200-201 Practice Test 25 — 15 Questions

Question 1

During a security assessment, a SOC analyst notices an IDS/IPS alert with a severity of 'High' for a signature named 'ET TROJAN Win32.Vobfus Checkin'. The alert shows source IP 10.0.0.5 and destination IP 203.0.113.50 on port 443. What is the most likely interpretation of this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A compromised host attempting to communicate with a command-and-control server over encrypted traffic. The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

Answer

A false positive due to a web browser accessing a secure site

Answer

An attacker scanning for open HTTPS ports on the internal network

Answer

A benign HTTPS connection to a legitimate website

Question 2

A security analyst is reviewing Snort IDS alerts and sees the following rule triggered: alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:'Possible SQL Injection'; content:'UNION'; nocase; sid:1000001;). Which action will Snort take when it detects matching traffic?

Accepted Answer

Generate an alert. The rule uses the Snort 'alert' action, which instructs Snort to generate an alert when the traffic matches the specified conditions (TCP traffic from any port on the home network to port 80 on an external network, with the string 'UNION' present in the payload, case-insensitive). Snort's default behavior for an 'alert' action is to log the packet and generate an alert, but it does not drop or reject the traffic because Snort is an IDS (Intrusion Detection System) by default, not an IPS (Intrusion Prevention System).

Answer

Log the packet only

Answer

Drop the packet

Answer

Reject the connection

Question 3

Which THREE of the following are common Indicators of Compromise (IoCs) used in threat intelligence?

Accepted Answer

IP addresses. IP addresses (A) are a classic network-based IoC because threat intelligence feeds track malicious or command-and-control (C2) infrastructure by IP, allowing defenders to block or alert on traffic to known-bad hosts. Domain names (D) are equally common IoCs, used to identify malicious domains, C2 servers, and phishing sites via DNS monitoring, sinkholing, or blocklists. File hashes such as MD5 and SHA-256 (E) are host-based IoCs that uniquely identify known malicious files, enabling endpoint and antivirus tools to detect malware by exact signature. User-agent strings (B) can be suspicious artifacts but are not typically standalone IoCs since they are trivially spoofed and highly variable, and port numbers (C) are not reliable IoCs on their own because legitimate and malicious services frequently share the same ports (e.g., 80, 443).

Answer

User-agent strings

Answer

Port numbers

Question 4

Which data source provides the most detailed information about the application layer payload in network traffic?

Accepted Answer

Full packet capture (PCAP). Full packet capture (PCAP) provides the most detailed information because it records the entire raw network packet, including headers and the complete application-layer payload. This allows deep inspection of protocols like HTTP, DNS, or SMTP at the byte level, which is essential for detecting malware, data exfiltration, or application-specific anomalies.

Answer

NetFlow

Answer

Syslog

Answer

SNMP

Question 5

A network administrator is creating a baseline for normal traffic patterns. Which of the following should be considered typical for a web server during business hours?

Accepted Answer

High volume of TCP SYN packets to port 443. A web server during business hours typically receives a high volume of incoming TCP SYN packets to port 443 (HTTPS) as clients initiate secure connections. This is normal traffic for a web server providing HTTPS services. The SYN packets are part of the TCP three-way handshake for new connections, and a high volume is expected during peak usage.

Answer

High volume of DNS queries to external domains

Answer

High volume of SSH connections on port 22

Answer

High volume of ICMP echo requests

Question 6

A Security Operations Center (SOC) uses Security Information and Event Management (SIEM) with event correlation. Analysts notice that alerts for a specific malware signature have decreased sharply after a new firewall rule was deployed. However, endpoint scans still show infections on several hosts. What is the most likely explanation for the decrease in SIEM alerts?

Accepted Answer

The firewall rule blocks the malware's C2 traffic, so SIEM no longer receives network alerts, but endpoint infections persist. The firewall rule specifically blocks command-and-control (C2) traffic, which is the network communication channel the malware uses to send data or receive instructions. Since the SIEM relies on network-based alerts (e.g., from intrusion detection systems or firewall logs) to detect this traffic, blocking the C2 traffic eliminates those network alerts. However, the malware remains on the endpoints because the firewall does not remove the infection; it only prevents outbound communication, so endpoint scans still detect the malware files or processes.

Answer

The SIEM correlation rules were accidentally disabled during the firewall update

Answer

The SIEM is not receiving logs from the endpoint detection and response (EDR) tool

Answer

The malware has mutated into a different variant that evades detection

Question 7

Your organization recently deployed a new web application that uses HTTPS. The security team notices that the IDS is generating a large number of alerts for 'SSL/TLS handshake anomalies' and 'self-signed certificates'. After investigating, you find that many of these alerts are coming from a legitimate internal scanning tool that uses a self-signed certificate. The IDS also reports a high rate of 'TLS renegotiation' attempts from the same source. The CISO wants to reduce false positives while maintaining visibility. The IDS is based on Suricata and uses a default rule set. What is the best course of action?

Accepted Answer

Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.. Creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.

Answer

Add a whitelist rule that ignores any traffic from any host using self-signed certificates.

Answer

Disable the Suricata rules that match self-signed certificates and TLS renegotiation.

