200-201 Practice Test 5 — 25 Questions

Question 1

A forensic analyst is examining a suspicious file. The file has a high entropy score (close to 8.0) and the PE section names are obfuscated. Which tool or technique would best help determine if the file is packed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyze the PE sections and calculate entropy to detect packing. High entropy (close to 8.0) indicates the file's byte distribution is nearly random, which is characteristic of compressed or encrypted data — exactly what packers produce. Combined with obfuscated PE section names (e.g., UPX0, .aspack, or random strings), analyzing PE section headers and computing per-section entropy is the definitive method to confirm packing. Tools like PEiD, Detect It Easy, or pefile in Python automate this by flagging sections with entropy >7.0 and non-standard names.

Answer

Use the 'strings' command to extract readable strings

Answer

Check the file's digital signature

Answer

Run the 'file' command in Linux

Question 2

An organization's security policy specifies that all configuration changes must be approved through a change management process. An analyst discovers that a firewall rule was added without approval. What is the appropriate action?

Accepted Answer

Report the unauthorized change to management.. The appropriate action is to report the unauthorized change to management, as per the change management process. Removing the rule immediately could disrupt legitimate business operations, and documenting and ignoring it violates policy. The analyst should follow the established process for handling unauthorized changes.

Answer

Remove the rule immediately.

Answer

Change the policy to allow emergency changes without approval.

Answer

Document the change and ignore it.

Answer

Analyze the rule to see if it's needed, then either approve or remove.

Question 3

A security analyst receives an alert from the SIEM indicating a large number of failed login attempts from an external IP address targeting a user account. According to the incident response process, what should be the analyst's first action?

Accepted Answer

Perform initial triage to determine the severity and validity. Initial triage is part of Detection and Analysis to determine if the alert is a true positive and assess its priority.

Answer

Initiate the legal hold process to preserve evidence

Answer

Contain the threat by blocking the IP address on the firewall

Answer

Escalate the alert to Tier 2 for deeper investigation

Question 4

Which TWO characteristics are typical of host-based intrusion detection systems (HIDS) compared to network-based intrusion detection systems (NIDS)?

Accepted Answer

Visibility into local system events such as file system changes and registry modifications.. Option B is correct because a HIDS agent runs directly on the endpoint and monitors local activity such as file integrity changes, registry modifications, log entries, and process behavior, giving it deep host-level visibility that a NIDS, which only sees network packets, cannot provide. Option C is correct because a HIDS can inspect data after it has been decrypted on the host, so it can analyze encrypted traffic (e.g., TLS/HTTPS sessions) at the endpoint, whereas a NIDS typically sees only ciphertext on the wire and cannot decrypt it. Option A is wrong because protecting many devices simultaneously is a strength of NIDS, which can monitor a whole network segment from a central sensor, while HIDS requires an agent per host. Option D is wrong because HIDS agents run on the host and are themselves exposed to host-based attacks (e.g., tampering, rootkits), making them more—not less—susceptible. Option E is wrong because lower latency in detecting network attacks is characteristic of NIDS, which inspects traffic in real time on the network path, not of HIDS.

Answer

Better suited for protecting a large number of devices simultaneously.

Answer

Less susceptible to host-based attacks.

Answer

Lower latency in detecting network attacks.

Question 5

A company's security policy states that all network traffic must be inspected by an IPS. However, encrypted traffic (SSL/TLS) is bypassing inspection. The network team wants to implement SSL decryption. What is the primary policy consideration before implementing?

Accepted Answer

Obtain legal approval for decryption of user traffic.. SSL/TLS decryption involves intercepting and inspecting encrypted communications, which can violate privacy laws and regulations such as GDPR, HIPAA, or the Wiretap Act. Before implementing decryption, the organization must obtain legal approval to ensure compliance with applicable laws and to define the scope of inspection, especially regarding personal or sensitive data. Without legal clearance, the company could face severe penalties, even if the technical implementation is sound.

Answer

Configure the firewall to block SSL traffic that cannot be decrypted.

