200-201 Practice Test 24 — 15 Questions

Question 1

An organization is implementing a threat intelligence sharing program. Which THREE elements are commonly used standards or platforms for sharing threat intelligence?

Accepted Answer

MISP. MISP (Malware Information Sharing Platform) is correct because it is a widely used open-source threat intelligence platform that enables organizations to store, correlate, and share indicators of compromise and threat data with trusted partners. TAXII (Trusted Automated Exchange of Intelligence Information) is correct because it is the OASIS-defined application-layer protocol specifically designed to transport cyber threat intelligence over HTTPS between parties. STIX (Structured Threat Information Expression) is correct because it is the standardized language/schema used to represent cyber threat intelligence in a structured, machine-readable form, and it is commonly paired with TAXII for exchange. ISACs (Information Sharing and Analysis Centers) are sector-specific sharing organizations rather than a technical standard or platform, and OpenIOC is a proprietary Mandiant indicator format that never became a broadly adopted sharing standard, so neither belongs here.

Answer

ISAC

Answer

OpenIOC

Question 2

A security analyst is examining system logs for signs of privilege escalation. Which THREE events are most relevant to detect such activity?

Accepted Answer

Execution of commands with sudo. Option A is correct because execution of commands with sudo directly indicates a user is attempting to run processes with elevated (root) privileges, which is a primary vector for privilege escalation and should be audited via /var/log/auth.log or journalctl. Option C is correct because modification of user group memberships (e.g., adding an account to the sudo or wheel group) grants persistent elevated privileges, a classic privilege-escalation technique detectable through changes to /etc/group or usermod/gpasswd events. Option D is correct because creating a user account with administrator privileges (e.g., UID 0 or membership in an admin group) establishes a new high-privilege identity, which is a strong indicator of malicious persistence or escalation. Option B is not the best fit because multiple failed login attempts primarily indicate brute-force or password-guessing attempts against authentication, not privilege escalation after access is obtained. Option E is also not the best fit because a successful SSH login from a remote IP only shows initial remote access, without evidence that privileges were elevated on the system.

Answer

Multiple failed login attempts

Answer

Successful SSH login from a remote IP

Question 3

During forensic analysis of a Windows host, an analyst finds a file in C:\Windows\Prefetch with the name 'MALWARE.EXE-3F2A1B0C.pf'. Which type of information can be extracted from this prefetch file to assist the investigation?

Accepted Answer

The number of times the executable has been run and the last execution timestamp. Windows Prefetch files (.pf) store execution metadata for applications, including the run count and the last time the executable was executed (plus up to the last eight run timestamps on some Windows versions). This makes them a primary artifact for establishing whether and when malware ran on a host.

Answer

The file's SHA256 hash and digital signature status

Answer

The registry keys modified by the executable during execution

Answer

The command-line arguments used when the executable was launched

Question 4

Which THREE of the following are key principles of zero trust security? (Choose three.)

Accepted Answer

Least privilege. Least privilege (A) is a core zero trust principle because users, devices, and workloads are granted only the minimum access rights needed for a specific task, limiting lateral movement if an identity is compromised. 'Never trust, always verify' (C) is the foundational zero trust tenet: every access request must be authenticated and authorized based on identity, device health, context, and policy regardless of network location. Assume breach (D) is also a key zero trust principle, requiring organizations to design as if adversaries are already inside the environment, using microsegmentation, encryption, and continuous monitoring to contain and detect threats. Perimeter-based security (B) is not a zero trust principle because zero trust explicitly rejects relying on a trusted internal network boundary, and implicit trust (E) is the opposite of zero trust, which eliminates automatic trust based on network location or prior authentication.

Answer

Perimeter-based security

Answer

Implicit trust

Question 5

Which TWO are components of the NIST SP 800-61 Rev 2 Preparation phase? (Select two.)

