200-201 Practice Test 27 — 15 Questions

Question 1

An analyst is examining a suspicious file that appears to be a PDF but when checking the magic bytes at offset 0, sees '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is a ZIP archive. The magic bytes '50 4B 03 04' at offset 0 are the ZIP file signature (PK\x03\x04). A genuine PDF must begin with '%PDF' (hex 25 50 44 46). Since the file claims to be a PDF but its header identifies it as a ZIP archive, this is a classic file-extension spoofing or polyglot technique used by malware to evade detection.

Answer

The file is a genuine PDF file

Answer

The file is a plain text file

Answer

The file is an executable

Question 2

An analyst is examining a PCAP file for signs of lateral movement. Which TWO of the following are typical indicators of lateral movement using pass-the-hash?

Accepted Answer

Multiple SMB authentication attempts from a single host to multiple other hosts. Option A is correct because pass-the-hash lateral movement typically manifests as a single compromised host authenticating over SMB (TCP 445) to numerous other hosts in rapid succession, as the attacker reuses the stolen hash to pivot across the network. Option E is correct because the defining characteristic of pass-the-hash is that NTLM authentication succeeds using only the captured NTLM hash (via tools like Mimikatz or Impacket's psexec/smbexec) without ever knowing or supplying the plaintext password. Option B is not a pass-the-hash indicator, since HTTP requests to a web server reflect normal web traffic rather than NTLM-based host-to-host authentication. Option C is unrelated, as ICMP timestamp requests are diagnostic network probes and not part of the NTLM/SMB authentication process. Option D is also unrelated, because FTP file transfers use a separate cleartext protocol and do not demonstrate hash-based credential reuse.

Answer

HTTP requests to a web server

Answer

ICMP timestamp requests

Answer

Large file transfers using FTP

Question 3

A SOC team is implementing a security monitoring solution for a cloud-based infrastructure. Which of the following is the most important consideration for effective monitoring?

Accepted Answer

Centralized logging from all cloud services and on-premises.. Centralized logging is the most important consideration because it provides a single, unified view of security events across all cloud services and on-premises infrastructure. Without aggregation, the SOC cannot correlate events, detect distributed attacks, or perform effective threat hunting. This aligns with the principle of 'visibility first' in security monitoring.

Answer

Encrypting all logs at rest.

Answer

Reducing log retention to save cost.

Answer

Using only native cloud monitoring tools.

Question 4

A security analyst is reviewing a Wireshark capture and notices a large number of TCP SYN packets sent to multiple ports on a single host from the same source IP. Which type of network activity is most likely being observed?

Accepted Answer

Port scan. A port scan is characterized by multiple connection attempts to different ports on a target host, often using SYN packets.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

Man-in-the-middle attack

Question 5

An analyst is examining a YARA rule that contains the condition: 'uint16(0) == 0x5a4d and filesize < 500KB'. What type of file is this rule targeting?

Accepted Answer

Windows executable files. The condition 'uint16(0) == 0x5a4d' checks the first two bytes of a file for the hexadecimal value 0x5a4d, which corresponds to the ASCII characters 'MZ'. This 'MZ' signature is the magic number for DOS/Windows executable files (e.g., .exe, .dll). The additional constraint 'filesize < 500KB' further narrows the rule to small Windows executables. Therefore, the rule targets Windows executable files.

Answer

PDF files

Answer

JPEG images

Answer

Linux ELF files

Question 6

A security analyst is investigating a Windows host suspected of malware infection. Which tool would allow the analyst to view parent-child relationships of running processes and inspect command line arguments?

Accepted Answer

Process Explorer. Process Explorer, part of Microsoft Sysinternals, provides a hierarchical view of running processes, showing parent-child relationships and allowing inspection of command-line arguments via the process properties. It also offers advanced features like VirusTotal integration and handle/ DLL views, making it the ideal tool for this investigation.

Answer

Task Manager

Answer

tasklist command

Answer

Resource Monitor

Question 7

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Accepted Answer

Frequent use of TXT record type in DNS queries. Option A is correct because DNS tunneling often abuses TXT records, which can carry arbitrary text payloads, to exfiltrate data or receive commands from a C2 server. Option B is correct because tunneling responses frequently contain encoded data, making DNS responses larger than the typical small A-record response. Option E is correct because a single host generating a high volume of DNS queries to one domain is a classic beaconing/tunneling indicator. Option C is not correct because high TTL values are not characteristic of DNS tunneling; tunneling often uses low or zero TTLs to avoid caching. Option D is not correct because queries to multiple well-known domains are common benign behavior and do not specifically indicate DNS tunneling.

Answer

DNS queries with TTL values greater than 86400

Answer

DNS queries for multiple well-known domains

Question 8

An organization's incident response team has identified a malware infection on a critical server. They need to collect evidence for potential legal action. Which of the following is the most important step to ensure the admissibility of the evidence?

