200-201 Practice Test 27 — 15 Questions

Question 1

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. Standard well-known port assignments: HTTP=80, HTTPS=443, SSH=22, DNS=53. Common confusions include swapping HTTP/HTTPS ports or confusing SSH with Telnet.

Answer

HTTP: 443

Answer

SSH: 23

Question 2

An analyst is investigating a potential DNS tunneling attack. Which characteristic in DNS traffic would most likely indicate DNS tunneling?

Accepted Answer

DNS queries with long, random-looking subdomains to a single domain.. DNS tunneling often encodes data in subdomains, resulting in long, random-looking domain names that differ from legitimate traffic.

Answer

Frequent DNS queries to the same domain at regular intervals.

Answer

DNS queries for domains that are known to be malicious.

Answer

DNS query responses with unusually large payload sizes.

Question 3

An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?

Accepted Answer

SQL injection. The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.

Answer

Command injection

Answer

Cross-site scripting

Answer

Directory traversal

Question 4

Refer to the exhibit. An analyst sees repeated ICMP echo requests from a host to the broadcast address. What is this an example of?

Accepted Answer

Smurf attack. A Smurf attack sends ICMP echo requests to a network broadcast address with the source IP spoofed to the victim's address. All hosts on the network reply to the victim, overwhelming it with traffic. This is a classic amplification-based denial-of-service attack.

Answer

Ping sweep

Answer

ICMP tunneling

Answer

Denial of service

Question 5

During an investigation, an analyst finds that an internal host has been communicating with a known malicious IP on port 445. Which protocol is most likely involved?

Accepted Answer

SMB. Port 445 is the default port for Microsoft SMB (Server Message Block) over TCP, used for file sharing, printer sharing, and other network services. Communication with a known malicious IP on this port strongly indicates SMB-based activity, such as exploitation of vulnerabilities like EternalBlue (MS17-010) or unauthorized file access.

Answer

SSH

Answer

RDP

Answer

HTTP

Question 6

A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?

Accepted Answer

The destination IP is listed in a threat intelligence feed as a known C2 server.. A destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.

Answer

The packet size is consistently 1452 bytes across multiple connections.

Answer

The source IP also connected to multiple other external IPs on port 443 within the same hour.

Answer

The traffic is using HTTPS (port 443) which is commonly used for covert channels.

Question 7

An analyst sees an alert with source IP 10.0.0.1 and destination IP 192.168.1.100 on port 80. The alert type is 'WEB-MISC Attempt to execute command on server'. Which action is most appropriate?

Accepted Answer

Verify if the target host is vulnerable. The alert 'WEB-MISC Attempt to execute command on server' from source IP 10.0.0.1 to destination IP 192.168.1.100 on port 80 indicates a potential command injection attempt against a web server. The most appropriate first action is to verify if the target host is actually vulnerable to such an attack, as this determines whether the alert is a true positive requiring remediation or a false positive that can be dismissed. This aligns with the network intrusion analysis process of validating alerts before taking irreversible actions.

Answer

Ignore because it's a false positive

Answer

Immediately block the source IP

Answer

Escalate to law enforcement

Question 8

A security analyst is using Zeek to monitor network traffic. The analyst wants to extract all files transferred over HTTP. Which Zeek script or package accomplishes this?

Accepted Answer

file_extraction.zeek. The file_extraction.zeek script is specifically designed to extract files from network streams, including HTTP transfers. Zeek's default HTTP logging (http.log) records metadata about HTTP sessions, but to actually capture and reassemble the transferred files (e.g., images, executables, documents), the file_extraction framework must be loaded via this script or package.

Answer

dns-logs.zeek

Answer

conn-logs.zeek

Answer

http-logs.zeek

Question 9

You are a security analyst at a financial services company. The company's security policy mandates that all sensitive data must be encrypted at rest and in transit. A recent internal audit reveals that a database containing customer personally identifiable information (PII) is stored on a server that uses unencrypted storage volumes. The database is accessed by internal applications via unencrypted connections. The policy also requires quarterly vulnerability scans, and the latest scan shows that the server has a critical vulnerability in the database software. Additionally, the server's firewall rules permit inbound traffic from the entire corporate network to the database port. The company's incident response policy requires that any violation of data protection policies be escalated within 24 hours. The IT manager asks you to prioritize actions. What should you do first?

