200-201 Practice Test 26 — 15 Questions

Question 1

During a security incident, a security analyst isolates an affected host and collects a memory dump. According to incident response procedures, what is the next step the analyst should take?

Accepted Answer

Analyze the memory dump to identify indicators of compromise. After isolating the host and collecting a memory dump, the next step is to analyze the dump to extract volatile evidence such as running processes, network connections, and injected code. This analysis identifies indicators of compromise (IoCs) that inform containment and eradication. Skipping analysis would lose critical forensic data and hinder understanding of the attack vector.

Answer

Reboot the host to clear any malware from memory

Answer

Notify the public relations team immediately

Answer

Restore the host from a known good backup

Question 2

When performing file analysis, which method is most reliable for determining the actual file type regardless of its extension?

Accepted Answer

Examining the file's magic bytes. Magic bytes (or file signatures) are unique byte sequences at the beginning of a file that identify its format regardless of the file extension. This method is reliable because it examines the actual binary content, such as the 'PK' header for ZIP files or '‰PNG' for PNG images, rather than relying on user-assigned metadata that can be easily changed.

Answer

Opening the file in a text editor

Answer

Checking the file extension

Answer

Checking the file size

Question 3

An analyst is reviewing PCAP and sees a TCP stream with a Wireshark filter 'tcp.stream eq 0'. The conversation shows an interactive shell session with commands like 'whoami' and 'ls'. This is most likely evidence of what?

Accepted Answer

Reverse shell. The PCAP shows an interactive shell session with commands like 'whoami' and 'ls' over TCP. This is characteristic of a reverse shell, where an attacker compromises a host and establishes a command-and-control channel back to their machine, allowing interactive command execution. The use of 'tcp.stream eq 0' in Wireshark simply isolates a specific TCP conversation, and the presence of shell commands confirms a reverse shell.

Answer

DNS tunneling

Answer

SQL injection

Answer

ARP spoofing

Question 4

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Answer

Enable port security on all switches.

Answer

Use VLAN segmentation.

Answer

Implement 802.1X authentication.

Question 5

Which TWO are common indicators of a phishing email? (Select two.)

Accepted Answer

Urgent call to action. Phishing emails often create a false sense of urgency to pressure recipients into acting without verifying the source. An urgent call to action, such as 'Your account will be suspended in 24 hours,' is a classic social engineering tactic that exploits fear or time pressure to bypass rational scrutiny.

Answer

Personal salutation

Answer

Proper spelling and grammar

Answer

Matching sender domain

Question 6

Which risk treatment option involves taking actions to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigation (also called risk reduction) is the risk treatment option where an organization takes deliberate actions to lower either the likelihood that a risk materializes or the severity of its impact if it does. Examples include applying patches, adding firewalls, or implementing MFA. It is the only option that actively modifies the risk itself rather than shifting, eliminating, or tolerating it.

Answer

Accept

Answer

Transfer

Answer

Avoid

Question 7

Which risk treatment option involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Mitigate. Mitigate is the risk treatment option that involves implementing security controls to reduce the likelihood or impact of a risk. This can include technical controls (e.g., firewalls, encryption), administrative controls (e.g., policies, training), or physical controls (e.g., locks, guards). Mitigation aims to bring the risk down to an acceptable level rather than eliminating it entirely.

Answer

Avoid

Answer

Transfer

Answer

Accept

Question 8

A security analyst notices repeated failed login attempts from a single IP address against multiple user accounts. What is the best immediate action to take?

Accepted Answer

Block the source IP address on the firewall.. Blocking the source IP address on the firewall is the best immediate action because it stops the ongoing brute-force attack at the network perimeter, preventing further authentication attempts from that IP without disrupting legitimate users. This aligns with the principle of containment before investigation, as the firewall ACL can be updated quickly to deny traffic from the offending source.

Answer

Increase logging verbosity for the authentication server.

Answer

Change all user passwords immediately.

Answer

Disable the affected user accounts.

Question 9

In the NIST SP 800-61 Rev 2 incident response process, which phase involves activities such as performing lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. Post-Incident Activity includes lessons learned, updating plans, and metrics.

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Question 10

Which component of a SIEM is responsible for converting log data from various sources into a standard format?

Accepted Answer

Normalization. Normalization is the SIEM component that parses incoming log data from diverse sources (e.g., syslog, Windows Event Log, NetFlow) and maps the fields into a common, standardized schema. This process ensures that fields like source IP, destination IP, and timestamp are consistently named and formatted, enabling effective correlation and analysis across heterogeneous devices.

