200-201 Practice Test 28 — 15 Questions

Question 1

During a security monitoring exercise, an analyst observes a series of NetFlow records showing a single internal host communicating with multiple external IP addresses on port 445 (SMB) within a short time window. The traffic volumes are small but consistent. Which THREE of the following should the analyst consider as possible explanations? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The host is infected with malware that propagates via SMB (e.g., EternalBlue).. SMB port 445 is a common vector for worm-like malware such as EternalBlue (MS17-010), which spreads by sending crafted SMB packets to random external IPs. The small, consistent traffic volumes and multiple external destinations match the behavior of a host scanning or propagating to new targets rather than normal file transfers.

Answer

The host is streaming video content.

Answer

The host is engaging in normal internal file sharing with external partners.

Question 2

A large enterprise has a security policy that mandates data classification and strict access controls. An IT administrator, John, has been granted temporary administrative privileges to resolve a server issue. During the maintenance window, John accesses a file server and downloads a spreadsheet containing customer PII (Personally Identifiable Information) classified as 'Confidential'. John then emails the spreadsheet to his personal email account to work from home. The security team receives an alert from the DLP system indicating the email transmission. According to the company's incident response policy, which of the following is the FIRST action the security team should take?

Accepted Answer

Preserve evidence, isolate the affected systems, and initiate the incident response process. The correct first action is to preserve evidence, isolate affected systems, and initiate the incident response process. This aligns with NIST SP 800-61 and ISO 27035, which mandate that containment and evidence preservation precede any investigative or disciplinary steps. Jumping to revocation or interviews risks spoliation of logs, email metadata, and forensic artifacts critical to determining the scope of the data exfiltration.

Answer

Block the email transmission and restore the file from backup

Answer

Revoke John's network access immediately and escalate to HR for disciplinary action

Answer

Interview John to determine his intent and whether it was accidental

Question 3

An analyst runs Volatility's pstree plugin on a memory dump. The output shows that a process 'svchost.exe' is the child of 'explorer.exe'. What is suspicious about this?

Accepted Answer

svchost.exe should be a child of services.exe, not explorer.exe. In a normal Windows system, svchost.exe is a service host process that should always be a child of services.exe, which is the Service Control Manager (SCM). When svchost.exe appears as a child of explorer.exe, it indicates that a malicious process or attacker has spawned a fake svchost.exe from explorer.exe to evade detection, as legitimate svchost.exe instances are never launched from the Windows shell.

Answer

explorer.exe should not have any child processes

Answer

Nothing, svchost.exe can be a child of any process

Answer

The pstree output is unreliable

Question 4

An analyst is investigating a malware infection on a workstation. The malware appears to be a trojan that downloads additional payloads and allows remote control. The analyst needs to classify the malware based on its behavior. Which THREE characteristics match this description? (Choose three.)

Accepted Answer

It provides unauthorized remote access to the system.. A is correct because a trojan is a type of malware that disguises itself as legitimate software to trick users into installing it, and once executed, it often provides unauthorized remote access to the system, commonly through a backdoor. This matches the description of allowing remote control, which is a core characteristic of Remote Access Trojans (RATs).

Answer

It self-replicates without user interaction.

Answer

It encrypts files and demands ransom.

Question 5

A Linux server is configured with auditd to monitor file access. Which audit rule will detect any attempt to read the /etc/shadow file?

Accepted Answer

-w /etc/shadow -p r. The `-p r` flag in an auditd rule specifies that the rule should monitor for read access attempts. The `/etc/shadow` file contains hashed passwords, and reading it is a common post-exploitation reconnaissance step. The `-w` flag watches a file, and `-p r` triggers an audit event when the file is opened for reading.

Answer

-w /etc/shadow -p x

Answer

-w /etc/shadow -p a

Answer

-w /etc/shadow -p w

Question 6

Which of the following is a common indicator of DNS tunneling used for exfiltration?

Accepted Answer

DNS queries with long subdomain strings. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.

Answer

Frequent DNS queries to known domains

Answer

DNS responses with large payloads

Answer

DNS queries using TCP instead of UDP

Question 7

An analyst is examining a Windows system for evidence of privilege escalation or credential theft. Which THREE Event IDs should the analyst focus on in the Security log? (Select THREE)

Accepted Answer

4648. Event ID 4648 (A logon was attempted using explicit credentials) is correct because it records when a user explicitly provides credentials to run a program or service, which is a common technique in privilege escalation (e.g., runas) and credential theft (e.g., pass-the-hash). This event captures the target account, source process, and target workstation, making it invaluable for detecting lateral movement or credential misuse.

Answer

4720

Answer

4625

Question 8

A security analyst needs to ensure data integrity. Which control best achieves this?

Accepted Answer

Hashing. Hashing is the correct control for ensuring data integrity because it produces a fixed-length digest (e.g., SHA-256) from the original data. Any change to the data, even a single bit, results in a completely different hash value, allowing the analyst to detect tampering or corruption. Unlike encryption, hashing is a one-way function that does not conceal the data but verifies its unchanged state.

