200-201 Practice Test 23 — 15 Questions

Question 1

A security analyst observes repeated ICMP port unreachable responses from a target host. The source IP is sending packets to multiple UDP ports. Which type of scan is most likely being performed?

Accepted Answer

UDP scan. UDP scans elicit ICMP port unreachable messages from closed ports; open ports typically do not respond.

Answer

TCP SYN scan

Answer

TCP connect scan

Answer

Ping sweep

Question 2

An organization is implementing a new remote access policy. Which of the following is a key component that should be included in this policy?

Accepted Answer

Requirements for multi-factor authentication. Remote access policies typically specify allowed methods (e.g., VPN), authentication requirements, and security controls.

Answer

Prohibition of personal device usage for any work

Answer

Mandatory use of social media for communication

Answer

Daily password changes for remote users

Question 3

An analyst identifies a PCAP with a reverse shell session. Which characteristic in the traffic would most likely indicate an interactive shell session?

Accepted Answer

Bidirectional traffic with small packets and command echo patterns. Reverse shells often exhibit bidirectional traffic with interactive patterns, such as small irregular packets and commands echoed.

Answer

Large file transfers over FTP

Answer

Periodic HTTP GET requests at regular intervals

Answer

Constant stream of UDP packets

Question 4

During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?

Accepted Answer

Delivery. The file contains shellcode and is extracted from network traffic, indicating it was delivered to the target. This aligns with the delivery phase.

Answer

Installation

Answer

Actions on Objectives

Answer

Weaponization

Question 5

A security analyst needs to share threat intelligence with other organizations in a standardized, machine-readable format. Which combination of standards should the analyst use?

Accepted Answer

STIX and TAXII. STIX is a language for threat intelligence, and TAXII is a protocol for sharing it. They are commonly used together.

Answer

TAXII and MISP

Answer

ISAC and STIX

Answer

OpenIOC and MISP

Question 6

During an incident, a forensic analyst needs to preserve evidence from a compromised hard drive. Which of the following steps is essential to maintain the chain of custody?

Accepted Answer

Documenting the date, time, and person handling the evidence. Chain of custody requires documenting each transfer, including who handled evidence and when. Write-blocking prevents alteration, and hashing verifies integrity. Documentation of transfers is key.

Answer

Deleting unnecessary files to reduce data volume

Answer

Storing the hard drive in a standard office drawer

Answer

Creating a bit-for-bit copy without write-blocking

Question 7

A PCAP contains the following patterns: (1) A TCP connection with a complete handshake to an external IP on port 443, (2) periodic data transfers every 60 seconds of approximately 1 KB, (3) the domain name in the TLS SNI field is generated by a DGA. Which THREE indicators are present?

Accepted Answer

Beaconing. Beaconing is periodic callbacks, C2 over HTTPS uses port 443, and DGA domains indicate automated C2 infrastructure.

Answer

DNS exfiltration

Answer

Port scanning

Question 8

An employee is suspected of using company resources to access inappropriate websites. Which security policy most directly addresses this behavior?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy defines acceptable use of company resources, including internet usage.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 9

Which of the following are responsibilities of the legal counsel role during incident response? (Choose two.)

Accepted Answer

Determining data breach notification requirements. Legal counsel advises on breach notification requirements and can place legal holds to preserve evidence for litigation.

Answer

Communicating with the media

Answer

Conducting technical analysis of malware

Answer

Approving financial expenditures for containment

Question 10

A security analyst is collecting evidence from a compromised system for legal proceedings. Which TWO actions are critical to preserve the integrity of the evidence?

Accepted Answer

Compute a cryptographic hash of the original drive before imaging. Write-blocking prevents modification during acquisition, and hashing verifies integrity before and after imaging.

Answer

Store the evidence in a public folder for easy access

Answer

Delete any sensitive files to protect privacy

Answer

Run the system normally to capture volatile data

Question 11

Which threat intelligence sharing standard defines a language and format for representing structured threat information, such as indicators and campaigns?

Accepted Answer

STIX. STIX is a standardized language for describing threat intelligence, while TAXII is the protocol to share it.

Answer

MISP

Answer

TAXII

Answer

OpenIOC

Question 12

While analyzing a PCAP, an analyst uses the Wireshark filter 'http.request' and finds a URI parameter containing '%27%20UNION%20SELECT%201,2,3%20--'. What type of attack is indicated?

Accepted Answer

SQL injection. The URL-encoded string decodes to a SQL injection attempt with UNION SELECT. SQL injection often appears in HTTP parameters.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Directory traversal

Question 13

A PCAP contains an HTTP POST request with a parameter containing "UNION SELECT username, password FROM users". This is evidence of:

Accepted Answer

SQL injection. SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.

Answer

Cross-site scripting

Answer

Path traversal

Answer

Command injection

Question 14

An analyst is reviewing a PCAP and sees multiple HTTP requests with the parameter 'id=1 UNION SELECT username,password FROM users'. What type of attack is being attempted?

Accepted Answer

SQL injection. The SQL keywords UNION and SELECT in a parameter indicate a SQL injection attempt to extract data from the database.

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 15

During incident response, an analyst extracts files from a PCAP using Wireshark's Export Objects feature. One extracted file is a PDF that triggers an IDS alert for 'Exploit:PDF/HeapSpray'. Which technique does this alert describe?

Accepted Answer

Heap spray. Heap spray is a memory corruption technique where an attacker fills heap memory with shellcode to increase the chance of code execution, often used in PDF exploits.

Answer

Return-oriented programming (ROP)

Answer

Shellcode injection

Answer

Stack buffer overflow