200-201 Practice Test 2 — 25 Questions

Question 1

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

Accepted Answer

Periodic connections at regular intervals to an external IP. Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.

Answer

Large data transfers to a known cloud provider

Answer

ICMP echo requests to multiple hosts

Answer

Random intervals with varying packet sizes

Question 2

Which security policy defines the process for reporting discovered security vulnerabilities to the organization?

Accepted Answer

Vulnerability Disclosure Policy. A Vulnerability Disclosure Policy (VDP) defines how external researchers and the public should report security vulnerabilities to an organization, including the scope, reporting channel, and expected response timeline. It is the formal mechanism that governs the inbound reporting process, distinct from internal incident response procedures.

Answer

Acceptable Use Policy

Answer

Incident Response Policy

Answer

Change Management Policy

Question 3

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 4

An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?

Accepted Answer

Command and Control. The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Answer

Delivery

Answer

Actions on Objectives

Answer

Installation

Question 5

A company uses Cisco Firepower NGFW with intrusion prevention. An analyst notices that many legitimate HTTPS connections are being blocked by an IPS rule. What is the best approach to reduce false positives?

Accepted Answer

Create a custom rule exception for the specific destination IPs.. Creating a custom rule exception for the specific destination IPs is the best approach because it allows the IPS to continue blocking malicious traffic while exempting legitimate HTTPS connections that are incorrectly flagged. This maintains security posture by not weakening the rule globally, and it directly addresses the false positive without affecting detection of other threats.

Answer

Increase the severity threshold of the rule.

Answer

Disable the IPS rule entirely.

Answer

Change the rule action from 'Drop' to 'Alert'.

Question 6

An analyst is analyzing a PCAP and sees multiple ICMP port unreachable responses from a target host when scanning UDP ports. What does this indicate about the scanned ports?

Accepted Answer

The ports are closed.. When a UDP scan sends a packet to a closed port, the target responds with an ICMP port unreachable message.

Answer

The scan is a SYN scan.

Answer

The ports are filtered by a firewall.

Answer

The ports are open.

Question 7

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Option A is correct because implementing access control lists (ACLs) on routers and switches restricts which traffic is permitted to reach the management plane and transit the device, enforcing least-privilege filtering as a core hardening control. Option B is correct because disabling unused services (for example, CDP, LLDP, HTTP server, or unused routing protocols) reduces the attack surface by eliminating unnecessary listening ports and daemons that could be exploited. Option E is correct because SNMPv3 with strong authentication (authNoPriv or authPriv using SHA and AES) replaces insecure SNMPv1/v2c community strings with encrypted, authenticated management traffic. Option C is not a hardening practice because Telnet transmits credentials and session data in cleartext; SSH should be used instead. Option D is not a hardening practice because default credentials are widely known and must be changed immediately during initial setup.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 8

Drag and drop the steps for the DHCP DORA process (dynamic host configuration) into the correct order.

Accepted Answer

Step 1: Discover, Step 2: Offer, Step 3: Request, Step 4: Acknowledge. The DHCP DORA process stands for Discover, Offer, Request, Acknowledge. It begins with the client broadcasting a Discover message to find DHCP servers. Servers respond with an Offer of an available IP address. The client then sends a Request to accept one of the offers. Finally, the server sends an Acknowledge to confirm the lease, completing the process. This sequence ensures proper assignment of IP addresses and avoids conflicts.

Answer

Step 1: Discover, Step 2: Request, Step 3: Offer, Step 4: Acknowledge

Answer

Step 1: Offer, Step 2: Discover, Step 3: Request, Step 4: Acknowledge

Answer

Step 1: Discover, Step 2: Offer, Step 3: Acknowledge, Step 4: Request

Question 9

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Vulnerability scanning (C) is active reconnaissance because the attacker directly sends probes to the target to identify weaknesses, generating traffic the firewall can detect and block. Port scanning (D) is active reconnaissance since tools like Nmap send TCP SYN, FIN, or UDP packets to enumerate open ports on the target hosts. Ping sweeps (E) are active reconnaissance because ICMP Echo Request packets are sent across an address range to discover live hosts. WHOIS lookups (B) are passive reconnaissance, as they query public registration databases rather than the target's own systems, so a firewall cannot block them. Social engineering (A) is a human-based attack that involves no network traffic to the firewall and is therefore not a reconnaissance traffic type to filter.

Answer

Social engineering

Answer

WHOIS lookups

Question 10

During an incident response, the SOC needs to determine the scope of a compromise by identifying all hosts that communicated with a known malicious IP in the last 30 days. Which data source would best support this analysis?

Accepted Answer

NetFlow records from the router. NetFlow records capture metadata about all IP traffic flows traversing a router, including source and destination IP addresses, ports, and timestamps. This allows the SOC to query for any host that communicated with the known malicious IP over the past 30 days, providing a complete picture of the compromise's scope. Unlike logs that only record denied traffic or administrative events, NetFlow records all successful communications, making it the ideal data source for this analysis.

Answer

SNMP traps from routers

Answer

Syslog from the DHCP server

Answer

Firewall deny logs

Question 11

In Zeek (Bro), which log file would an analyst examine to identify HTTP methods, URIs, and response codes from web traffic?