Answer

Notify all users that their traffic will be inspected.

Answer

Create a certificate authority to issue certificates to all internal servers.

Answer

Ensure that the SSL decryption device has enough CPU capacity.

Question 6

Refer to the exhibit. What type of activity does this log represent?

Accepted Answer

Brute force SSH attack.. The log shows repeated SSH connection attempts with 'Failed password' messages from the same source IP (10.10.0.5) to the same destination IP (10.10.0.3) for user 'admin'. This pattern of multiple failed authentication attempts in a short time window is characteristic of a brute force SSH attack, where an attacker systematically tries different passwords to gain unauthorized access.

Answer

Man-in-the-middle attack.

Answer

Denial-of-service (DoS) attack.

Answer

Port scan.

Question 7

A security analyst is reviewing logs to identify a potential brute force attack. Which TWO log entries would be most suspicious? (Choose TWO.)

Accepted Answer

Successful login from IP 10.0.0.9 after 50 failed attempts.. Option A is correct because a successful login immediately following 50 failed attempts from the same IP (10.0.0.9) indicates a probable successful brute force or password-guessing attack, where the attacker eventually guessed valid credentials. Option D is correct because 50 failed login attempts from a single IP (10.0.0.9) within only 2 minutes is a classic high-rate authentication failure pattern consistent with automated brute force tools. Option B is not suspicious because a single successful login from a known IP during business hours matches normal, expected user behavior. Option C is not suspicious on its own because a single failed login from an external IP at 3:00 AM could simply be a mistyped password or a legitimate off-hours attempt, lacking the volume or repetition of brute force. Option E is not suspicious because changing a password after a successful login is a routine, legitimate user action.

Answer

A single successful login from a known IP during business hours.

Answer

A failed login attempt from an external IP at 3:00 AM.

Answer

A user changing their password after a successful login.

Question 8

An intrusion analyst is analyzing a series of alerts from a network-based IDS. The alerts are triggered by the signature 'OVERFLOW-ICMP-ECHO' with a payload size of 65535 bytes. The source IP is a trusted internal server. What is the most likely explanation?

Accepted Answer

The IDS signature is incorrectly configured. The ICMP Echo (ping) payload size is limited to 65535 bytes, but the actual data portion of an ICMP packet cannot exceed 65535 minus the IP and ICMP header sizes (typically 20 + 8 = 28 bytes), making a payload of exactly 65535 bytes impossible under normal operation. Since the source IP is a trusted internal server, the most plausible cause is that the IDS signature is misconfigured—likely with an incorrect payload size threshold or a false positive trigger—rather than an actual overflow attempt.

Answer

The server is performing a ping sweep

Answer

There is a network error causing packet fragmentation

Answer

The server is under a DDoS attack

Question 9

Which compliance framework is specifically designed to protect the privacy and security of electronic health information in the United States?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the US federal law that specifically governs the privacy and security of protected health information (PHI) held by covered entities and business associates. It defines the Privacy Rule, Security Rule, and Breach Notification Rule, making it the direct answer for electronic health information in the United States. GDPR, ISO 27001, and PCI DSS address different scopes and jurisdictions.

Answer

GDPR

Answer

ISO 27001

Answer

PCI DSS

Question 10

Which of the following is a common indicator of DNS tunneling used for exfiltration?

Accepted Answer

DNS queries with long subdomain strings. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.

Answer

Frequent DNS queries to known domains

Answer

DNS responses with large payloads

Answer

DNS queries using TCP instead of UDP

Question 11

You are a security analyst for a financial institution. Over the past hour, the intrusion detection system has generated multiple alerts for outbound traffic from a single internal host (10.0.0.50) to various external IP addresses on port 443. The alerts indicate that the host is making HTTPS connections to IPs that are associated with known command and control servers. Additionally, the host has been observed making DNS queries for domains that are algorithmically generated (e.g., rgj3k2.example.com, fh7d8s.example.net). The host is a Windows 10 workstation used by an employee in the accounting department. The employee reports that they have not noticed any unusual behavior, but they did click on a link in a phishing email yesterday. The network administrator confirms that the host's firewall rules allow outbound HTTPS traffic. You have access to endpoint logs, network flow data, and packet captures. Which course of action should you take FIRST?