Answer

Recommend removing the scanning tool from the network and using a different tool that uses a trusted certificate.

Question 8

Which TWO of the following are key components of a security policy? (Choose two.)

Accepted Answer

Policy statement. A security policy's core structure includes a policy statement (B), which articulates the organization's intent, scope, and high-level security objectives that management commits to, making it a defining component. It also includes enforcement and compliance guidelines (C), which specify how the policy will be mandated, monitored, and violated consequences applied, giving the policy its binding authority. Incident response procedures (A) are operational playbooks that support execution after an incident, not a foundational element of the policy document itself. Password complexity requirements (D) are a technical control or standard derived from policy, and network topology diagrams (E) are architectural documentation, neither of which constitutes a key component of the policy.

Answer

Incident response procedures

Answer

Password complexity requirements

Answer

Network topology diagrams

Question 9

You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?

Accepted Answer

Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5. The immediate priority is to stop the active data exfiltration and prevent further exploitation. Since the IPS was configured to 'alert' only, it did not block the malicious traffic. Blocking the attacker's IP at the firewall with a temporary drop rule is the fastest way to sever the attacker's access to the web server and stop the ongoing data theft, containing the incident while preserving forensic evidence.

Answer

Apply a software patch to the web application to fix the SQL injection vulnerability

Answer

Restore the web server from a known good backup

Answer

Shut down the database server to prevent further data loss

Question 10

A SIEM correlation rule triggers when a user account is created and then added to a privileged group within 10 minutes. Which activity does this rule detect?

Accepted Answer

Privileged account creation and elevation.. The SIEM rule specifically correlates the creation of a user account followed by its addition to a privileged group within a short time window. This sequence directly maps to the definition of privileged account creation and elevation, where a new account is granted administrative rights. The rule does not require any other malicious activity like data theft or lateral movement to trigger.

Answer

Malicious insider data theft.

Answer

Privilege escalation via token manipulation.

Answer

Lateral movement using pass-the-hash.

Question 11

An analyst is investigating a potential data exfiltration via DNS. In Zeek DNS logs, the analyst sees many queries for subdomains like 'a1b2c3.malicious.com', 'd4e5f6.malicious.com' etc. from an internal host. Which technique is likely being used?

Accepted Answer

DNS tunneling. The repeated pattern of unique, seemingly random subdomains (e.g., 'a1b2c3.malicious.com') from a single internal host is a classic indicator of DNS tunneling. This technique encodes exfiltrated data into DNS query subdomains, leveraging the fact that DNS traffic is often allowed through firewalls. The malicious server decodes the subdomain strings to reconstruct the stolen data.

Answer

DNS cache poisoning

Answer

DNS amplification

Answer

DNS zone transfer

Question 12

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

Accepted Answer

NTP traffic. The syslog message %ASA-4-106023 shows a UDP deny from source 192.0.2.1 port 123 to destination 10.0.0.5 port 123. Port 123 is the well-known port for Network Time Protocol (NTP), which is used for clock synchronization. Therefore, the denied traffic is NTP traffic.

Answer

HTTP traffic

Answer

SNMP traffic

Answer

DNS traffic

Question 13

An attacker uses a tool to capture keystrokes on a compromised system. What type of malware is most likely in use?

Accepted Answer

Keylogger. A keylogger is a type of malware specifically designed to capture and record keystrokes on a compromised system. The question directly describes the behavior of capturing keystrokes, which is the primary function of a keylogger, making it the most likely malware in use.

Answer

Spyware

Answer

Rootkit

Answer

Ransomware

Question 14

Which THREE of the following are best practices for creating and maintaining security policies? (Choose three.)

Accepted Answer

Obtain approval from senior management.. Option B is correct because security policies derive their authority from executive endorsement; obtaining approval from senior management ensures the policies are formally sanctioned, funded, and enforceable across the organization. Option C is correct because policies are only effective if the people they govern understand them, so providing training on policies to all employees ensures awareness, accountability, and consistent compliance. Option D is correct because reviewing and updating policies annually keeps them aligned with changes in business operations, technology, regulations, and threat landscape, preventing outdated or ineffective controls. Option A is not a best practice because developing policies in isolation by the security team excludes key stakeholders such as legal, HR, IT, and business units, reducing practicality and buy-in. Option E is not a best practice because storing policies in a secure location accessible only to security staff undermines the need for organization-wide visibility, awareness, and training that make policies effective.

Answer

Develop policies in isolation by the security team.

Answer

Store policies in a secure location accessible only to security staff.

Question 15

An analyst uses Volatility on a memory dump and runs the 'pstree' command. What specific information does this provide compared to 'pslist'?

Accepted Answer

It displays the process tree hierarchy.. The Volatility 'pstree' plugin displays the process tree hierarchy, showing parent-child relationships between processes. Unlike 'pslist', which lists processes in a flat table ordered by creation time, 'pstree' visually indents child processes under their parents. This helps analysts identify suspicious process lineage, such as a web server spawning a shell.

Answer

It shows only hidden processes.

Answer

It extracts command line arguments.

Answer

It lists loaded kernel modules.