200-201 Practice Test 4 — 25 Questions

Question 1

A company's security policy prohibits the use of shared accounts. However, a legacy application requires a shared administrative account to run. What is the best approach?

Accepted Answer

Use a privileged access management solution to control and monitor the shared account. A privileged access management (PAM) solution allows the shared administrative account to be used while enforcing security controls. PAM tools can vault the shared credentials, require check-in/check-out workflows, rotate passwords automatically, and provide full session recording and auditing. This satisfies the security policy's prohibition on shared accounts by eliminating direct shared access and replacing it with monitored, temporary, and revocable privileged sessions.

Answer

Create a policy exception

Answer

Disable the application

Answer

Ignore the policy because it's a legacy system

Question 2

An analyst needs to collect volatile data from a live host before performing a memory dump. Which data is most volatile?

Accepted Answer

Network connections. Network connections are the most volatile data because they change rapidly as packets flow and sessions are established or torn down. In live response, the current state of TCP/UDP connections (e.g., via netstat -ano) can be lost the instant the system is powered off or the network cable is pulled, making them more ephemeral than registry data, file system metadata, or event logs.

Answer

Registry data

Answer

File system metadata

Answer

Event logs

Question 3

A security analyst is reviewing IDS alerts and notices multiple TCP resets sent from an internal host with IP 10.10.10.25 to various external IPs on port 443. The alerts indicate that these resets occur immediately after the corresponding SYN-ACK from the external server, before any data exchange. The analyst suspects a TCP reset attack. Which action is most likely occurring?

Accepted Answer

An attacker is spoofing the client IP to send forged RST packets.. The described behavior—TCP RST packets sent immediately after the SYN-ACK, before any data exchange, from an internal host to multiple external IPs on port 443—is characteristic of a TCP reset attack. In this attack, an adversary spoofs the source IP of the legitimate client (10.10.10.25) and sends forged RST segments to the external servers, causing them to abort the TCP handshake prematurely. This prevents the completion of the three-way handshake and disrupts the connection before any application data can be exchanged.

Answer

A firewall is sending RST packets to block outbound traffic.

Answer

A client is properly closing a session after receiving data.

Answer

The client is retransmitting lost TCP segments.

Question 4

During an incident response, an analyst extracts a suspicious file and computes its MD5 hash: d41d8cd98f00b204e9800998ecf8427e. Upon checking a threat intelligence feed, this hash is known as a malicious indicator. What does this hash represent?

Accepted Answer

A false positive; the hash corresponds to an empty file.. The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.

Answer

An invalid hash; the file may be corrupt.

Answer

A known malicious executable that should be quarantined.

Answer

A hash of a benign system file.

Question 5

A security analyst is investigating a potential brute force attack. Which SIEM correlation rule would best detect this activity?

Accepted Answer

Alert when more than 10 failed logins from the same IP occur within one minute. A typical brute force detection rule monitors for multiple failed authentication attempts from the same source within a short time window.

Answer

Alert on a single failed login from any IP

Answer

Alert when a successful login occurs after midnight

Answer

Alert when a user logs in from a new geographic location

Question 6

Which TWO of the following are best practices when configuring a SIEM for security monitoring?

Accepted Answer

Tune rules to reduce false positives.. Tuning SIEM rules to reduce false positives is a best practice because it improves the signal-to-noise ratio, ensuring that security analysts focus on genuine threats rather than being overwhelmed by irrelevant alerts. By adjusting thresholds, whitelisting known benign activity, or refining correlation logic, the SIEM becomes more efficient and reduces alert fatigue, which is critical for effective security monitoring.

Answer

Disable logging for low-security systems.

Answer

Use the same log source for all event types.

Answer

Enable all default correlation rules.

Question 7

An organization uses both network-based intrusion detection (NIDS) and host-based intrusion detection (HIDS). A HIDS alert reports that a critical server's registry key was modified. The NIDS shows no corresponding network activity. The change occurred during a scheduled maintenance window. What is the best course of action for the analyst?