Accepted Answer

Isolate the host from the network to prevent further C2 communication. The immediate priority when confirmed C2 communication is detected is to contain the threat by isolating the host from the network. The combination of outbound HTTPS connections to known C2 servers and algorithmically generated domain (AGD) DNS queries strongly indicates active malware infection. Isolating the host (e.g., via network access control or switch port shutdown) stops data exfiltration and further command reception, which is the first step in incident response containment before any analysis or remediation.

Answer

Analyze packet captures to determine the full extent of the compromise

Answer

Block all outbound HTTPS traffic from the network

Answer

Reimage the host immediately to remove the malware

Question 12

You are a senior analyst in a SOC that monitors a large financial institution. The SIEM correlates events from firewalls, IDS, endpoints, and database servers. Over the past week, you have noticed multiple low-priority alerts from the IDS indicating 'ET SCAN NMAP -sS' scans from internal IP 10.0.0.50, which is a print server. The alerts occur at random times during business hours. The number of alerts has increased from 5 per day to 20 per day. The print server runs a standard OS and printer management software. No other alerts are triggered from that host. The firewall logs show outbound connections from the print server to IPs on the internet on port 443, which is abnormal for a print server. You check the printer management software and see no recent updates. The user of the print server, the IT administrator, reports no issues. What is your best course of action?

Accepted Answer

Isolate the print server from the network and conduct a forensic investigation. The print server at 10.0.0.50 is exhibiting multiple indicators of compromise: it is performing NMAP SYN scans (ET SCAN NMAP -sS) from an internal IP, and firewall logs show abnormal outbound HTTPS connections to internet IPs on port 443. These behaviors are inconsistent with a standard print server's role and suggest the host may be compromised, possibly acting as a pivot point for reconnaissance or command-and-control communication. Isolating the host and conducting a forensic investigation is the appropriate incident response step to contain the threat and determine the root cause before it can cause further damage.

Answer

Increase the alert threshold to reduce noise and continue monitoring

Answer

Disable the printer service on the server and monitor for recurrence

Answer

Dismiss the alerts as false positives because print servers often perform network discovery

Question 13

Which TWO of the following are valid reasons to use a proxy server for security monitoring? (Choose two.)

Accepted Answer

To inspect encrypted traffic by acting as a man-in-the-middle with SSL decryption. Option C is correct because a proxy can terminate TLS connections and perform SSL/TLS inspection (SSL decryption or break-and-inspect), decrypting traffic so it can be examined for malicious content before re-encrypting it to the destination. Option D is correct because a forward proxy sits inline on outbound traffic and can enforce access-control policies, URL/domain filtering, and block connections to known malicious destinations via threat-intelligence feeds. Option A is not a security-monitoring reason and proxies typically add latency rather than reduce it. Option B is inaccurate because a proxy only logs traffic that is routed through it, not all network traffic, so it cannot provide a complete forensic record. Option E is wrong because a proxy does not replace endpoint anti-malware; host-based protection is still required for local threats.

Answer

To reduce network latency for monitored traffic

Answer

To provide a complete log of all network traffic for forensics

Answer

To replace the need for endpoint anti-malware software

Question 14

An analyst identifies a series of SMB authentication attempts from a compromised host to multiple internal servers. The authentication uses NTLM hashes. Which TWO techniques are most likely being used for lateral movement? (Select 2)

Accepted Answer

SMB relay. SMB relay (B) is correct because the attacker can intercept NTLM authentication attempts from the compromised host and relay them to other internal servers, gaining unauthorized access without needing to crack the hash. This technique leverages the SMB protocol's lack of channel binding in older implementations, allowing the relayed hash to authenticate to multiple targets.

