200-201 Practice Test 4 — 25 Questions

Question 1

Which Windows Event ID is recorded when a user account is created, indicating potential unauthorized account creation?

Accepted Answer

4720. Windows Security Event ID 4720 is logged when a user account is created. It is a key indicator for detecting unauthorized account creation, which attackers use for persistence and privilege escalation. This directly matches the question.

Answer

4726

Answer

4648

Answer

4624

Question 2

During which phase of the NIST SP 800-61 Rev 2 incident response process should an organization develop and exercise the incident response plan?

Accepted Answer

Preparation. The Preparation phase of NIST SP 800-61 Rev 2 covers establishing the incident response capability, including developing the IR plan, acquiring tools, training staff, and exercising the plan through tabletop and functional exercises. Exercising the plan before an incident occurs is explicitly a Preparation activity, not something done during or after an event.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 3

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

Accepted Answer

Multiple DNS queries to algorithmically generated domains that result in NXDOMAIN responses. DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.

Answer

Large DNS responses indicating amplification

Answer

DNS queries to a single domain with high frequency

Answer

DNS queries with long TTL values

Question 4

An organization wants to ensure that data sent over the internet cannot be read if intercepted. Which cryptographic method should be used?

Accepted Answer

Symmetric encryption with AES. Symmetric encryption with AES transforms plaintext into ciphertext using a shared secret key, so an attacker who intercepts the data over the internet cannot read it without the key. AES is the standard, NIST-approved symmetric cipher (FIPS 197) used in TLS, VPNs, and disk encryption. This directly satisfies the requirement that intercepted data cannot be read.

Answer

Digital signature using RSA

Answer

Hash-based message authentication code (HMAC)

Answer

Hashing with SHA-256

Question 5

An analyst is investigating a Linux system for persistence mechanisms. Which TWO of the following are common locations for cron-based persistence? (Select TWO)

Accepted Answer

/var/spool/cron/crontabs/. Option A (/var/spool/cron/crontabs/) is correct because this is the directory where per-user crontab files are stored on Debian/Ubuntu-style systems, and attackers commonly drop a crontab entry here to run a payload under a specific user account at scheduled intervals. Option C (/etc/crontab) is correct because it is the system-wide crontab file that supports the extra user field and is a frequent target for persistence, since a malicious line added here executes with the specified user's privileges on a recurring schedule. Option B (/etc/init.d/) is not cron-based; it holds SysV init scripts for service startup, not scheduled jobs. Option D (/var/log/cron) is a log file recording cron activity, useful for detection but not a persistence location. Option E (/etc/systemd/system/) is for systemd unit files, a separate persistence mechanism from cron.

Answer

/etc/init.d/

Answer

/var/log/cron

Answer

/etc/systemd/system/

Question 6

An analyst is analyzing a Linux system that may have been compromised. Which THREE artifacts would provide evidence of attacker activity? (Choose three.)

Accepted Answer

/var/spool/cron/crontabs/. Option B, /var/spool/cron/crontabs/, is correct because attackers commonly establish persistence by adding malicious cron jobs here (per-user crontabs on Debian/Ubuntu systems), so unexpected entries provide direct evidence of attacker activity. Option D, /var/log/auth.log, is correct because it records authentication events such as SSH logins, sudo usage, and failed/successful password attempts, which can reveal unauthorized access or brute-force activity. Option E, /home/user/.bash_history, is correct because it preserves the commands a user (or an attacker operating under that account) executed, often exposing reconnaissance, privilege escalation, or data exfiltration commands. Option A, /proc/cpuinfo, is not relevant because it only exposes CPU hardware details from the kernel and contains no record of user or attacker actions. Option C, /etc/passwd, is not the best evidence of activity because it is a static account database listing users; while tampering (e.g., a rogue UID 0 account) could be suspicious, the file itself does not log activity, and the question asks for artifacts evidencing attacker activity.

Answer

/proc/cpuinfo

Answer

/etc/passwd

Question 7

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

Accepted Answer

tcp.stream. The `tcp.stream` filter in Wireshark isolates a single TCP conversation by its stream index, allowing analysts to follow the entire bidirectional flow of that session. Once filtered, you can right-click and select Follow > TCP Stream to extract the full payload. This is the standard method for reconstructing application-layer data from a specific conversation in a PCAP.

Answer

tcp.port

Answer

http.request

Answer

ip.addr

Question 8

An analyst is reviewing Windows Event Logs and finds Event ID 4648. What does this event typically indicate?

Accepted Answer

A logon using explicit credentials. Windows Security Event ID 4648 is logged when a process attempts an explicit-credential logon — that is, when a user or service supplies alternate credentials (via runas, New-PSSession -Credential, or similar) rather than using the current session's token. It records the account that requested the logon and the account whose credentials were used.

Answer

A failed logon attempt

Answer

An account creation event

Answer

A successful logon event

Question 9

During a security assessment, an analyst uses the Shodan search engine to find exposed industrial control systems. Which phase of the attack lifecycle does this activity represent?

Accepted Answer

Reconnaissance. Using Shodan to search for exposed industrial control systems is a form of passive/active information gathering about the target's internet-facing assets — this is the Reconnaissance phase of the attack lifecycle (also called footprinting or information gathering). The attacker is mapping the attack surface before any exploitation, delivery, or command-and-control activity occurs. Shodan indexes banners from internet-connected devices, making it a classic reconnaissance tool.