Accepted Answer

Check the change management system to see if the modification was authorized. The registry modification occurred during a scheduled maintenance window, which is a legitimate time for authorized changes. The analyst should first verify the change management system to confirm whether the modification was planned and approved, as this aligns with standard change control processes. The absence of NIDS alerts further suggests the change was likely local and non-malicious, but confirmation via change management is essential before taking any action.

Answer

Ignore the alert because it occurred during maintenance

Answer

Escalate the alert as a potential security incident

Answer

Immediately revert the registry change

Question 8

An analyst sees an alert from the IDS: 'ET TROJAN Possible Zeus Variant Outbound Connection'. What action should the analyst take first?

Accepted Answer

Investigate the source host for signs of compromise. The first priority when an IDS alerts on a possible Zeus variant (a known Trojan) is to investigate the source host to confirm or rule out compromise. Zeus is a credential-stealing Trojan that often establishes outbound C2 (command-and-control) traffic; blindly blocking the IP (A) could disrupt the investigation and may not stop the malware if it uses domain flux or multiple IPs. Reimaging (D) destroys forensic evidence, and ignoring the alert (B) is negligent given the severity of Zeus. The analyst must perform host-based analysis (e.g., check processes, registry, network connections) to validate the alert before taking containment actions.

Answer

Block the IP address on the firewall

Answer

Ignore the alert as a false positive

Answer

Reimage the host immediately

Question 9

During an incident, the analyst finds that an attacker modified system files. Which security principle was primarily violated?

Accepted Answer

Integrity. Integrity ensures that data and system files are not altered by unauthorized entities. When an attacker modifies system files, the trustworthiness and accuracy of those files are compromised, directly violating the integrity principle. This is distinct from confidentiality (unauthorized disclosure) or availability (denial of service).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 10

A financial firm uses Sysmon for endpoint monitoring on all Windows servers. One server, 'FIN-SRV-01', which hosts a critical database application, is exhibiting high CPU usage and unusual outbound network connections to a known malicious IP on port 8080. The Sysmon logs show Event ID 1 (Process Create) with a suspicious process 'rundll32.exe' spawned from 'winword.exe', and Event ID 3 (Network Connect) showing the connection to the malicious IP. The antivirus has not detected any threats. The analyst must decide the next immediate action to contain the threat while preserving evidence.

Accepted Answer

Isolate the server by disconnecting its network cable and taking a memory dump for further analysis.. Isolating the server by disconnecting its network cable immediately stops the outbound communication to the malicious IP on port 8080, containing the threat without destroying volatile evidence. Taking a memory dump preserves the running processes, including the suspicious rundll32.exe spawned from winword.exe, which is critical for forensic analysis of the attack chain. This approach aligns with incident response best practices: contain first, then analyze, while avoiding actions that could destroy evidence or alert the attacker.

Answer

Reboot the server to clear any suspicious processes from memory.

Answer

Immediately format the server's hard drive and reinstall the OS.

Answer

Restore the server from the most recent backup taken yesterday.

Question 11

During a security incident, a network engineer captures traffic with tcpdump and saves it to a pcap file. The analyst needs to extract all HTTP POST requests containing a specific string in the URI. Which command should be used?

Accepted Answer

tcpdump -r traffic.pcap 'tcp port 80' -A | grep 'POST' | grep 'string'. It uses tcpdump with the `-r` flag to read the pcap file, filters for TCP port 80 (HTTP), uses `-A` to print packet payloads in ASCII, and then pipes the output through two grep commands: first to isolate lines containing 'POST' (indicating HTTP POST requests) and second to filter for the specific string in the URI. This combination efficiently extracts only the relevant HTTP POST requests with the target string from the captured traffic.

Answer

tcpdump -r traffic.pcap -X | grep 'string'

Answer

ngrep -q -W byline 'POST.*string' port 80

Answer

tcpdump -r traffic.pcap -nn 'host 10.0.0.1'

Question 12

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

Accepted Answer

tcp.stream. The tcp.stream filter allows viewing a specific TCP stream by its number, which is useful for analysis.

