200-201 Practice Test 28 — 15 Questions

Question 1

A security analyst is monitoring network traffic and notices a large number of TCP SYN packets being sent to a single host on various ports. Which type of attack is most likely occurring?

Accepted Answer

Port scan. A port scan involves sending packets to multiple ports on a target to discover open ports. The description matches a TCP SYN scan.

Answer

Man-in-the-middle

Answer

ARP spoofing

Answer

DNS amplification

Question 2

A company's security policy requires that all servers have host-based intrusion detection (HIDS) installed and configured to send alerts to the SIEM. During a routine check, you find that a critical database server has HIDS installed but is not sending alerts because the agent service is stopped. The server administrator says he stopped the service because it was using too much CPU. The policy requires that any deviation from baseline must be approved by the security team. What should you do?

Accepted Answer

Restart the service on the server and submit a change request for CPU optimization.. The security policy requires HIDS to be running and sending alerts to the SIEM. The server administrator stopped the service without approval, which is a policy violation. The correct action is to restore compliance by restarting the service and then submit a change request for CPU optimization if needed. This ensures the security baseline is met while addressing the administrator's concern through proper channels.

Answer

Accept the server administrator's justification and document it.

Answer

Recommend setting the HIDS process priority to low to reduce CPU impact.

Answer

Report the non-compliance to the security manager and disable the server until compliance is restored.

Question 3

Which TWO of the following are common sources of security events used in security monitoring?

Accepted Answer

Firewall logs. Firewall logs (B) are a primary source of security events because they record allowed and denied traffic based on access control lists (ACLs), providing critical data on attempted intrusions, policy violations, and reconnaissance scans. DNS query logs (E) are equally vital as they capture domain resolution requests, enabling detection of malware command-and-control (C2) communication, DNS tunneling, and connections to known malicious domains. Both are standard inputs for SIEM systems and security monitoring platforms.

Answer

Employee attendance records

Answer

Marketing campaign results

Answer

Company newsletter subscriptions

Question 4

A healthcare organization has a security policy that mandates immediate reporting of any potential data breach to the privacy officer. An analyst notices that an employee accidentally emailed a patient list to the wrong recipient. The recipient is known to be a trusted partner, but the email contained PHI. The analyst contacts the recipient who acknowledges receipt and agrees to delete the email. What should the analyst do next?

Accepted Answer

Report the incident as a data breach to the privacy officer as per policy.. Under HIPAA and most organizational security policies, any unauthorized disclosure of PHI — even accidental and even to a trusted partner — must be reported to the privacy officer so it can be assessed and documented. The analyst is not authorized to make the breach determination or to close the incident; only the privacy officer can evaluate whether notification obligations apply. The recipient's verbal agreement to delete the email does not eliminate the disclosure event or the reporting requirement.

Answer

Update the access control list to prevent similar mistakes.

Answer

Do nothing further since the data was deleted.

Answer

Send a warning email to the employee without reporting.

Question 5

While analyzing a PCAP, an analyst uses the Wireshark filter 'http.request' and finds a URI parameter containing '%27%20UNION%20SELECT%201,2,3%20--'. What type of attack is indicated?

Accepted Answer

SQL injection. The URL-encoded string decodes to a SQL injection attempt with UNION SELECT. SQL injection often appears in HTTP parameters.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Directory traversal

Question 6

An alert shows a high volume of outbound traffic from an internal host to an external IP using FTP. The data includes files with names matching internal document names. This activity is most likely:

Accepted Answer

Data exfiltration. The scenario describes an internal host sending a high volume of outbound FTP traffic to an external IP, with file names matching internal document names. This pattern is characteristic of data exfiltration, where an attacker steals sensitive data by transferring it to an external command-and-control (C2) or staging server. FTP is commonly used because it is a standard protocol that may not be blocked, and the file names indicate the data is likely proprietary or confidential. The volume and direction (outbound) further support exfiltration rather than normal backup or scanning.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Port scanning

Question 7

During alert triage, an analyst determines that an alert fired but no actual attack or malicious activity occurred on the network. How should this alert be classified?

Accepted Answer

False positive. A false positive occurs when an alert fires but no actual malicious activity is present. The analyst determined that no attack occurred, so the alert is a false positive. This is a common occurrence in security operations and requires tuning of detection rules to reduce noise.

Answer

True negative

Answer

False negative

Answer

True positive

Question 8

A SOC analyst sees an alert for 'Possible SQL Injection' on a web server. Reviewing the PCAP, the analyst finds the parameter 'id=1 OR 1=1' in the HTTP request. However, the web server returns a normal page with no signs of compromise. What is the correct classification?

Accepted Answer

False positive. A false positive occurs when a security tool raises an alert for activity that is not actually malicious or successful. Here, the SQL injection payload 'id=1 OR 1=1' was detected in the request, but the server returned a normal page with no signs of compromise, meaning the attack did not succeed and the alert was triggered on suspicious input rather than actual exploitation. Therefore, the alert is a false positive.

