200-201 Practice Test 5 — 25 Questions

Question 1

An analyst is using Volatility's 'pslist' and 'pstree' commands on a memory dump. The output shows a process named 'lsass.exe' with a PID of 1024. However, the usual PID for lsass.exe on this system is 512. What does this discrepancy likely indicate?

Accepted Answer

It indicates a possible process hollowing or masquerading attack. The 'lsass.exe' process (Local Security Authority Subsystem Service) is a critical Windows system process responsible for enforcing security policies and handling authentication. Under normal conditions, lsass.exe runs as a child of 'winlogon.exe' or 'services.exe' with a consistent PID (often 512 or 528) across boots on a given system. A PID of 1024, especially when the known baseline is 512, strongly suggests that a malicious actor has spawned a fake 'lsass.exe' process via process hollowing (replacing the legitimate process's memory with malicious code) or masquerading (naming a malicious binary to mimic the legitimate one) to evade detection.

Answer

It shows that the system has multiple instances of lsass running

Answer

It is normal; the PID can vary between system boots

Answer

It suggests the process is a legitimate child of services.exe

Question 2

An analyst is investigating a Windows host and observes a suspicious process with PID 1337. Which THREE of the following Volatility commands would provide useful information about this process? (Choose three.)

Accepted Answer

cmdline. The `cmdline` plugin displays the command-line arguments used to start a process, which is critical for identifying malicious or suspicious execution patterns (e.g., obfuscated paths, encoded commands). For PID 1337, this reveals exactly how the process was launched, helping to confirm or refute malicious intent.

Answer

hivelist

Answer

connscan

Question 3

An analyst wants to determine if a specific executable has been run on a Windows system. Which artifact provides evidence of prior execution?

Accepted Answer

Prefetch files. Prefetch files (.pf) are created by Windows when an executable runs, storing execution details such as the first eight file paths referenced and the last run time. Analyzing Prefetch files allows an analyst to determine if a specific executable has been executed, even if the executable itself has been deleted. This makes Prefetch the most direct artifact for evidence of prior execution.

Answer

Registry Run keys

Answer

Task Scheduler logs

Answer

Windows Event Logs

Question 4

An analyst runs Volatility's pstree plugin on a memory dump. The output shows that a process 'svchost.exe' is the child of 'explorer.exe'. What is suspicious about this?

Accepted Answer

svchost.exe should be a child of services.exe, not explorer.exe. Option C is correct because in a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

Answer

explorer.exe should not have any child processes

Answer

Nothing, svchost.exe can be a child of any process

Answer

The pstree output is unreliable

Question 5

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 6

A SOC analyst is investigating a suspected data exfiltration. Which THREE indicators in network traffic are most consistent with exfiltration? (Choose three.)

Accepted Answer

Large outbound data transfers to an external IP at unusual hours. Large outbound data transfers to an external IP at unusual hours (A) are a classic indicator of data exfiltration because attackers often move stolen data during off-peak times to evade detection. This behavior deviates from normal business traffic patterns and can be flagged by network monitoring tools as anomalous. The volume and timing together suggest intentional data theft rather than routine operations.

Answer

Consistent HTTPS traffic to a CDN

Answer

Increased inbound web traffic

Question 7

An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?

Accepted Answer

Command and Control. The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Answer

Delivery

Answer

Actions on Objectives

Answer

Installation

Question 8

During a forensic analysis, an analyst uses NetworkMiner to extract files from a PCAP. One of the extracted files contains a PE executable with a known signature of a malware variant. Which phase of the Cyber Kill Chain does the file transfer most likely represent?

Accepted Answer

Delivery. The file transfer from the PCAP represents the Delivery phase because NetworkMiner extracted a PE executable that was transmitted over the network, likely via HTTP, SMTP, or SMB. In the Cyber Kill Chain, Delivery is the phase where the weaponized payload is transmitted to the target system, which is exactly what a file transfer in a PCAP captures. The presence of a known malware signature confirms the payload was delivered, not yet executed or exploited.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation

Question 9

An analyst reviews a PCAP and sees HTTP requests containing script tags and event handlers such as 'onload' and 'onerror'. Additionally, the URI contains 'alert(1)'. Which TWO types of attacks are indicated? (Select 2)

Accepted Answer

Reflected XSS. The presence of script tags, event handlers like 'onload' and 'onerror', and the URI containing 'alert(1)' indicates that the attacker is injecting client-side script into the HTTP response. Since the payload is reflected in the URI (likely in a query parameter or path) and executed immediately in the browser without being stored on the server, this is Reflected XSS (option B). The same payload can also be executed via client-side JavaScript that manipulates the DOM using untrusted data from the URI, which is characteristic of DOM-based XSS (option C).

Answer

Command injection

Answer

Stored XSS

Answer

SQL injection

Question 10

An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?