Accepted Answer

Documenting the chain of custody for all evidence. Maintaining a proper chain of custody documents who handled the evidence and ensures it has not been tampered with, which is critical for legal admissibility.

Answer

Contacting legal counsel before proceeding

Answer

Creating a forensic image of the affected hard drive

Answer

Isolating the server from the network

Question 9

Which Cisco tool provides network-wide visibility and can detect anomalies using NetFlow and behavioral analysis?

Accepted Answer

Cisco Secure Network Analytics (Stealthwatch). Cisco Secure Network Analytics (formerly Stealthwatch) is the correct answer because it is a dedicated network visibility and security analytics platform that leverages NetFlow, IPFIX, and other telemetry sources to perform behavioral analysis and detect anomalies across the entire network. Unlike a firewall or switch, its primary function is to ingest flow data and apply machine learning models to identify threats such as lateral movement, data exfiltration, and command-and-control traffic.

Answer

Cisco Firepower Threat Defense (FTD)

Answer

Cisco Catalyst 9300 Switch

Answer

Cisco Identity Services Engine (ISE)

Question 10

An organization wants to ensure that a received email genuinely came from the claimed sender and has not been altered. Which cryptographic mechanism provides both authentication and integrity?

Accepted Answer

Digital signature. A digital signature uses the sender's private key to sign the message, and the recipient verifies it with the sender's public key. This process provides authentication (proving the sender's identity) and integrity (detecting any alteration) because any change to the message invalidates the signature. Hash functions alone provide integrity but not authentication, while PKI is the infrastructure that supports digital signatures but is not the mechanism itself.

Answer

Hash function

Answer

Public key infrastructure (PKI)

Answer

Symmetric encryption

Question 11

An analyst reviews the Cisco ASA syslog message shown in the exhibit. What does this entry indicate?

Accepted Answer

An attempted connection from an external host to an internal web server that was blocked by the firewall. The syslog message shows a deny action for an HTTP connection (port 80) from an external IP (outside) to an internal IP (inside). The '%ASA-4-106023' message indicates a packet was denied by the firewall's access control list (ACL). This matches the scenario of an attempted external-to-internal web connection being blocked, which is option C.

Answer

A successful HTTP connection from the outside to the inside server

Answer

A VPN tunnel initiation that was rejected due to authentication failure

Answer

A NAT translation failure for an outbound connection

Question 12

An analyst is reviewing a web server log and sees the following entry: '192.168.1.1 - - [25/Oct/2023:10:15:30 -0400] "GET /admin/index.php?cmd=id HTTP/1.1" 200 1532 "-" "Mozilla/5.0"'. What potential attack does this log entry suggest?

Accepted Answer

Command injection. The presence of 'cmd=id' in the URL suggests an attempt to execute the 'id' command via a web shell or command injection vulnerability. The response code 200 indicates success, which is concerning.

Answer

SQL injection

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Question 13

Which of the following are responsibilities of the legal counsel role during incident response? (Choose two.)

Accepted Answer

Determining data breach notification requirements. Legal counsel advises on breach notification requirements and can place legal holds to preserve evidence for litigation.

Answer

Communicating with the media

Answer

Conducting technical analysis of malware

Answer

Approving financial expenditures for containment

Question 14

A security team is implementing a remote access policy. Which TWO controls should be included to ensure secure remote access?

Accepted Answer

Multifactor authentication (MFA). Option A (Multifactor authentication (MFA)) is correct because requiring a second factor beyond a password (e.g., TOTP, push notification, or FIDO2 security key) defends against credential theft, phishing, and password reuse, which are the primary risks for remote access. Option D (Virtual private network (VPN)) is correct because a VPN establishes an encrypted tunnel (e.g., IPsec/IKEv2 or TLS) between the remote endpoint and the corporate network, protecting data in transit from interception and enabling authenticated, policy-controlled access to internal resources. Option B (Single sign-on (SSO)) is not a security control that secures the remote connection itself; it improves user convenience and centralizes authentication but does not encrypt traffic or add a verification factor. Option C (Password expiration every 90 days) is a legacy practice that is no longer recommended by NIST and does not compensate for weak or stolen credentials. Option E (Guest network access) is an isolated, untrusted network segment and does not provide secure access to corporate resources.

Answer

Single sign-on (SSO)

Answer

Password expiration every 90 days

Answer

Guest network access

Question 15

An IDS/IPS alert shows a signature named 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' with severity high. What is the most likely next step for an analyst?

Accepted Answer

Investigate the source IP and user-agent for malicious activity. The 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' signature indicates a policy violation, not necessarily a confirmed attack. An analyst must first investigate the source IP and user-agent to determine if the traffic is malicious (e.g., command-and-control communication, data exfiltration) or benign (e.g., a legitimate application using a non-standard user-agent). Immediate blocking (Option A) could disrupt legitimate services, while ignoring the alert (Option D) risks missing a real threat.

Answer

Immediately block the source IP on the firewall

Answer

Reset the IDS/IPS signature database

Answer

Ignore the alert as it is not a critical signature