Answer

Kerberoasting

Answer

Brute force

Answer

Golden ticket

Question 15

An organization's security policy requires that all data at rest on laptops be encrypted. An employee reports that their laptop was stolen. Which control would most likely prevent data exposure?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) is the correct answer because it directly addresses the requirement that data at rest be encrypted. When a laptop is stolen, FDE ensures that the data on the drive is unreadable without the decryption key, which is typically derived from a user password or TPM-stored key. This prevents unauthorized access even if the attacker removes the drive and attempts to read it on another system. The policy explicitly mandates encryption, so FDE is the control that fulfills that requirement.

Answer

Remote wipe

Answer

Biometric authentication

Answer

Screen lock with password

Question 16

Which TWO are common sources of security event data in a Security Information and Event Management (SIEM) system?

Accepted Answer

NetFlow records. NetFlow records (B) are a common SIEM data source because they provide flow-level metadata—source/destination IP, ports, protocol, byte/packet counts, and timestamps—that SIEMs use for traffic analysis, anomaly detection, and threat hunting. Syslog from network devices (D) is also a core source, as routers, switches, and firewalls send event messages (e.g., RFC 5424/3164 format) to a SIEM for correlation and alerting. SMTP logs (A) are email-server logs and, while they can be ingested, they are not a common primary SIEM source category in the same way as flow and syslog data. SNMP traps (C) are asynchronous device notifications used mainly for network management/monitoring, not a standard SIEM event-data source. DNS queries (E) can be logged and analyzed for security (e.g., DNS tunneling), but they are a specialized telemetry type rather than one of the two common sources identified here.

Answer

SMTP logs

Answer

SNMP traps

Answer

DNS queries

Question 17

An organization uses STIX and TAXII to share threat intelligence with an ISAC. What is the purpose of TAXII in this scenario?

Accepted Answer

It provides a method to transport threat intelligence. TAXII is a protocol for exchanging STIX data.

Answer

It stores threat intelligence locally

Answer

It is a platform for malware analysis

Answer

It defines the format for threat indicators

Question 18

A network administrator has configured a SPAN port to send traffic to an intrusion detection system (IDS). However, the IDS is not seeing traffic from a specific VLAN. What is the most likely cause?

Accepted Answer

The SPAN source does not include that VLAN.. A SPAN (Switched Port Analyzer) port copies traffic from specified source interfaces or VLANs to a destination port. If the IDS is not seeing traffic from a specific VLAN, the most likely cause is that the SPAN configuration does not include that VLAN as a source. The administrator must explicitly specify the VLAN(s) to monitor using the `monitor session` command with the `vlan` keyword; otherwise, traffic from that VLAN will not be forwarded to the IDS.

Answer

The IDS interface is set to promiscuous mode.

Answer

The SPAN destination port is in trunk mode.

Answer

The IDS is in inline mode.

Question 19

During a risk assessment, a company identifies that the annualized loss expectancy (ALE) for a specific threat is $50,000. The cost to implement a mitigation control is $30,000 with an annual maintenance cost of $5,000. According to risk management principles, what is the most appropriate risk treatment option?

Accepted Answer

Mitigate the risk by implementing the control. If the cost of mitigation ($30,000 + $5,000 = $35,000) is less than the ALE ($50,000), it is cost-effective to mitigate the risk.

Answer

Accept the risk because the mitigation cost is higher than the ALE

Answer

Avoid the risk by discontinuing the activity

Answer

Transfer the risk by purchasing cyber insurance

Question 20

An organization wants to ensure that security logs are tamper-proof and available for forensic analysis. Which logging best practice should be implemented?

Accepted Answer

Forward logs to a centralized, hardened log server with access controls. Forwarding logs to a centralized, hardened log server with access controls ensures tamper resistance and preserves forensic integrity. Centralization removes logs from the source device where an attacker with local access could alter or delete them, and hardening plus access controls prevents unauthorized modification. This is a core logging best practice for forensic readiness.

Answer

Retain logs for only 30 days to reduce storage costs

Answer

Encrypt logs before sending them to a remote server

Answer

Store logs locally on each device with read-only permissions