200-201 Practice Test 5 — 25 Questions

Question 1

A network analyst is creating a baseline for normal network traffic. Which TWO metrics should be included to establish a baseline?

Accepted Answer

Average bandwidth usage over time. Baselines include average bandwidth usage and typical protocol distribution. Peak traffic times and unusual payload sizes are anomalies, not baseline metrics.

Answer

Excessive connection attempts from a single IP

Answer

Peak traffic times

Answer

Unusual payload sizes

Question 2

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following network behaviors are indicators of data exfiltration?

Accepted Answer

Frequent DNS queries to a known malicious domain. Data exfiltration often involves large outbound transfers (volume anomaly) and communication with known malicious IPs. DNS tunneling can also be used, but it's not the only indicator. The two best are unusual large outbound traffic and connections to known malicious IPs.

Answer

A high number of ICMP echo requests

Answer

A single host scanning multiple internal IPs

Answer

Multiple successful login attempts from a single IP

Question 3

A NetFlow analysis shows that a single internal IP sent 10 GB of data to an external IP within one hour, whereas the baseline for that host is typically 100 MB per day. Which type of activity does this indicate?

Accepted Answer

Data exfiltration. A sudden large volume of outbound data from a host that normally sends little is a classic indicator of data exfiltration.

Answer

Denial of service attack

Answer

Network scanning

Answer

Normal business activity

Question 4

A security analyst is using Zeek to analyze network traffic. Which Zeek log would be most useful for identifying HTTP requests to a known malicious domain?

Accepted Answer

http.log. Zeek's HTTP log records details of HTTP requests, including the host header (domain).

Answer

ssl.log

Answer

conn.log

Answer

dns.log

Question 5

A network administrator is creating a baseline for normal traffic patterns. Which of the following should be considered typical for a web server during business hours?

Accepted Answer

High volume of TCP SYN packets to port 443. A web server typically receives HTTP/HTTPS traffic on ports 80/443. High volumes of SYN packets to port 443 are normal for web traffic.

Answer

High volume of DNS queries to external domains

Answer

High volume of SSH connections on port 22

Answer

High volume of ICMP echo requests

Question 6

A SOC analyst observes a spike in DNS queries for long, random-looking subdomains under a single domain from an internal host. The responses are NXDOMAIN. Which type of activity is most likely indicated?

Accepted Answer

DNS tunneling. Random subdomain queries with NXDOMAIN responses are typical of a DNS tunneling attempt used for data exfiltration or C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for many websites

Answer

Misconfigured DNS server

Question 7

A security analyst is investigating an alert from a Windows system log that shows multiple failed logon attempts for the same user account within a short period, followed by a successful logon. Which type of attack does this pattern suggest?

Accepted Answer

Brute-force attack. Multiple failed logons followed by a success indicates a brute-force attack where the attacker eventually guessed the correct password.

Answer

Pass-the-hash attack

Answer

Denial-of-service attack

Answer

Phishing attack

Question 8

A security analyst observes a NetFlow record showing a single internal IP communicating with many external IPs on port 445 within seconds. This pattern is indicative of:

Accepted Answer

SMB scanning. Port 445 is used by SMB; a rapid series of connections to many IPs suggests a scan for vulnerable SMB services.

Answer

DNS tunneling

Answer

Data exfiltration

Answer

Port scan

Question 9

Which port is used by RDP (Remote Desktop Protocol) and is a common target for brute force attacks?

Accepted Answer

3389. RDP uses TCP port 3389 and is frequently targeted by attackers attempting to gain remote access.

Answer

443

Answer

22

Answer

1433

Question 10

A security engineer is setting up a Snort rule to detect FTP traffic where the source IP is not from the internal network. Which Snort rule header correctly specifies the action, protocol, source, and destination?

Accepted Answer

alert tcp !$HOME_NET any -> any 21. The correct Snort rule header format is: alert tcp !$HOME_NET any -> any 21. It alerts on TCP traffic from any IP not in $HOME_NET to any destination on port 21 (FTP).

Answer

alert tcp $HOME_NET any -> any 21

Answer

alert tcp any any -> any 21

Answer

alert udp any any -> any 21

Question 11

An analyst sees a Snort alert with the message 'ET POLICY Outbound connection to known malicious IP'. What does this indicate?

