200-201 Practice Test 24 — 15 Questions

Question 1

A security analyst is investigating a potential exploit. The PCAP shows a HTTP POST request containing a long string of characters that, when decoded, reveals a series of return-oriented programming (ROP) gadgets. What is the likely purpose of this payload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exploitation. ROP gadgets are used to bypass non-executable memory protections by chaining together small code sequences to execute arbitrary code. This is an exploitation technique.

Answer

Lateral movement

Answer

Privilege escalation

Answer

Persistence

Question 2

A security analyst at a SOC Tier 1 receives an alert about a potential malware infection on a user's workstation. What is the primary responsibility of the Tier 1 analyst in this scenario?

Accepted Answer

Conduct initial triage and basic investigation. Tier 1 analysts monitor alerts, perform initial triage, and escalate if needed. They conduct basic investigation.

Answer

Coordinate with legal counsel for data breach notification

Answer

Develop new detection signatures

Answer

Perform deep forensic analysis of the malware

Question 3

During the containment phase of an incident, the IR team decides to power off a compromised server to prevent further damage. However, they later realize that this action may have destroyed volatile evidence. According to best practices, what should the team have done instead?

Accepted Answer

Perform a live forensic image of the server's memory before powering off. Short-term containment should preserve evidence; live imaging captures volatile data before power-off.

Answer

Disconnect the server from the network but leave it running

Answer

Immediately power off the server without any imaging

Answer

Skip evidence collection and focus solely on containment

Question 4

An organization uses STIX and TAXII to share threat intelligence with an ISAC. What is the purpose of TAXII in this scenario?

Accepted Answer

It provides a method to transport threat intelligence. TAXII is a protocol for exchanging STIX data.

Answer

It stores threat intelligence locally

Answer

It is a platform for malware analysis

Answer

It defines the format for threat indicators

Question 5

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

Accepted Answer

Multiple DNS queries to algorithmically generated domains that result in NXDOMAIN responses. DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.

Answer

Large DNS responses indicating amplification

Answer

DNS queries to a single domain with high frequency

Answer

DNS queries with long TTL values

Question 6

Which TWO are components of the NIST SP 800-61 Rev 2 Preparation phase? (Select two.)

Accepted Answer

Developing an incident response plan. Preparation includes developing the IR plan and creating the IR team.

Answer

Conducting lessons learned

Answer

Containing the incident

Answer

Identifying indicators of compromise

Question 7

A SOC analyst is investigating a suspected data exfiltration. The analyst needs to preserve evidence from a compromised workstation. Which of the following is the CORRECT procedure to ensure evidence integrity?

Accepted Answer

Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.. Proper evidence preservation requires hashing the original disk before imaging and then hashing the image to verify integrity.

Answer

Create a forensic image without write-blocking, then hash the image.

Answer

Copy all files to an external drive without hashing.

Answer

Disconnect the hard drive and boot from a live CD to collect data.

Question 8

During a SYN scan, an attacker sends a SYN packet to a closed port on a target. What response does the target typically send back?

Accepted Answer

RST. In a SYN scan, a closed port responds with a RST packet to reject the connection attempt.

Answer

ICMP Port Unreachable

Answer

ACK

Answer

SYN-ACK

Question 9

In the Cyber Kill Chain model, which phase involves delivering the exploit to the target, such as via email attachment or malicious link?

Accepted Answer

Delivery. The delivery phase is where the weaponized payload is transmitted to the victim, e.g., via phishing email or drive-by download.

Answer

Installation

Answer

Exploitation

Answer

Weaponization

Question 10

An analyst filters PCAP with 'tcp.stream eq 0' and sees an interactive shell session with commands like 'whoami', 'ls -la', 'cd /etc'. The session originated from an HTTP POST to a web shell. Which type of attack is this?

Accepted Answer

Reverse shell. A web shell allows remote command execution over HTTP, essentially a reverse shell.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Cross-site scripting

Question 11

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

Accepted Answer

Periodic connections at regular intervals to an external IP. Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.

Answer

Large data transfers to a known cloud provider

Answer

ICMP echo requests to multiple hosts

Answer

Random intervals with varying packet sizes

Question 12

Which type of attack is indicated by a series of SMB authentication attempts from one host to multiple other hosts in a short time frame?

Accepted Answer

Lateral movement. Lateral movement often involves propagating across hosts using SMB for remote access and authentication.

Answer

Port scanning

Answer

C2 beaconing

Answer

DNS exfiltration

Question 13

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 14

An analyst captures traffic and sees a TCP connection with only a SYN packet and an RST response. No SYN-ACK is observed. Which scan technique is this?

Accepted Answer

TCP SYN scan. A SYN scan sends a SYN and expects a SYN-ACK; if an RST is received, the port is closed. Incomplete handshake without SYN-ACK indicates a half-open scan.

Answer

Ping sweep

Answer

UDP scan

Answer

TCP connect scan

Question 15

An analyst detects a large outbound FTP transfer from a sensitive server to an external IP address not previously seen. The file being transferred is a compressed archive containing database dumps. Which Cyber Kill Chain phase is most directly indicated?

Accepted Answer

Actions on Objectives. Exfiltration of sensitive data is part of 'Actions on Objectives', where the attacker achieves their goal of stealing data.

Answer

Installation

Answer

C2

Answer

Exploitation