiple connection attempts to various ports on the same external IP is characteristic of port scanning or reconnaissance, not data exfiltration. Option E does not belong because low-volume traffic to multiple external IPs is more consistent with normal web browsing or DNS activity and lacks the volume and concentration expected in exfiltration.

Answer

Consistent traffic at regular intervals to an external IP

Answer

Multiple connection attempts to various ports on the same external IP

Answer

Low volume of traffic to multiple external IPs

Question 10

A security analyst is reviewing logs from a web proxy and sees that a user's machine is making frequent connections to a domain that is registered recently and has a low reputation score. What is the best action?

Accepted Answer

Check if the user has a legitimate need to access the domain.. The best action is to check if the user has a legitimate need to access the domain because a recently registered domain with a low reputation score is a strong indicator of potential malicious activity, but it could also be a false positive or a legitimate new service. Security analysts must validate the context through user inquiry or additional log correlation before taking irreversible actions like blocking or disabling access. This aligns with the principle of least disruption and evidence-based decision-making in security monitoring.

Answer

Disable the user's network access.

Answer

Block the domain immediately.

Answer

Ignore because it might be a false positive.

Question 11

A SOC analyst is monitoring network traffic using Cisco Stealthwatch. An alert is generated indicating a large volume of data being transferred from a critical server to an external IP address during off-hours. The analyst observes that the data transfer is using encrypted HTTPS traffic to a cloud storage provider. The server is known to host sensitive customer data. The analyst reviews the server's outbound firewall rules and finds that HTTPS traffic to any destination is allowed. The analyst checks the server's recent login logs and sees an authentication from a user account that is typically used by a contractor who only works during business hours. The contractor's account has not been disabled after the contract ended last week. What should the analyst do first?

Accepted Answer

Investigate the alert further by checking the server for any signs of malware or unauthorized access, and then escalate to the incident response team.. The analyst should first investigate further by checking the server for signs of malware or unauthorized access, then escalate to the incident response team. This is the correct first step because the alert indicates a potential data exfiltration, but the analyst must gather additional evidence to confirm the incident and determine its scope before taking disruptive actions. Investigating the server can reveal the exact cause, such as compromised credentials or malware, and escalation ensures proper incident response procedures are followed.

Answer

Ignore the alert because the traffic is encrypted and cannot be inspected.

Answer

Immediately block the external IP address at the firewall to stop the data transfer.

Answer

Disable the contractor's user account and notify the IT manager.

Question 12

A security engineer is setting up a Snort rule to detect FTP traffic where the source IP is not from the internal network. Which Snort rule header correctly specifies the action, protocol, source, and destination?

Accepted Answer

alert tcp !$HOME_NET any -> any 21. The rule header alert tcp !$HOME_NET any -> any 21 correctly specifies: action (alert), protocol (tcp), source (!$HOME_NET, i.e., NOT the internal network), source port (any), direction (->), destination (any), and destination port (21, FTP). The ! negation operator inverts the HOME_NET variable, so the rule fires only when the source is external — exactly what the engineer wants.

Answer

alert tcp $HOME_NET any -> any 21

Answer

alert tcp any any -> any 21

Answer

alert udp any any -> any 21

Question 13

During a forensic examination of a Linux system, an analyst wants to check for persistence mechanisms. Which file or directory should be examined to find user-specific cron jobs that may have been added by an attacker?

Accepted Answer

/var/spool/cron/crontabs/. User-specific cron jobs are stored in /var/spool/cron/crontabs/ (on Debian-based systems) or /var/spool/cron/ (on Red Hat-based systems). Each user has a file named after their username containing their cron jobs. Attackers often add entries here for persistence. The other locations are for system-wide cron jobs.

Answer

/etc/cron.hourly/

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 14

Refer to the exhibit. An analyst sees repeated denied TCP connections from the same source to the same destination web server. Which of the following actions should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. Repeated denied TCP connections from the same source to the same destination web server are a classic indicator of a potential reconnaissance or attack pattern, such as a port scan or brute-force attempt. The first priority in security monitoring is to investigate the source IP for malicious activity (Option C) to determine intent and scope before taking any irreversible action. This aligns with the incident response process of identification and analysis before containment or eradication.

Answer

Increase the logging level to get more details.

Answer

Create a permit rule for the source IP to allow legitimate traffic.

Answer

Block the source IP globally.

Question 15

A SIEM correlation rule is designed to detect a brute-force attack. The rule triggers when an event includes 10 or more failed logins from the same source IP within 1 minute. An analyst sees an alert for 12 failed logins from IP 10.0.0.1 in 2 minutes. Why did the rule not trigger?

Accepted Answer

The time window is too short; the rule requires 10 failures in 1 minute, but this occurred over 2 minutes. The rule requires 10+ failures in 1 minute. In 2 minutes, the rate is 6 per minute, which is below threshold.

Answer

The source IP is not in the watch list

Answer

The rule only counts successful logins

Answer

The alert severity is too low