Answer

tcp.port

Answer

http.request

Answer

ip.addr

Question 13

While analyzing a PCAP file in Wireshark, an analyst sees multiple GET requests to /login.php with different usernames in the URL parameters, all from the same source IP: 192.168.1.100 to 10.0.0.1. The HTTP response codes are mostly 200 OK. This pattern suggests which attack?

Accepted Answer

Brute force attack. Repeated login attempts with different usernames from the same IP is typical of a brute force attack against the login page.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 14

A security analyst is investigating a host that is suspected of being compromised. The analyst runs a series of commands to gather information. Which TWO of the following commands are most useful for collecting volatile data from a live Windows system? (Choose two.)

Accepted Answer

netstat -anob. The `netstat -anob` command displays active network connections, listening ports, and the associated process IDs (PIDs) along with the executable name. This is critical for identifying unauthorized outbound connections or backdoor listeners that indicate compromise. Because network state and process-to-port mappings reside in volatile memory (RAM), they are lost on reboot, making this command essential for live forensic collection.

Answer

dir /s C:\Windows\System32\config

Answer

wevtutil qe System /c:10

Answer

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Question 15

Which THREE of the following are key elements of a security monitoring and analysis strategy? (Choose three.)

Accepted Answer

Establishing a feedback loop for continuous improvement. Establishing a feedback loop for continuous improvement (A) is a key element because security monitoring is not a static process; it requires iterative refinement based on lessons learned from incidents, false positives, and changes in the threat landscape. This loop ensures that detection rules, response playbooks, and monitoring configurations evolve to maintain effectiveness against new attack vectors and reduce noise over time.

Answer

Focusing only on network-based monitoring to reduce complexity

Answer

Automating all incident response decisions to eliminate human error

Question 16

A SOC analyst is tuning IDS signatures and notices that a particular signature triggers frequently on legitimate traffic from a specific internal application. The signature has a high false positive rate. What is the best action to take?

Accepted Answer

Create a suppression rule to ignore the specific source IP or application.. To reduce false positives without losing detection capability, the analyst should create a suppression filter that excludes the known benign IP or application from triggering the signature.

Answer

Disable the signature entirely.

Answer

Increase the severity of the signature to get more attention.

Answer

Change the signature action to 'alert' instead of 'drop'.

Question 17

A security analyst is examining system logs for signs of privilege escalation. Which THREE events are most relevant to detect such activity?

Accepted Answer

Execution of commands with sudo. Privilege escalation often involves account creation with elevated rights, changes to user privileges, and successful use of 'sudo' commands.

Answer

Multiple failed login attempts

Answer

Successful SSH login from a remote IP

Question 18

A security analyst is monitoring network traffic and notices a high volume of TCP SYN packets sent to various ports on a single host. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan uses TCP SYN packets to probe for open ports on a target host. Excessive SYN packets to multiple ports indicate a port scan.

Answer

DNS amplification

Answer

Smurf attack

Answer

ARP spoofing

Question 19

An analyst finds a YARA rule that matches a file containing the string 'MZ' at offset 0 and includes 'CreateRemoteThread'. This rule likely identifies:

Accepted Answer

A malicious executable. 'MZ' indicates a PE (Portable Executable) file, and 'CreateRemoteThread' is a common API used for process injection, suggesting malware.

Answer

A benign PDF

Answer

A network packet capture

Answer

A Linux ELF binary

Question 20

A security analyst is examining web server logs and finds an entry with method 'POST', URL '/login.php', response code '200', and user-agent 'Mozilla/5.0'. The log shows 100 similar entries from the same IP within 5 seconds. What is the most likely activity?

Accepted Answer

A brute-force attack on the login form. Multiple POST requests to a login page from a single IP in a short time suggests a brute-force password guessing attack.

Answer

A SQL injection attempt on the login page

Answer

A DDoS attack targeting the web server

Answer

A user repeatedly clicking the login button due to a slow connection