200-201 Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. A security analyst reviews the configuration of a router and notices the access list applied to the internal interface. Which traffic from the source network 10.0.0.0/8 will be permitted? (Assume typical web traffic.)

Accepted Answer

HTTP and HTTPS traffic only. Option A is correct because the ACL permits TCP traffic from 10.0.0.0/8 to any destination on ports 80 (HTTP) and 443 (HTTPS). Option B is wrong because only these two ports are permitted. Option C is wrong because it permits only HTTP and HTTPS. Option D is wrong because both HTTP and HTTPS are allowed.

Answer

All TCP traffic

Answer

All IP traffic from 10.0.0.0/8

Answer

Only HTTP traffic

Question 2

A security analyst at a medium-sized enterprise notices that an employee's workstation has been sending outbound traffic to a known malicious IP address at irregular intervals. The analyst runs a scan and finds no malware signatures. What should the analyst do next?

Accepted Answer

Escalate to the incident response team for further investigation.. Option C is correct because the situation suggests a potential advanced threat that requires specialized team. Disconnecting prematurely might destroy evidence. Blocking IP alone does not address the root cause. Reviewing history is part of investigation but escalation is the best next step.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Review the employee's recent web browsing history and email attachments.

Answer

Immediately disconnect the workstation from the network and reimage it.

Question 3

A company's security policy requires that all servers have host-based intrusion detection (HIDS) installed and configured to send alerts to the SIEM. During a routine check, you find that a critical database server has HIDS installed but is not sending alerts because the agent service is stopped. The server administrator says he stopped the service because it was using too much CPU. The policy requires that any deviation from baseline must be approved by the security team. What should you do?

Accepted Answer

Restart the service on the server and submit a change request for CPU optimization.. Option A is correct because restarting the service and submitting a change request for CPU optimization addresses the immediate non-compliance while working on a solution. Option B is too lenient; Option C is too harsh; Option D may not solve the CPU issue and bypasses approval.

Answer

Accept the server administrator's justification and document it.

Answer

Recommend setting the HIDS process priority to low to reduce CPU impact.

Answer

Report the non-compliance to the security manager and disable the server until compliance is restored.

Question 4

A Cisco Firepower sensor is generating a high number of false positives from a rule that triggers on large ICMP packets. The analyst suspects the rule threshold is too low. Which tuning action most effectively reduces false positives while maintaining detection of actual attacks?

Accepted Answer

Increase the packet size threshold.. Increasing the packet size threshold (Option D) directly addresses the root cause of the false positives: the rule is triggering on legitimate large ICMP packets that are below the actual attack size. By raising the threshold to a value that still captures known attack vectors (e.g., ICMP echo requests exceeding 65,535 bytes in a fragmented attack), the sensor reduces noise while preserving detection of true malicious oversized packets. This is the most effective tuning action because it adjusts the detection parameter without disabling or bypassing the rule.

Answer

Change the rule action from alert to drop.

Answer

Disable the rule entirely.

Answer

Add an exception for trusted source IPs.

Question 5

Which Windows registry hive is most likely to contain evidence of malware persistence via a service?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services registry hive stores the configuration for all Windows services, including their executable paths and startup types. Malware often installs itself as a service to achieve persistence, and evidence of this can be found by examining the ImagePath value under a suspicious service subkey. This is the correct location for service-based persistence, unlike the Run keys which handle startup programs for users.

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SAM

Question 6

An analyst reviews the Cisco ASA syslog message shown in the exhibit. What does this entry indicate?

Accepted Answer

An attempted connection from an external host to an internal web server that was blocked by the firewall. The syslog message shows a deny action for an HTTP connection (port 80) from an external IP (outside) to an internal IP (inside). The '%ASA-4-106023' message indicates a packet was denied by the firewall's access control list (ACL). This matches the scenario of an attempted external-to-internal web connection being blocked, which is option C.

Answer

A successful HTTP connection from the outside to the inside server

Answer

A VPN tunnel initiation that was rejected due to authentication failure

Answer

A NAT translation failure for an outbound connection

Question 7

Which Windows registry hive contains user-specific configuration settings that can be modified by applications?

Accepted Answer

HKEY_CURRENT_USER. HKEY_CURRENT_USER (HKCU) is the correct answer because it stores user-specific configuration settings, such as desktop preferences, environment variables, and application settings, that are loaded from the NTUSER.DAT file when a user logs in. Applications modify this hive to persist per-user customizations, making it the primary location for user-level registry changes.

Answer

HKEY_CLASSES_ROOT

Answer

HKEY_LOCAL_MACHINE

Answer

HKEY_USERS

Question 8

Which THREE of the following are common evasion techniques used by attackers?