Accepted Answer

Apply the critical security patch to the database software. The most immediate threat is the critical vulnerability in the database software, which could allow remote code execution or data exfiltration without any authentication. Patching this vulnerability directly reduces the risk of exploitation, which is the highest priority in a security incident. Encryption and firewall restrictions are important but do not address an actively exploitable software flaw.

Answer

Enable encryption on the storage volumes and database connections

Answer

Escalate the violation to management within 24 hours

Answer

Restrict firewall access to only authorized application servers

Question 10

A security analyst notices repeated failed login attempts from a single IP address to the company's VPN gateway. Which action should the analyst take first?

Accepted Answer

Investigate the source IP for malicious activity.. The first step in security monitoring is to investigate the source IP to determine if the failed login attempts are part of a brute-force attack, a misconfigured client, or a legitimate user error. Without context, blocking the IP or escalating prematurely could disrupt legitimate access or waste resources. The analyst should gather evidence (e.g., logs, timestamps, user accounts targeted) before taking further action.

Answer

Escalate to the incident response team immediately.

Answer

Block the IP at the firewall immediately.

Answer

Ignore the activity as it may be a user error.

Question 11

During memory analysis using Volatility, an analyst wants to identify processes with suspicious network connections and potentially injected code. Which THREE plugins should the analyst use? (Select THREE)

Accepted Answer

pstree. pstree shows process hierarchy, netscan lists network connections, and malfind detects injected code.

Answer

hashdump

Answer

hivelist

Question 12

An intrusion analyst is analyzing a series of alerts from a network-based IDS. The alerts are triggered by the signature 'OVERFLOW-ICMP-ECHO' with a payload size of 65535 bytes. The source IP is a trusted internal server. What is the most likely explanation?

Accepted Answer

The IDS signature is incorrectly configured. The ICMP Echo (ping) payload size is limited to 65535 bytes, but the actual data portion of an ICMP packet cannot exceed 65535 minus the IP and ICMP header sizes (typically 20 + 8 = 28 bytes), making a payload of exactly 65535 bytes impossible under normal operation. Since the source IP is a trusted internal server, the most plausible cause is that the IDS signature is misconfigured—likely with an incorrect payload size threshold or a false positive trigger—rather than an actual overflow attempt.

Answer

The server is performing a ping sweep

Answer

There is a network error causing packet fragmentation

Answer

The server is under a DDoS attack

Question 13

In the OSI model, which layer is primarily targeted by a SYN flood attack?

Accepted Answer

Transport Layer (Layer 4). A SYN flood attack targets the Transport Layer (Layer 4) by exploiting the TCP three-way handshake. The attacker sends a high volume of SYN packets with spoofed source IP addresses, causing the target server to allocate resources for half-open connections that never complete, eventually exhausting its connection queue and denying service to legitimate users.

Answer

Network Layer (Layer 3)

Answer

Application Layer (Layer 7)

Answer

Data Link Layer (Layer 2)

Question 14

A SOC analyst is tuning a SIEM correlation rule to detect port scanning. The rule should generate an alert when a single source IP connects to many different destination ports on multiple hosts within a short time. Which THREE conditions should be included in the rule?

Accepted Answer

Count of unique destination IPs > threshold. Port scanning involves multiple ports on multiple hosts from one source. Unique destination ports and unique destination IPs are key. Low packet count per connection is typical of scans (e.g., SYN scans).

Answer

Destination port is well-known

Answer

Average packet count per connection is high (e.g., >100)

Question 15

A critical security patch for a widely exploited vulnerability is released. The patch requires a system reboot during business hours. According to change management policy, what is the best procedure?

Accepted Answer

Submit an emergency change request for immediate approval. When a critical security patch addresses a widely exploited vulnerability, the immediate risk to the organization outweighs standard change windows. Change management policy typically includes an emergency change process that bypasses normal scheduling to allow rapid deployment with expedited approval, even if a reboot during business hours is required. This aligns with the principle of prioritizing security over availability in high-severity scenarios.

Answer

Deploy the patch only at the end of the business day

Answer

Wait for the next scheduled change window

Answer

Install the patch without approval