200-201 Practice Test 23 — 15 Questions

Question 1

During which phase of the NIST SP 800-61 Rev 2 incident response process would the incident response team conduct initial triage and determine whether an event qualifies as an incident?

Accepted Answer

Detection and Analysis. Initial triage and identification of incidents occur in the Detection and Analysis phase.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 2

A SOC analyst is tuning a SIEM correlation rule to detect port scanning. The rule should generate an alert when a single source IP connects to many different destination ports on multiple hosts within a short time. Which THREE conditions should be included in the rule?

Accepted Answer

Count of unique destination IPs > threshold. Option A is correct because a port scan is characterized by one source touching many distinct targets, so counting unique destination IPs above a threshold captures the horizontal spread across multiple hosts required by the rule. Option C is correct because the scenario specifies a single source IP, and grouping or filtering on that single source is what ties the many connections together as one scanning event rather than unrelated traffic. Option E is correct because counting unique destination ports above a threshold detects the vertical sweep of many ports, which is the defining signature of port scanning. Option B is not required because scans can target any port range, not just well-known ports, so restricting to well-known ports would miss scans of high or ephemeral ports. Option D is not appropriate because port scans typically involve small, often single-packet connections, so a high average packet count per connection would indicate data transfer or a different behavior, not scanning.

Answer

Destination port is well-known

Answer

Average packet count per connection is high (e.g., >100)

Question 3

Refer to the exhibit. A security analyst is reviewing the ASA configuration. Which traffic will be permitted from the outside interface?

Accepted Answer

TCP traffic to host 10.1.1.1 on port 80. The ASA configuration shown includes an access-list entry that permits TCP traffic from any source to host 10.1.1.1 on port 80. This is the only rule that explicitly allows traffic from the outside interface to the inside network, and since the outside interface has the access-group applied inbound, only traffic matching this permit statement will be allowed.

Answer

Any IP traffic to host 10.1.1.1

Answer

All traffic from the outside to the inside network

Answer

HTTP traffic from internal hosts to the outside

Question 4

A security analyst is analyzing a suspicious PE file. Using a hex editor, the analyst sees the ASCII string 'MZ' at the beginning. What does this indicate?

Accepted Answer

The file is a Windows Portable Executable. The ASCII string 'MZ' at the beginning of a file is the DOS MZ header signature, which identifies the file as a Windows Portable Executable (PE) or a DOS executable. 'MZ' stands for Mark Zbikowski, the Microsoft engineer who designed the format. This signature is the first two bytes of every PE file and is used by Windows loaders to recognize executable images.

Answer

The file is a plain text file

Answer

The file is a Linux ELF binary

Answer

The file is a PDF document

Question 5

An analyst is examining a Linux server and notices an unusual systemd service that starts automatically. Which command would be used to disable this service?

Accepted Answer

systemctl disable servicename. The 'systemctl disable' command prevents a service from starting automatically at boot.

Answer

systemctl stop servicename

Answer

systemctl remove servicename

Answer

systemctl mask servicename

Question 6

A security analyst is analyzing a memory dump from a compromised Windows system using Volatility. Which command would best reveal hidden or injected code within a process?

Accepted Answer

vol.py malfind. The vol.py malfind command in Volatility scans process memory for hidden or injected code by looking for memory regions with suspicious characteristics, such as executable permissions and no corresponding file on disk. It is specifically designed to detect code injection and rootkit-like behavior. This makes it the best choice for revealing hidden or injected code within a process.

Answer

vol.py netscan

Answer

vol.py pslist

Answer

vol.py dlllist

Question 7

During an incident investigation, the IR team collects evidence from a compromised server. The evidence must be admissible in court. Which documentation is essential to maintain the chain of custody?

Accepted Answer

A log of who accessed the evidence and when. Chain of custody documentation must include a log of who accessed the evidence, when, and for what purpose, to ensure integrity and admissibility in court. This log creates an auditable trail that proves the evidence has not been tampered with. Without it, the evidence may be deemed inadmissible.

Answer

The CVSS score of the vulnerability

Answer

A copy of the incident response plan

Answer

The organization's acceptable use policy

Question 8

Which element of the CIA triad ensures that data cannot be modified by unauthorized parties?

Accepted Answer

Integrity. Integrity is the CIA triad element that ensures data has not been altered or tampered with by unauthorized parties. It guarantees that information remains accurate, complete, and trustworthy throughout its lifecycle, typically enforced through hashing, checksums, digital signatures, and access controls.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Question 9

Which Windows artifact stores evidence of file execution, including the path and run count, and is located in C:\Windows\Prefetch?