Answer

True negative

Answer

False negative

Answer

True positive

Question 9

An analyst is using Volatility to analyze a memory dump. Which TWO plugins are most effective for detecting code injection?

Accepted Answer

ldrmodules. Option A, ldrmodules, is correct because it compares the three DLL/module lists maintained in the PEB (InLoad, InInit, InMem) and flags modules that appear in memory but are absent from the loader list, a classic sign of injected or unlinked DLLs. Option C, malfind, is correct because it scans process memory for pages with MZ/PE headers that are not backed by a file on disk and have suspicious protection flags such as PAGE_EXECUTE_READWRITE, which is the standard indicator of injected code. The unmarked options do not belong: pslist merely walks the doubly linked process list to enumerate running processes, pstree shows parent-child process relationships, and netscan lists network connections and sockets; none of these inspect module lists or memory pages for injected code.

Answer

pslist

Answer

pstree

Answer

netscan

Question 10

Which TWO are examples of risk treatment options? (Select two.)

Accepted Answer

Mitigate. Mitigate (B) is a recognized risk treatment option because it involves applying controls or countermeasures to reduce the likelihood and/or impact of a risk to an acceptable level. Accept (D) is also a recognized risk treatment option, meaning the organization acknowledges the risk and decides to retain it without additional controls, typically when the cost of treatment outweighs the benefit or the risk is within tolerance. The other options are not standard risk treatment categories: Neglect (A) and Ignore (C) imply simply disregarding a risk without a formal, documented decision, which is not a valid treatment strategy, and Amplify (E) is not a recognized risk treatment option since treatment aims to reduce or transfer risk, not increase exposure.

Answer

Neglect

Answer

Ignore

Answer

Amplify

Question 11

Which TWO pieces of information are essential for an analyst to correlate when investigating an intrusion alert from a network-based sensor?

Accepted Answer

Source and destination IP addresses. Option B (Source and destination IP addresses) is correct because correlating the source and destination IPs lets the analyst identify the communicating hosts, pivot to related logs (firewall, NetFlow, IDS/IPS), and determine whether the traffic is internal-to-external, external-to-internal, or lateral movement. Option D (Timestamp of the alert) is correct because the timestamp enables time-based correlation across disparate data sources, which is essential for reconstructing the sequence of events and aligning the sensor alert with firewall, proxy, and endpoint logs. The unmarked options do not belong: cable color (A) and sensor brand (C) are irrelevant physical/vendor details that do not help correlate events, and the security team lead's name (E) is an administrative fact, not investigative data.

Answer

The color of the network cables

Answer

The brand of the sensor

Answer

The name of the security team lead

Question 12

A SOC Tier 2 analyst is investigating an alert that was escalated by Tier 1. The analyst needs to perform deeper correlation and malware analysis. Which of the following actions is most appropriate for Tier 2?

Accepted Answer

Analyze the malware sample in a sandbox and correlate with other indicators.. Tier 2 analysts are responsible for deeper investigation, including malware analysis and correlating indicators across multiple data sources. Analyzing a malware sample in a sandbox allows safe execution and observation of behavior, while correlation with other indicators (e.g., IOCs from other alerts) helps determine scope and impact. This aligns with the escalation from Tier 1, which typically handles initial triage. Options B and C are more advanced or proactive tasks often handled by Tier 3 or threat hunting teams, and D is a Tier 1 responsibility.

Answer

Conduct threat hunting to proactively search for threats.

Answer

Develop new detection rules for the SIEM.

Answer

Perform initial triage and basic investigation.

Question 13

During incident response, an analyst extracts files from a PCAP using Wireshark's Export Objects feature. One extracted file is a PDF that triggers an IDS alert for 'Exploit:PDF/HeapSpray'. Which technique does this alert describe?

Accepted Answer

Heap spray. Heap spray is a memory corruption technique where an attacker fills heap memory with shellcode to increase the chance of code execution, often used in PDF exploits.

Answer

Return-oriented programming (ROP)

Answer

Shellcode injection

Answer

Stack buffer overflow

Question 14

Which encryption method uses a single key for both encryption and decryption of data?

Accepted Answer

Symmetric encryption. Symmetric encryption uses a single shared key for both encryption and decryption of data. This is the defining characteristic of symmetric algorithms like AES, DES, and 3DES, where the same secret key must be known to both sender and receiver to protect confidentiality.

Answer

Asymmetric encryption

Answer

Digital signature

Answer

Hashing

Question 15

A security analyst is implementing multifactor authentication. Which TWO are considered factors? (Select two.)

Accepted Answer

Password. A password (A) is a knowledge factor — something the user knows — and is one of the three classic authentication factor categories (knowledge, possession, inherence), so it qualifies as a factor in MFA. An RSA token (E) is a possession factor — something the user has — generating a one-time passcode (e.g., TOTP/HOTP), which is exactly the second factor MFA combines with a password. The remaining options are not authentication factors: last login time (B) is audit/log data, a user ID (C) is an identifier rather than a verifier, and security group membership (D) is an authorization attribute, not a factor used to prove identity.

Answer

Last login time

Answer

User ID

Answer

Security group membership