Accepted Answer

SQL injection. The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.

Answer

Command injection

Answer

Cross-site scripting

Answer

Directory traversal

Question 11

Which of the following is a common indicator of DNS tunneling used for exfiltration?

Accepted Answer

DNS queries with long subdomain strings. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.

Answer

Frequent DNS queries to known domains

Answer

DNS responses with large payloads

Answer

DNS queries using TCP instead of UDP

Question 12

Which tool can be used to extract files from a PCAP file for further analysis?

Accepted Answer

Wireshark (Export Objects). Wireshark's 'Export Objects' feature allows you to extract files (e.g., HTTP objects, SMB files, or other application-layer payloads) from a PCAP file. This is essential for further analysis of malware or data exfiltration, as it reconstructs the original files from the captured network streams without needing to replay the traffic.

Answer

Snort

Answer

tcpdump

Answer

nmap

Question 13

In the Cyber Kill Chain, which TWO phases occur after the attacker establishes command and control (C2)?

Accepted Answer

Lateral movement. After establishing command and control (C2), the attacker typically performs lateral movement to pivot within the network and then executes actions on objectives, such as data exfiltration or system disruption. In the Cyber Kill Chain, the phases following C2 are lateral movement and actions on objectives, as the attacker uses the C2 channel to explore the environment and achieve their end goal.

Answer

Exploitation

Answer

Weaponisation

Answer

Installation

Question 14

An organization is implementing a threat intelligence sharing program. They want to exchange both structured indicators and full reports with other members of their ISAC. Which combination of standards/protocols should they choose? (Choose two.)

Accepted Answer

TAXII. STIX (Structured Threat Information Expression) is the standard for representing structured threat indicators and full reports, while TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging that STIX content over HTTPS. Together, they enable ISAC members to share both machine-readable indicators and human-readable reports in a standardized, automated manner.

Answer

Snort rules

Answer

OpenIOC

Answer

MISP

Question 15

An organization is conducting a risk assessment and assigns a monetary value to potential losses. Which risk assessment method is being used?

Accepted Answer

Quantitative risk assessment. Assigning a monetary value to potential losses is a hallmark of quantitative risk assessment. This method uses numerical data (e.g., dollar amounts, percentages) to calculate metrics such as Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE), enabling objective comparison of risks. In contrast, qualitative methods rely on subjective ratings like high/medium/low.

Answer

Risk treatment

Answer

Qualitative risk assessment

Answer

Risk identification

Question 16

An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?

Accepted Answer

Use a write blocker when creating the forensic image. Option C is correct because a write blocker is a hardware or software tool that intercepts and blocks any write commands to the original drive, ensuring that no data is altered during the forensic imaging process. This is essential to maintain the integrity of the evidence, as any modification could render the data inadmissible in legal proceedings. Without a write blocker, even a simple read operation from the operating system could trigger unintended writes (e.g., metadata updates, file system journaling).

Answer

Store the original drive in a Faraday bag

Answer

Copy files directly to an external drive using the operating system

Answer

Boot the system from the hard drive to collect volatile data

Question 17

During the Detection and Analysis phase of incident response, a SOC Tier 1 analyst identifies a potential malware infection on a critical server. What is the FIRST action the analyst should take according to NIST SP 800-61 Rev 2?

Accepted Answer

Perform initial triage and prioritize the incident based on severity and impact.. According to NIST SP 800-61 Rev 2, the first step in the Detection and Analysis phase is to perform initial triage and prioritize the incident based on severity and impact. This ensures that resources are allocated appropriately before any containment or escalation actions are taken. Option C is correct because triage is the foundational action that determines the urgency and scope of the response.

Answer

Disconnect the server from the network immediately to contain the threat.

Answer

Escalate the incident to Tier 3 for advanced malware analysis.

Answer

Notify legal counsel and PR to prepare for potential data breach.

Question 18

Which element of the CIA triad is primarily concerned with preventing unauthorized access to data?

Accepted Answer

Confidentiality. Confidentiality is the CIA triad element that ensures data is accessible only to authorized users. It is primarily enforced through encryption (e.g., AES-256 for data at rest, TLS 1.3 for data in transit) and access control mechanisms (e.g., RBAC, ACLs). Preventing unauthorized access directly aligns with confidentiality's goal of protecting data from disclosure.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 19

An organization experiences a ransomware attack where files are encrypted and a ransom is demanded. Which element of the CIA triad is most directly impacted?

Accepted Answer

Availability. A ransomware attack encrypts files and demands payment, directly preventing users from accessing their data and systems. This loss of access is a direct impact on Availability, which ensures that information and resources are accessible when needed. The CIA triad's Availability element is most immediately compromised because the organization cannot retrieve or use its encrypted files.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality

Question 20

An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Answer

DNS poisoning

Answer

Replay attack

Answer

ARP spoofing