Answer

Command and control

Answer

Delivery

Answer

Exploitation

Question 10

A security analyst is analyzing a Linux system suspected of being used as a phishing server. Which THREE artifacts should the analyst examine to identify persistence mechanisms? (Select 3)

Accepted Answer

/etc/systemd/system/. Common Linux persistence mechanisms include cron jobs (crontab), systemd services, and startup scripts. Bash history may show commands but is not a persistence mechanism itself.

Answer

/var/log/auth.log

Answer

~/.bash_history

Question 11

A Windows event log review shows Event ID 4625 multiple times from a single source IP. What does this event indicate, and which log contains it?

Accepted Answer

Failed logon; Security log. Event ID 4625 is a failed logon attempt, recorded in the Security log.

Answer

Successful logon; System log

Answer

Service start; System log

Answer

Account creation; Application log

Question 12

An organization is implementing an AUP that prohibits personal use of corporate resources. However, an employee uses a company laptop to access personal email, which leads to a malware infection. Which policy violation is most directly implicated?

Accepted Answer

Acceptable Use Policy (AUP). The Acceptable Use Policy (AUP) defines acceptable behavior regarding the use of company resources. Personal use that violates the AUP is a direct policy breach.

Answer

Remote access policy

Answer

Information security policy

Answer

Password policy

Question 13

During a SYN scan, an attacker sends a SYN packet to a closed port on a target. What response does the target typically send back?

Accepted Answer

RST. In a SYN scan, a closed port responds with a RST packet to reject the connection attempt.

Answer

ICMP Port Unreachable

Answer

ACK

Answer

SYN-ACK

Question 14

During the Containment, Eradication, and Recovery phase, the incident response team collects evidence from a compromised system. Which document is used to record the chain of custody?

Accepted Answer

Chain of custody form. Chain of custody documentation tracks who handled evidence from collection to court presentation.

Answer

Data classification policy

Answer

Acceptable Use Policy

Answer

Incident response plan

Question 15

A SOC Tier 3 analyst is performing advanced threat analysis. Which TWO activities are typical for this tier?

Accepted Answer

Forensic analysis of compromised systems. Forensic analysis of compromised systems (A) is a Tier 3 activity because it requires deep expertise in memory, disk, and artifact examination to reconstruct attacker actions and determine root cause. Threat hunting (E) is also typical for Tier 3, as it involves proactively searching for hidden adversaries using hypotheses, advanced analytics, and tools beyond routine alert handling. In contrast, correlating multiple alerts (B) and initial triage of alerts (D) are generally Tier 1 or Tier 2 responsibilities, and monitoring SIEM dashboards (C) is a routine Tier 1 monitoring task rather than advanced analysis.

Answer

Correlating multiple alerts

Answer

Monitoring SIEM dashboards

Answer

Initial triage of alerts

Question 16

A company uses Cisco Firepower NGFW with intrusion prevention. The security team notices that some legitimate traffic is being blocked by the IPS, causing application outages. The analyst reviews the IPS signature events and finds false positives. What is the best approach to handle this without reducing security posture?

Accepted Answer

Create a custom rule to exclude the affected traffic based on source/destination, while monitoring the signature for true positives.. It allows the security team to selectively exclude only the specific legitimate traffic causing false positives, using source/destination criteria in a custom rule, while keeping the IPS signature active for all other traffic. This approach maintains the overall security posture by still detecting true positives from the same signature against other traffic flows. Disabling or lowering the signature's severity would globally reduce detection capability, and updating the database may not address a signature that is inherently too broad for the environment.

Answer

Lower the severity of the signature to informational.

Answer

Disable the IPS signature that is causing the false positives.

Answer

Update the IPS signature database to the latest version.

Question 17

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

Accepted Answer

A threat exploits a vulnerability, resulting in risk.. In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Answer

A vulnerability is a potential danger; a threat is a weakness; risk is the impact.

Answer

A vulnerability is a potential attack; a threat is a weakness.

Answer

Risk is eliminated when a vulnerability is patched.

Question 18

A SOC Tier 2 analyst receives an escalated alert about a potential command-and-control (C2) communication. The analyst needs to correlate network logs with threat intelligence. Which data format and transport protocol pair is specifically designed for standardized threat intelligence sharing?

Accepted Answer

STIX and TAXII. STIX is the format, TAXII is the transport protocol for sharing threat intelligence.

Answer

OpenIOC and MISP

Answer

MISP and STIX

Answer

TAXII and OpenIOC

Question 19

During which phase of the NIST SP 800-61 Rev 2 incident response process does an organization develop an incident response plan and assemble a team?

Accepted Answer

Preparation. The Preparation phase includes developing the IR plan, team, tools, and conducting exercises.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 20

A SOC analyst is investigating a suspected data exfiltration. The analyst needs to preserve evidence from a compromised workstation. Which of the following is the CORRECT procedure to ensure evidence integrity?

Accepted Answer

Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.. Proper evidence preservation requires hashing the original disk before imaging and then hashing the image to verify integrity.

Answer

Create a forensic image without write-blocking, then hash the image.

Answer

Copy all files to an external drive without hashing.

Answer

Disconnect the hard drive and boot from a live CD to collect data.