Accepted Answer

Prefetch files. Windows Prefetch files, stored in C:\Windows\Prefetch with a .pf extension, record evidence of program execution including the executable path, run count, and timestamps of recent executions. Forensic analysts use them to prove that a binary ran on a system and how many times. This directly matches the artifact described in the question.

Answer

Windows Event Logs

Answer

Registry hives

Answer

Scheduled tasks

Question 10

An organization's security policy defines acceptable use of corporate email. Which THREE of the following actions are typically prohibited?

Accepted Answer

Sending personal emails using the corporate account.. Option C is correct because sending personal emails through a corporate account violates acceptable use policies, which restrict company resources to business purposes and expose the organization to liability and data leakage. Option D is correct because forwarding corporate email to personal external accounts exfiltrates potentially confidential or regulated data outside the organization's controlled environment, a common policy prohibition. Option E is correct because transmitting sensitive customer data without encryption breaches data protection requirements (e.g., GDPR, HIPAA, PCI DSS) and typical acceptable use policies mandating encryption for sensitive information. Option A does not belong because subscribing to personal newsletters is a minor personal use that many policies tolerate or address separately, not a typical outright prohibition. Option B does not belong because emailing IT support for assistance is a legitimate business use of corporate email and is never prohibited.

Answer

Using email to subscribe to personal newsletters.

Answer

Emailing the IT support for assistance.

Question 11

An analyst is investigating a Linux host and runs 'cat /proc/1234/cmdline'. What information does this provide?

Accepted Answer

The command line and arguments used to start the process. The file /proc/1234/cmdline is a pseudo-file exposed by the Linux kernel's procfs for the process with PID 1234. Reading it returns the exact command line and arguments that were passed to execve() when the process was started, with arguments separated by NUL bytes. This is why 'cat' often shows the arguments run together — the NUL separators are not rendered as visible characters.

Answer

The memory map of the process

Answer

The environment variables of the process

Answer

The current working directory of the process

Question 12

In the MITRE ATT&CK framework, TTPs are mapped to:

Accepted Answer

Real-world threat groups. MITRE ATT&CK maps Tactics, Techniques, and Procedures (TTPs) to specific real-world threat groups (also called Advanced Persistent Threats or APTs). Each technique page in ATT&CK lists the known threat actors that have been observed using it, allowing defenders to attribute behaviors and prioritize defenses against groups targeting their industry. This threat-group-centric mapping is what distinguishes ATT&CK from a pure technique catalog.

Answer

Vulnerability databases

Answer

Compliance standards

Answer

Network protocols

Question 13

An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)

Accepted Answer

ROP gadgets. Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.

Answer

NOP sled

Answer

Heap spray

Answer

DNS tunnelling

Question 14

An attacker uses a tool to scan all IP addresses in a range to identify which hosts are online and what services are running. Which type of reconnaissance is this?

Accepted Answer

Active reconnaissance. Active reconnaissance involves directly interacting with the target system to gather information, such as scanning IP addresses to identify live hosts and open services. This type of scanning generates traffic that can be detected by the target, distinguishing it from passive reconnaissance.

Answer

Denial of Service

Answer

Passive reconnaissance

Answer

Social engineering

Question 15

During packet analysis in Wireshark, which THREE findings are indicators of potential malicious activity? (Choose THREE.)

Accepted Answer

An unusually large ICMP echo request packet (e.g., 65,000 bytes).. Option B is correct because an ICMP echo request of roughly 65,000 bytes is abnormally large for a standard ping (normally 32–64 bytes of payload), indicating possible ICMP tunneling, data exfiltration, or a Ping of Death-style attack. Option C is correct because credentials transmitted in cleartext over HTTP can be captured by anyone sniffing the traffic, which is a clear sign of insecure and potentially malicious credential harvesting or a policy violation. Option E is correct because a flood of TCP SYN packets to multiple ports on a single host is the classic signature of a port scan (e.g., SYN scan), often a precursor to exploitation. Option A is not an indicator because HTTPS to a well-known website is normal, expected, encrypted traffic. Option D is not an indicator because a routine DNS query for a common domain is ordinary network behavior and not inherently suspicious.

Answer

An HTTPS connection to a well-known website.

Answer

A normal DNS query for a common domain.