200-201 Practice Test 26 — 15 Questions

Question 1

A security analyst is establishing a data classification policy. Which TWO categories are commonly included in a data classification policy?

Accepted Answer

Confidential. Common categories include public, internal, confidential, and restricted.

Answer

Archived

Answer

Encrypted

Answer

Backup

Question 2

In the NIST SP 800-61 Rev 2 incident response process, which phase involves activities such as performing lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. Post-Incident Activity includes lessons learned, updating plans, and metrics.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 3

An analyst is using Volatility's 'pslist' and 'pstree' commands on a memory dump. The output shows a process named 'lsass.exe' with a PID of 1024. However, the usual PID for lsass.exe on this system is 512. What does this discrepancy likely indicate?

Accepted Answer

It indicates a possible process hollowing or masquerading attack. The 'lsass.exe' process (Local Security Authority Subsystem Service) is a critical Windows system process responsible for enforcing security policies and handling authentication. Under normal conditions, lsass.exe runs as a child of 'winlogon.exe' or 'services.exe' with a consistent PID (often 512 or 528) across boots on a given system. A PID of 1024, especially when the known baseline is 512, strongly suggests that a malicious actor has spawned a fake 'lsass.exe' process via process hollowing (replacing the legitimate process's memory with malicious code) or masquerading (naming a malicious binary to mimic the legitimate one) to evade detection.

Answer

It shows that the system has multiple instances of lsass running

Answer

It is normal; the PID can vary between system boots

Answer

It suggests the process is a legitimate child of services.exe

Question 4

An incident handler collects a hard drive from a compromised server. To maintain chain of custody, which information must be documented?

Accepted Answer

The date, time, and signature of each person who handled the evidence. Chain of custody requires detailed documentation of who handled evidence and when.

Answer

The IP address of the server

Answer

The name of the antivirus software installed

Answer

The operating system version

Question 5

A SOC Tier 2 analyst receives an escalated alert about a potential command-and-control (C2) communication. The analyst needs to correlate network logs with threat intelligence. Which data format and transport protocol pair is specifically designed for standardized threat intelligence sharing?

Accepted Answer

STIX and TAXII. STIX is the format, TAXII is the transport protocol for sharing threat intelligence.

Answer

OpenIOC and MISP

Answer

MISP and STIX

Answer

TAXII and OpenIOC

Question 6

A company is implementing threat intelligence sharing. Which THREE standards or platforms are used for this purpose? (Select three.)

Accepted Answer

STIX. STIX, TAXII, and MISP are common threat intelligence sharing standards/platforms.

Answer

SIEM

Answer

OpenIOC

Question 7

An organization uses a qualitative risk assessment to evaluate a new vendor. Which characteristic is typical of qualitative risk assessments?

Accepted Answer

Ranks risks using scales such as high, medium, low. Qualitative assessments use subjective ratings like high, medium, low.

Answer

Calculates annual loss expectancy (ALE)

Answer

Assigns numeric probabilities and impact

Answer

Uses monetary values to estimate loss

Question 8

During which phase of the NIST SP 800-61 Rev 2 incident response process does an organization develop an incident response plan and assemble a team?

Accepted Answer

Preparation. The Preparation phase includes developing the IR plan, team, tools, and conducting exercises.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 9

A SOC Tier 1 analyst receives an alert for a potential malware infection. What is the primary responsibility of the Tier 1 analyst?

Accepted Answer

Perform initial triage and basic investigation. Tier 1 analysts monitor alerts and perform initial triage to determine if further investigation is needed.

Answer

Communicate with the media

Answer

Develop detection signatures

Answer

Conduct advanced malware analysis

Question 10

After containing a security incident, the incident response team eradicates the malware and restores systems from clean backups. Which phase of the NIST SP 800-61 Rev 2 process does this represent?

Accepted Answer

Containment, Eradication, and Recovery. Eradication removes the threat, and recovery restores normal operations.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Detection and Analysis

Question 11

A security analyst is triaging an alert about a user downloading a suspicious file. According to the NIST SP 800-61 Rev 2 incident response process, in which phase does initial triage occur?

Accepted Answer

Detection and Analysis. Initial triage is part of the Detection and Analysis phase, where alerts are evaluated to determine if they are actual incidents.

Answer

Containment, Eradication, and Recovery

Answer

Post-Incident Activity

Answer

Preparation

Question 12

During a security incident, the CISO decides to contain a compromised server by isolating it from the network. Which role is primarily responsible for making this containment decision based on business impact?

Accepted Answer

CISO. The CISO is the decision-maker for business impact and authorizes containment actions.

Answer

Incident handler

Answer

Legal counsel

Answer

PR representative

Question 13

An IDS detected the following signature match: "ET TROJAN Zeus variant outbound connection to C2 server". The destination IP is flagged as a known malicious host. What should the analyst do FIRST?

Accepted Answer

Open the packet capture associated with the alert. The first step in incident response after an IDS alert is to validate the alert by examining the associated packet capture (PCAP). This allows the analyst to confirm whether the traffic truly matches the Zeus C2 signature, check for false positives, and gather contextual details such as payload content, timing, and protocol behavior. Without this validation, any subsequent action (blocking, isolating) could be premature or based on incomplete information.

Answer

Block the destination IP at the firewall

Answer

Ignore the alert because signatures can produce false positives

Answer

Isolate the source host from the network immediately

Question 14

A security policy mandates that all network devices must be hardened. Which THREE of the following are common hardening best practices for routers and switches? (Select three.)

Accepted Answer

Implement access control lists (ACLs). Implementing access control lists (ACLs) on routers and switches is a fundamental hardening practice because ACLs filter traffic based on source/destination IP addresses, ports, and protocols, thereby restricting unauthorized access and mitigating threats like spoofing or reconnaissance. By default, Cisco devices permit all traffic unless explicitly denied, so ACLs enforce the principle of least privilege at the network layer.

Answer

Enable Telnet for remote management

Answer

Use default credentials for initial setup

Question 15

You are a cybersecurity analyst at a large enterprise. The NOC team reports that users are experiencing intermittent connectivity to the company's internal web application hosted on 192.168.1.100:443. You review the IPS logs and see repeated alerts for signature 'ET WEB_SERVER Possible HTTP Response Splitting' triggered by traffic from the web server to internal clients. The signature fires on responses containing CRLF sequences. You examine a packet capture and observe that the web server sends HTTP responses with legitimate headers but occasionally includes extra CRLF sequences in the body. The application developers confirm that the web application is custom and uses unfiltered user input in HTTP headers. The security policy requires that all internal traffic be inspected and blocked by the IPS. What is the best course of action?

Accepted Answer

Request that the development team sanitize user input in HTTP headers to prevent CRLF injection, and in the meantime, create a custom signature that ignores CRLF sequences in the response body but alerts on header injection.. The root cause is a vulnerability in the custom web application that allows CRLF injection into HTTP headers, which the IPS correctly detects as a potential HTTP Response Splitting attack. Simply disabling or bypassing the signature (options A, B, C) would leave the network exposed to a real security risk. The best course is to fix the application code to sanitize user input, and in the interim, create a custom IPS signature that differentiates between benign CRLF sequences in the response body (which are not exploitable) and malicious CRLF sequences in headers, thus maintaining security while reducing false positives.

Answer

Increase the threshold for the signature to require multiple occurrences before alerting, but keep blocking enabled.

Answer

Disable the HTTP Response Splitting signature entirely to restore connectivity, as the issue is a false positive.

Answer

Whitelist the web server IP address in the IPS policy so that traffic from that server is not inspected.