Accepted Answer

Developing an incident response plan. NIST SP 800-61 Rev 2 places the creation of a formal, written IR plan—covering mission, goals, roles, communication paths, and escalation procedures—squarely in the Preparation phase, before any incident occurs. Option D (Creating an incident response team) is also correct because staffing and organizing the CSIRT (with defined roles, authority, and on-call procedures) is a core Preparation activity that must exist before incidents can be handled. By contrast, option A (Conducting lessons learned) belongs to the Post-Incident Activity phase, where the team reviews what happened and improves the plan. Option C (Containing the incident) is part of the Detection and Analysis/Containment, Eradication, and Recovery handling phase, not Preparation. Option E (Identifying indicators of compromise) is a Detection and Analysis activity, since IoCs are used to discover and validate incidents rather than to prepare for them.

Answer

Conducting lessons learned

Answer

Containing the incident

Answer

Identifying indicators of compromise

Question 6

A security analyst is analyzing system logs and notices multiple failed authentication events followed by a successful login from the same user account, and then a privilege escalation event. Which THREE events should be correlated to detect a potential attack?

Accepted Answer

Successful authentication event. The scenario describes a classic brute-force-then-compromise pattern, so the three events that must be correlated are C, the failed authentication events, which indicate repeated unsuccessful login attempts against the same account; A, the successful authentication event, which shows the attacker eventually guessed or cracked the credentials and gained access; and B, the privilege escalation event, which reveals that the compromised account was then used to obtain higher-level rights, confirming the attack progressed beyond initial access. Correlating these three in sequence (many failures → one success → escalation) is what distinguishes a real intrusion from benign failed logins. D (network share access) and E (account creation) are not part of the described sequence and, while potentially suspicious in other contexts, are not the events the analyst should correlate here to detect this specific attack chain.

Answer

Network share access event

Answer

Account creation event

Question 7

An analyst observes that an internal host is sending ICMP echo requests with payloads containing random data to an external IP. The payload size is larger than typical. What is the most likely technique?

Accepted Answer

ICMP tunneling. ICMP tunneling encapsulates non-ICMP data (e.g., command-and-control traffic) within ICMP echo request/reply packets. The random payload data and larger-than-typical payload size are hallmarks of this technique, as the attacker uses the ICMP protocol to bypass firewalls and exfiltrate data or establish covert communication.

Answer

Ping of death

Answer

Traceroute

Answer

Smurf attack

Question 8

A small retail company has a security policy that requires all point-of-sale (POS) systems to be isolated on a separate network segment with strict firewall rules. During a network audit, you discover that the POS system is connected to the same network as the office workstations, violating policy. The store manager says it was done for convenience because the network cable was too short. What is the best course of action?

Accepted Answer

Move the POS system to the correct network segment immediately and report the violation.. The best course of action is to immediately move the POS system to the correct network segment and report the violation, because the security policy explicitly requires isolation and the current setup exposes the POS to unnecessary risk. This action restores compliance and ensures the violation is documented for follow-up. It addresses both the technical misconfiguration and the procedural requirement to report.

Answer

Accept the risk because it's a small store.

Answer

Implement a software firewall on the POS system to compensate.

Answer

Purchase a longer cable and reconnect the POS to the correct segment.

Question 9

Which THREE of the following are best practices for implementing security logging and monitoring? (Select 3)

Accepted Answer

Define alert thresholds based on baselines. Defining alert thresholds based on baselines is a best practice because it allows the security monitoring system to distinguish between normal and anomalous behavior. By establishing a baseline of typical network traffic, CPU usage, or login patterns, you can set thresholds that trigger alerts only when deviations occur, reducing false positives and ensuring that genuine security incidents are not missed.

Answer

Minimize log retention to reduce storage costs

Answer

Log only during incident response to reduce noise

Question 10

A company is implementing a security policy to reduce risk. Which THREE activities are examples of risk mitigation? (Choose three.)