Accepted Answer

An internal host is connecting to an IP that is on a threat intelligence blacklist.. Snort signature-based IDS alerts on matching rules. This alert indicates a connection from an internal host to a known malicious IP address, likely a command-and-control server.

Answer

A malicious IP is connecting to an internal host.

Answer

The firewall blocked the connection.

Answer

The connection is encrypted and safe.

Question 12

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices on the same network. Which attack technique is being used?

Accepted Answer

Man-in-the-Middle. Man-in-the-Middle attacks intercept and alter communications between two parties.

Answer

Reconnaissance

Answer

ARP spoofing

Answer

DNS poisoning

Question 13

A security analyst is notified that an employee's laptop was stolen. The laptop contains sensitive customer data. Which type of threat does this incident represent?

Accepted Answer

Threat. The threat is the potential compromise of confidentiality due to physical theft of a device containing sensitive data.

Answer

Exploit

Answer

Risk

Answer

Vulnerability

Question 14

A security analyst is assessing the risks to a company's data. The analyst identifies a vulnerability in the web application that could allow SQL injection. Which TWO terms correctly describe the elements of this risk scenario? (Choose two.)

Accepted Answer

The SQL injection flaw in the application is a vulnerability.. The SQL injection flaw is a vulnerability (weakness). The potential for an attacker to exploit it is a threat. Risk is the likelihood and impact combined.

Answer

The SQL injection flaw in the application is a threat.

Answer

The combination of the vulnerability and threat is the exploit.

Answer

The possibility of an attacker exploiting the SQL injection is a vulnerability.

Question 15

Which THREE of the following are common Indicators of Compromise (IoCs) used in threat intelligence?

Accepted Answer

IP addresses. IP addresses are a primary Indicator of Compromise (IoC) because they directly identify the network location of a malicious host, such as a command-and-control (C2) server or a source of an attack. In threat intelligence, IP addresses are used to block traffic, enrich alerts, and correlate events across different data sources. They are a foundational IoC because they are observable in network logs, firewall logs, and IDS/IPS alerts.

Answer

User-agent strings

Answer

Port numbers

Question 16

A security analyst is reviewing logs from a web server and notices a high volume of HTTP requests from a single IP address targeting the same login page within a short time frame. The analyst suspects a brute force attack. Which TWO actions are most appropriate to mitigate this type of attack? (Choose two.)

Accepted Answer

Implement rate limiting on the login endpoint.. Implementing account lockout after a few failed attempts prevents further brute force attempts on the same account. Rate limiting restricts the number of requests from a single IP, slowing down the attack.

Answer

Disable the login page entirely.

Answer

Block all traffic from the offending IP address permanently.

Answer

Increase the password complexity requirements.

Question 17

An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?

Accepted Answer

Man-in-the-Middle. Man-in-the-Middle (MitM) attack involves an attacker intercepting and potentially altering communication between two parties without their knowledge.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 18

A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?

Accepted Answer

DDoS. A DDoS uses multiple sources to flood a target, making it unavailable.

Answer

ARP spoofing

Answer

DoS

Answer

DNS poisoning

Question 19

A security analyst is configuring a firewall to block common reconnaissance techniques. Which THREE types of reconnaissance traffic should be blocked to prevent active reconnaissance? (Choose three.)

Accepted Answer

Vulnerability scanning. Active reconnaissance involves direct interaction with the target. Port scanning, ping sweeps, and vulnerability scanning are active methods. Passive reconnaissance includes social engineering, Google searches, and WHOIS lookups.

Answer

Social engineering

Answer

WHOIS lookups

Question 20

A SOC analyst is reviewing firewall logs and sees repeated entries: 'Deny TCP 10.0.0.5:49152 -> 203.0.113.1:22' and 'Deny TCP 10.0.0.5:49153 -> 203.0.113.1:22'. What does this pattern suggest?

Accepted Answer

An SSH brute-force attack from the internal host. Multiple denied connection attempts from the same internal IP to the same external IP on port 22 (SSH) with different source ports indicates a brute-force SSH attack. The firewall is denying the connections, but the pattern is indicative of an attack.

Answer

DNS tunneling

Answer

A legitimate SSH session

Answer

A port scan from the external host