200-201 Practice Test 25 — 15 Questions

Question 1

An analyst is investigating a host that is making outbound HTTPS connections to multiple random-looking domains, each with a short TTL. The domains are not in any threat intelligence feeds. Which technique is most likely being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Domain Generation Algorithm (DGA). Domain Generation Algorithms (DGAs) generate many random domain names to evade blocklists. Short TTLs allow fast changes.

Answer

Beaconing

Answer

DNS tunneling

Answer

Fast flux DNS

Question 2

A network analyst is investigating a suspected DNS tunneling attack. Which THREE of the following are indicators of DNS tunneling?

Accepted Answer

Unusually high volume of DNS queries to a single domain. DNS tunneling often involves high volumes of DNS queries to a single domain, large payloads in TXT records, and encoded data in subdomains to exfiltrate data.

Answer

DNS queries for well-known domains like google.com

Answer

Low volume of DNS queries from internal hosts

Question 3

During the Containment, Eradication, and Recovery phase, the incident response team collects evidence from a compromised system. Which document is used to record the chain of custody?

Accepted Answer

Chain of custody form. Chain of custody documentation tracks who handled evidence from collection to court presentation.

Answer

Data classification policy

Answer

Acceptable Use Policy

Answer

Incident response plan

Question 4

In Wireshark, which filter can be used to quickly find all HTTP requests that contain a specific keyword in the URL?

Accepted Answer

http.request.uri contains "keyword". The http.request filter combined with a contains operator can isolate HTTP requests with specific patterns.

Answer

dns.qry.name contains "keyword"

Answer

tcp.port == 80

Answer

ip.src == 10.0.0.1

Question 5

A SOC Tier 3 analyst is performing advanced threat analysis. Which TWO activities are typical for this tier?

Accepted Answer

Forensic analysis of compromised systems. Tier 3 involves threat hunting and advanced forensics, while Tier 1 handles triage and Tier 2 handles correlation.

Answer

Correlating multiple alerts

Answer

Monitoring SIEM dashboards

Answer

Initial triage of alerts

Question 6

An organization is conducting a risk assessment and wants to assign numerical values to the likelihood and impact of risks. Which type of risk assessment is being performed?

Accepted Answer

Quantitative risk assessment. Quantitative risk assessment uses numerical values (e.g., monetary, percentages) to calculate risk.

Answer

Operational risk assessment

Answer

Qualitative risk assessment

Answer

Hybrid risk assessment

Question 7

During the Cyber Kill Chain, which phase involves sending a malicious attachment to a target user via email?

Accepted Answer

Delivery. Delivery is the phase where the attacker transmits the weaponized payload to the target, such as via email attachments.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 8

In the context of risk management, which term describes the risk that remains after implementing security controls?

Accepted Answer

Residual risk. Residual risk is the risk left after controls are applied. It must be accepted or further treated.

Answer

Acceptable risk

Answer

Inherent risk

Answer

Transfer risk

Question 9

A security analyst is reviewing PCAP data and sees a TCP stream with interactive shell commands such as 'whoami', 'ls -la', and 'cat /etc/passwd'. The session appears to be bidirectional with a remote IP. Which type of attack is most likely occurring?

Accepted Answer

Reverse shell. Interactive shell commands over TCP indicate a reverse shell, where the attacker has a command shell on the victim.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 10

Which of the following is the CORRECT order of the NIST SP 800-61 Rev 2 incident response lifecycle phases?

Accepted Answer

Preparation, Detection and Analysis, Containment Eradication and Recovery, Post-Incident Activity. The correct order is Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity.

Answer

Containment Eradication and Recovery, Detection and Analysis, Preparation, Post-Incident Activity

Answer

Post-Incident Activity, Preparation, Detection and Analysis, Containment Eradication and Recovery

Answer

Detection and Analysis, Preparation, Containment Eradication and Recovery, Post-Incident Activity

Question 11

During which phase of the NIST SP 800-61 Rev 2 incident response process would the incident response team conduct initial triage and determine whether an event qualifies as an incident?

Accepted Answer

Detection and Analysis. Initial triage and identification of incidents occur in the Detection and Analysis phase.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Question 12

An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?

Accepted Answer

DNS tunnelling for C2 communication. DNS tunnelling encodes data in subdomain queries, and periodic beaconing is common for C2. High entropy subdomains and regular intervals suggest DNS tunnelling for C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for a dynamic DNS service

Answer

DNS cache poisoning attempt

Question 13

An organization is implementing a threat intelligence sharing program. Which THREE elements are commonly used standards or platforms for sharing threat intelligence?

Accepted Answer

MISP. STIX, TAXII, and MISP are widely used for threat intelligence sharing. ISAC is an organization, not a standard/platform. OpenIOC is a format but less common now.

Answer

ISAC

Answer

OpenIOC

Question 14

A company's legal counsel is involved in an incident response due to a data breach. What is the primary role of legal counsel during the incident?

Accepted Answer

Advise on data breach notification requirements. Legal counsel ensures compliance with data breach notification laws.

Answer

Make decisions about business impact

Answer

Communicate with the public

Answer

Conduct forensic analysis of affected systems

Question 15

A SOC analyst is investigating a potential malware outbreak. Which THREE actions should the analyst take to preserve evidence? (Select three.)

Accepted Answer

Calculate a hash of the original drive before imaging. Hashing before imaging, using write blockers, and maintaining chain of custody are key evidence preservation steps.

Answer

Reboot the system to clear memory

Answer

Run a full antivirus scan to remove malware