Accepted Answer

Implementing access controls. Implementing access controls (A) is a risk mitigation activity because it enforces authentication and authorization mechanisms (such as RBAC, least privilege, and MFA) that reduce the likelihood of unauthorized access to systems and data. Encrypting sensitive data (C) mitigates risk by protecting confidentiality, so even if data is intercepted or stolen, it remains unreadable without the proper cryptographic keys (e.g., AES-256). Patching vulnerabilities (E) mitigates risk by remediating known weaknesses (e.g., CVEs) that attackers could exploit, thereby reducing the attack surface. Accepting the risk without action (B) is risk acceptance, not mitigation, since no controls are applied. Purchasing cyber insurance (D) is risk transference, as the financial impact is shifted to an insurer rather than reduced through technical or administrative controls.

Answer

Accepting the risk without action

Answer

Purchasing cyber insurance

Question 11

An analyst is using Zeek to monitor network traffic. Which THREE types of logs can Zeek generate to provide visibility into application-layer activity?

Accepted Answer

smtp.log. Zeek generates smtp.log (B) to record SMTP transactions, including sender/recipient envelopes, subjects, and mail server responses, giving application-layer visibility into email traffic. dns.log (D) captures DNS queries and responses at the application layer, logging query names, record types, and answers. http.log (E) records HTTP requests and replies, including methods, URIs, host headers, user agents, and status codes, which is classic application-layer visibility. conn.log (A) is a transport/network-layer connection summary (IPs, ports, protocol, bytes, duration) and does not describe application-layer activity, while weird.log (C) logs protocol anomalies and unexpected behavior rather than normal application-layer transactions.

Answer

conn.log

Answer

weird.log

Question 12

A security analyst is reviewing PCAP data and sees a TCP stream with interactive shell commands such as 'whoami', 'ls -la', and 'cat /etc/passwd'. The session appears to be bidirectional with a remote IP. Which type of attack is most likely occurring?

Accepted Answer

Reverse shell. Interactive shell commands over TCP indicate a reverse shell, where the attacker has a command shell on the victim.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 13

A SOC Tier 1 analyst is processing alerts. Which THREE tasks are typical for a Tier 1 analyst? (Select three.)

Accepted Answer

Execute basic investigation using standard tools. Option C is correct because Tier 1 analysts perform basic investigations with standard tools such as SIEM queries, log review, and endpoint/EDR lookups to validate alerts before escalation. Option D is correct because continuous monitoring of alerts and events from sources like SIEM, IDS/IPS, and EDR is a core Tier 1 responsibility. Option E is correct because initial triage and categorization—confirming true/false positive, assigning severity, and routing to the right queue—is exactly the Tier 1 role. Option A does not belong because deep malware analysis (reverse engineering, sandboxing, code disassembly) is typically Tier 2/Tier 3 or a dedicated malware analyst function. Option B does not belong because developing new detection signatures or rules is an engineering/detection-content task, not a Tier 1 monitoring and triage duty.

Answer

Conduct deep malware analysis

Answer

Develop new detection signatures

Question 14

A SOC analyst is investigating a potential malware outbreak. Which THREE actions should the analyst take to preserve evidence? (Select three.)

Accepted Answer

Calculate a hash of the original drive before imaging. Option A is correct because calculating a cryptographic hash (e.g., MD5 or SHA-256) of the original drive before imaging establishes a verifiable baseline that proves the forensic image is an exact, unaltered copy, which is essential for evidence integrity and admissibility. Option C is correct because documenting the chain of custody records who handled, accessed, and transferred the evidence, and when, ensuring the evidence's integrity can be attested in legal or disciplinary proceedings. Option D is correct because using a hardware or software write blocker prevents any writes to the source drive while creating a forensic image, preserving the original evidence in an unmodified state. Option B is not correct because rebooting the system destroys volatile memory (RAM) contents such as running processes, network connections, and encryption keys, which are valuable evidence. Option E is not correct because running a full antivirus scan can modify or delete files and alter system state, contaminating the evidence rather than preserving it.

Answer

Reboot the system to clear memory

Answer

Run a full antivirus scan to remove malware

Question 15

A security administrator needs to verify that a downloaded file has not been altered during transit. Which cryptographic technique should be used?

Accepted Answer

Hashing. Hashing produces a fixed-size hash that changes if the file is modified, allowing integrity verification.

Answer

Public key encryption

Answer

Symmetric encryption

Answer

Digital signature