Accepted Answer

Slow scans. Slow scans are a common evasion technique used by attackers to avoid detection by intrusion detection systems (IDS) and intrusion prevention systems (IPS). By sending packets at a very low rate, often over hours or days, the scan falls below the threshold of time-based detection algorithms that trigger alerts on rapid port sweeps. This technique exploits the fact that many security devices rely on timing heuristics to identify reconnaissance activity.

Answer

Using high ports

Answer

Patching vulnerabilities

Question 9

Refer to the exhibit. A security analyst notices repeated login failures. According to the company's security policy, what action should be taken?

Accepted Answer

Investigate for brute force attack. Repeated login failures are a classic indicator of a brute-force attack, where an attacker attempts to guess credentials by trying many passwords. The security policy should require investigation to confirm the attack pattern (e.g., frequency, source, target accounts) before taking irreversible actions like blocking or disabling. Option C is correct because it follows the principle of verify-then-act, aligning with incident response procedures.

Answer

Block the source IP at the firewall

Answer

Ignore because it's only three failures

Answer

Disable the user account

Question 10

A company is creating an incident response policy. Which TWO elements should be included to ensure proper handling of security incidents?

Accepted Answer

Contact information for law enforcement. Option A is correct because an incident response policy must include contact information for law enforcement to ensure timely reporting of crimes such as data breaches or ransomware attacks, as required by regulations like GDPR or state breach notification laws. This enables proper legal handling and chain-of-custody preservation. Option C is correct because a step-by-step procedure for containment, eradication, and recovery is the core operational framework of the NIST SP 800-61 incident response lifecycle, ensuring consistent and effective response actions.

Answer

A list of employee performance metrics

Answer

A schedule for quarterly vulnerability scans

Answer

List of approved vendors for forensic tools

Question 11

An analyst needs to review the Windows event logs from a host to determine if a user's account was used to log in at an unusual time. Which log type should the analyst check?

Accepted Answer

Security. The Security log in Windows Event Viewer records audit events, including successful and failed logon attempts (Event ID 4624 for successful logons). This log type is the correct source for determining if a user's account was used to log in at an unusual time, as it captures the timestamp and details of each authentication event.

Answer

Application

Answer

System

Answer

Setup

Question 12

A company's endpoint detection and response (EDR) agent is reporting a file that was created with a name matching a known ransomware pattern. The analyst suspects the file is malicious. What is the best first step to contain the threat?

Accepted Answer

Isolate the host from the network. Isolating the host from the network is the best first step because it immediately stops the ransomware from communicating with its command-and-control (C2) server and prevents lateral movement to other systems. The EDR agent has already flagged the file as suspicious, so the priority is containment, not further analysis or deletion, which could trigger the ransomware to encrypt data. Network isolation breaks the attack chain at the host level, buying time for forensic analysis and remediation.

Answer

Create a new firewall rule

Answer

Run a full antivirus scan

Answer

Delete the file

Question 13

An analyst is performing host-based analysis on a machine that is part of a botnet. The machine is communicating with a C2 server over HTTPS. Which host-based evidence would be most useful to identify the C2 communication?

Accepted Answer

DNS logs showing queries to the C2 domain. Option C is correct because DNS logs can reveal the domain name used for C2 communication even when the traffic is encrypted over HTTPS. Since the analyst is performing host-based analysis, DNS query logs on the host itself (e.g., from the DNS client service or a local DNS resolver) will show the host attempting to resolve the C2 domain, providing a direct indicator of the C2 server's address without needing to decrypt the HTTPS traffic.

Answer

Packet capture showing the unencrypted payload

Answer

A memory dump of the process showing encryption keys

Answer

Windows Event ID 5157 (Filtering Platform connection) showing the process ID

Question 14

A security analyst notices that a workstation is generating multiple DNS queries to a known malicious domain. Which host-based analysis technique would be most effective in confirming the infection?

Accepted Answer

Use Process Explorer to examine the process responsible for the DNS queries. Process Explorer is a host-based analysis tool that provides detailed information about running processes, including their network connections and DNS queries. By examining the process responsible for the DNS queries to the known malicious domain, the analyst can directly identify the infected executable or script, confirming the infection at the process level.

Answer

Review the Windows Firewall logs to see blocked connections

Answer

Check the scheduled tasks for suspicious entries

Answer

Analyze the Windows Event Log for Event ID 5156

Question 15

Which TWO are common sources of security event data in a Security Information and Event Management (SIEM) system?

Accepted Answer

NetFlow records. NetFlow records (B) are a common source of security event data in a SIEM because they provide detailed metadata about network flows, including source/destination IPs, ports, protocols, and byte counts. SIEMs ingest NetFlow to detect anomalies, such as data exfiltration or beaconing, by analyzing flow patterns rather than full packet payloads. This makes NetFlow a standard telemetry source for network visibility and threat hunting.

Answer

SMTP logs

Answer

SNMP traps

Answer

DNS queries

200-201 Practice Test 23 — 15 Questions

Exhibit

200-201 Practice Test 23 — 15 Questions

Exhibit