Answer

Aggregation

Answer

Alerting

Answer

Correlation

Question 11

Refer to the exhibit. An EDR alert shows this JSON event. What is the most significant indicator of a potential malware infection?

Accepted Answer

The process path is in the Downloads folder.. The process path in the Downloads folder is the most significant indicator because it suggests the executable was downloaded from the internet, a common vector for malware delivery. Attackers frequently use social engineering to trick users into saving malicious files to the Downloads folder, which then execute and initiate infection chains. In EDR analysis, execution from user-writable directories like Downloads is a high-fidelity alert, as legitimate software is rarely launched from this location.

Answer

The user is 'jsmith'.

Answer

The parent process is explorer.exe.

Answer

The event type is 'Process Creation'.

Question 12

A network engineer configures a SPAN port to send traffic from a critical server to an IDS. After configuration, the IDS sees no traffic. What is the most likely issue?

Accepted Answer

The monitor session source interface is incorrectly specified.. The most likely issue is that the monitor session source interface is incorrectly specified. SPAN (Switched Port Analyzer) requires the engineer to designate the correct source interface (the port connected to the critical server) and a destination interface (the port connected to the IDS). If the source interface is misconfigured—for example, pointing to the wrong switch port or using a VLAN instead of a specific port—the IDS will receive no mirrored traffic. This is a common configuration error when setting up local SPAN on Cisco switches.

Answer

The IDS is in a different subnet.

Answer

The SPAN destination interface is not connected to the IDS.

Answer

The server is using VLAN tagging.

Question 13

An analyst is investigating a potential DNS tunneling attack. Which characteristic in DNS traffic would most likely indicate DNS tunneling?

Accepted Answer

DNS queries with long, random-looking subdomains to a single domain.. DNS tunneling encodes data (e.g., stolen files, C2 commands) into the query name itself, so the attacker generates long, high-entropy subdomains like 'a8f3k2...exfil.attacker.com' under a single controlled domain. The randomness defeats signature-based detection, and the length maximizes the bytes smuggled per query. This pattern — many unique, long, random labels pointing to one authoritative domain — is the hallmark of tools such as iodine, dnscat2, and DNSExfiltrator.

Answer

Frequent DNS queries to the same domain at regular intervals.

Answer

DNS queries for domains that are known to be malicious.

Answer

DNS query responses with unusually large payload sizes.

Question 14

You are a cybersecurity analyst in a SOC. The company uses a combination of Snort NIDS and Windows Event Log monitoring. At 3:00 PM, you receive a critical alert: 'ET TROJAN Observed Malicious SSL Certificate (Fake Google)'. The alert shows that a workstation (IP 10.0.1.45) initiated an SSL connection to IP 192.0.2.10 on port 443. The certificate presented by the server is self-signed and claims to be 'google.com'. The destination IP is not in any known Google IP range. You check the firewall logs and see that the outbound connection was allowed. The workstation's host logs show that the user is a marketing employee who frequently accesses webmail. The user reports no unusual behavior. You also check the company's web proxy logs and see that the user accessed 'http://www.google.com' earlier today, but the SSL connection is to a different IP. What should be your next step?

Accepted Answer

Isolate the workstation from the network and perform a forensic analysis. The alert indicates a potential man-in-the-middle (MITM) attack or malware using a self-signed SSL certificate impersonating google.com. Isolating the workstation is critical to prevent lateral movement or data exfiltration while preserving evidence for forensic analysis. The combination of Snort NIDS detecting the malicious certificate and the connection to an unknown IP (192.0.2.10) strongly suggests compromise, regardless of user reports.

Answer

Ignore the alert because the user is unaware of any issue

Answer

Wait and monitor the workstation for further alerts before taking action

Answer

Block the destination IP 192.0.2.10 on the firewall

Question 15

An analyst sees an alert from the IDS: 'ET TROJAN Possible Zeus Variant Outbound Connection'. What action should the analyst take first?

Accepted Answer

Investigate the source host for signs of compromise. The first priority when an IDS alerts on a possible Zeus variant (a known Trojan) is to investigate the source host to confirm or rule out compromise. Zeus is a credential-stealing Trojan that often establishes outbound C2 (command-and-control) traffic; blindly blocking the IP (A) could disrupt the investigation and may not stop the malware if it uses domain flux or multiple IPs. Reimaging (D) destroys forensic evidence, and ignoring the alert (B) is negligent given the severity of Zeus. The analyst must perform host-based analysis (e.g., check processes, registry, network connections) to validate the alert before taking containment actions.

Answer

Block the IP address on the firewall

Answer

Ignore the alert as a false positive

Answer

Reimage the host immediately