Answer

Logging

Answer

Encryption

Answer

Access control

Question 9

Refer to the exhibit. An administrator configured AAA on a Cisco router. What is the expected outcome when a user tries to access privileged EXEC mode (enable) with the username 'admin' and password 'cisco123'?

Accepted Answer

The user enters user EXEC mode but is denied enable access due to missing enable secret. The configuration uses 'enable' authentication for enable mode, which means it uses the enable password (not set) or if not set, the local user database? Actually 'enable' method uses the enable secret/password. Since no enable secret is configured, authentication fails. However, the user must first log in to user EXEC mode. For user EXEC, it uses local-case authentication, so 'admin' with password 'cisco123' works there. But for enable, it uses 'enable' method, which requires the enable password. Since no enable password is set, the user is denied enable access. Option D is correct. Option A is wrong because user EXEC works. Option B is wrong because enable access fails. Option C is wrong because the user cannot even enter enable mode.

Answer

The user is granted access to user EXEC mode only

Answer

The user is denied all access because no enable secret is set

Answer

The user is granted full privileged EXEC access

Question 10

Drag and drop the steps to perform a password recovery on a Cisco IOS router into the correct order.

Accepted Answer

Enter ROMmon, change confreg to 0x2142, reset router, boot router, restore config and change password. Password recovery: enter ROMmon, change confreg, reset, boot, then restore config and change password.

Answer

Reset router, boot router, change confreg to 0x2142, enter ROMmon, restore config and change password

Answer

Change confreg to 0x2142, enter ROMmon, reset router, boot router, restore config and change password

Answer

Boot router, reset router, enter ROMmon, change confreg to 0x2142, restore config and change password

Question 11

An organization's security policy specifies that all configuration changes must be approved through a change management process. An analyst discovers that a firewall rule was added without approval. What is the appropriate action?

Accepted Answer

Report the unauthorized change to management.. Reporting the unauthorized change is required by policy. Option A is too hasty without impact analysis. Option B might follow reporting. Option D violates policy. Option E is inappropriate.

Answer

Remove the rule immediately.

Answer

Change the policy to allow emergency changes without approval.

Answer

Document the change and ignore it.

Answer

Analyze the rule to see if it's needed, then either approve or remove.

Question 12

A network administrator is tasked with creating a security policy for handling sensitive data. Which of the following is the most critical element to include?

Accepted Answer

Data classification and handling procedures.. Data classification and handling procedures are fundamental to any data security policy. Topology, antivirus, and contacts are supporting but not the most critical.

Answer

Detailed network topology diagrams.

Answer

List of antivirus software versions.

Answer

Vendor contact information.

Question 13

During a security investigation, an analyst examines a PCAP file in Wireshark. The analyst wants to see only traffic between two specific IP addresses (192.168.1.10 and 10.0.0.5). Which display filter should be applied?

Accepted Answer

ip.addr==192.168.1.10 && ip.addr==10.0.0.5. The correct display filter uses 'ip.addr' to match either direction. The syntax 'ip.addr==192.168.1.10 && ip.addr==10.0.0.5' shows packets where both addresses appear, which is correct for traffic between them.

Answer

tcp.port==80

Answer

ip.src==192.168.1.10 and ip.dst==10.0.0.5

Answer

ip.addr eq 192.168.1.10 or ip.addr eq 10.0.0.5

Question 14

An IPS sensor is configured inline and drops traffic that triggers the signature 'OVERFLOW-ICMP-ECHO', which triggers on ICMP packets with size > 1024 bytes. A network administrator reports that legitimate network monitoring tools using large ICMP packets are being blocked. What is the best course of action?

Accepted Answer

Create a whitelist for the monitoring tool's source IP. Creating a whitelist for the monitoring tool's source IP allows the IPS to continue dropping malicious oversized ICMP packets while permitting legitimate traffic from known, trusted sources. This maintains security for the rest of the network without disabling the signature or changing its mode, which would reduce protection.

Answer

Increase the threshold to 2048

Answer

Disable the signature entirely

Answer

Change the sensor mode to IDS for that signature

Question 15

A security analyst is reviewing logs from a network-based IPS that detected traffic from an internal host connecting to a known malicious IP address on port 6667. The traffic is encrypted IRC. Which conclusion is most likely?

Accepted Answer

The host is compromised and part of a botnet. Port 6667 is the default port for IRC (Internet Relay Chat), and encrypted IRC traffic to a known malicious IP strongly indicates command-and-control (C2) communication. Botnets commonly use IRC over TLS/SSL to evade detection and issue commands to compromised hosts. Therefore, the host is most likely compromised and part of a botnet.

Answer

The traffic is a normal application update

Answer

The host is running a legitimate IRC client

Answer

The IPS is generating a false positive