Accepted Answer

http.log. Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

Answer

files.log

Answer

dns.log

Answer

conn.log

Question 12

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

Accepted Answer

GET /products?id=1 UNION SELECT * FROM users. The UNION SELECT payload is the classic SQL injection signature: it appends a second SELECT statement to the original query, allowing the attacker to retrieve data from other tables such as 'users'. The presence of SQL keywords (UNION, SELECT, FROM) inside a URL parameter that should only contain a numeric ID is a strong indicator of SQLi. This pattern targets the backend database directly, unlike script tags which target the browser.

Answer

GET /login?user=admin&pass=password123

Answer

GET /search?q=

Answer

GET /index.html HTTP/1.1

Question 13

A security analyst notices repeated failed login attempts from a single IP address to the company's VPN gateway. Which action should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.

Answer

Escalate to the incident response team immediately.

Answer

Block the IP at the firewall immediately.

Answer

Ignore the activity as it may be a user error.

Question 14

Which TWO actions should an analyst take when a critical alert is triggered?

Accepted Answer

Verify the alert with other sources. Option B is correct because verifying a critical alert against other sources (such as SIEM logs, EDR telemetry, IDS/IPS events, or host-based logs) confirms whether the alert represents a true positive before committing resources, reducing the risk of acting on a false positive. Option C is correct because once a critical alert is validated, the analyst should escalate it to the incident response team so that containment, eradication, and recovery follow the organization's documented IR process and chain-of-custody requirements. Option A is wrong because deleting alerts destroys evidence and audit trails and could mask a real compromise. Option D, while sometimes useful for context, is not one of the two primary actions required at the moment a critical alert fires. Option E is wrong because powering off a system can destroy volatile evidence in memory and may violate incident response procedures; isolation is preferred over shutdown.

Answer

Delete the alert to reduce noise

Answer

Search for similar alerts in the past

Answer

Immediately power off the affected system

Question 15

Which of the following is a valid indicator of compromise (IoC)?

Accepted Answer

A file hash (MD5). An indicator of compromise is a forensic artifact that provides evidence a system or network has been breached. A file hash such as an MD5 (or SHA-1/SHA-256) uniquely identifies a malicious file and can be searched across endpoints and threat feeds, making it a canonical host-based IoC. Hashes, IP addresses, domain names, URLs, and registry keys are all standard IoC types used in detection and threat intelligence.

Answer

The company's logo

Answer

An employee's email address

Answer

A user's full name

Question 16

An analyst is investigating a Windows host for malware persistence. Which TWO registry locations are commonly abused for persistence by modifying the 'Run' key? (Select TWO)

Accepted Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\Run. Both HKLM and HKCU Run keys are commonly used for persistence.

Answer

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\System\CurrentControlSet\Services

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Question 17

A company uses Cisco Stealthwatch to monitor network traffic. Which type of data does Stealthwatch primarily rely on for visibility?

Accepted Answer

NetFlow data. Cisco Stealthwatch is designed for network traffic analysis and relies on NetFlow data (including IPFIX and other flow protocols) to provide visibility into network behavior, traffic patterns, and anomalies. Unlike full packet captures, NetFlow metadata (source/destination IP, ports, protocols, byte counts) is lightweight and scalable for monitoring large networks, making it the primary data source for Stealthwatch's behavioral analytics and threat detection.

Answer

SNMP traps

Answer

Full packet captures

Answer

Syslog messages

Question 18

An analyst is performing memory forensics on a Windows machine using Volatility. Which command would be most useful to identify hidden or injected code within a process?

Accepted Answer

malfind. The `malfind` plugin in Volatility is specifically designed to detect hidden or injected code in process memory. It scans for memory regions that are both executable and writable (or have no file backing on disk), which are common indicators of code injection techniques like process hollowing or reflective DLL injection. By identifying these suspicious memory pages, `malfind` helps analysts uncover malware that attempts to hide within legitimate processes.

Answer

dlllist

Answer

netscan

Answer

pslist

Question 19

An analyst examining a Linux server notices an unusual cron job in /etc/crontab that runs a script every 5 minutes. Which of the following describes the best approach to determine if this cron job is malicious?

Accepted Answer

Check the script's content, owner, and compare its hash with known threats.. Inspecting the script content and correlating with known persistence techniques helps assess maliciousness.

Answer

Ignore it because cron jobs are always legitimate.

Answer

Delete the cron job immediately to stop potential malicious activity.

Answer

Run the script in a sandbox to see what it does.

Question 20

When analyzing a suspicious PE file, the analyst calculates the file's entropy and finds it to be 7.8. What does a high entropy value typically indicate, and why is it relevant to malware analysis?

Accepted Answer

The file is likely packed or encrypted to evade signature-based detection.. A high entropy value (close to 8.0) indicates that the data within the file is highly random, which is a strong sign of packing or encryption. Malware authors use packers to obfuscate the original executable code, making it harder for signature-based detection engines to identify known malicious patterns. In malware analysis, entropy is a quick heuristic to flag files that may be hiding their true content.

Answer

The file contains no executable code.

Answer

The file is likely a legitimate application with high compression.

Answer

The file's imports are all standard Windows DLLs.