200-201 Practice Test 29 — 15 Questions

Question 1

You are analyzing network traffic from a compromised host. The host is running Windows and is connected to a corporate network. The IDS generated an alert for a known malware signature matching traffic from the host to an external IP on port 443. However, you see that the traffic is encrypted and the destination IP is a cloud storage provider. The host also shows periodic DNS queries to a domain that closely resembles the cloud provider's domain but with a single character difference (typosquatting). The employee on that host reports no unusual activity. Which step should you take first to confirm the compromise?

Accepted Answer

Check DNS logs to see if the typosquatted domain resolved recently and correlate with the encrypted traffic timestamps.. Option A is correct because correlating DNS logs with encrypted traffic timestamps is the fastest, least intrusive way to confirm whether the host actually communicated with the typosquatted domain. If the DNS query for the lookalike domain resolved just before the encrypted session to the external IP, it strongly indicates the malware is using the typosquatted domain for command-and-control (C2) over HTTPS, bypassing simple domain-based blocklists. This step validates the alert without requiring decryption or assuming user reports are reliable.

Answer

Dismiss the alert as a false positive because the user reports no issues.

Answer

Examine the full packet capture for the encrypted session to see the payload.

Answer

Enable SSL/TLS decryption on the corporate firewall to inspect the encrypted traffic.

Question 2

Which TWO are examples of technical security controls? (Select two.)

Accepted Answer

Firewall. A firewall is a technical security control because it is a hardware or software device that enforces access policies by inspecting network traffic based on rules (e.g., permit/deny IP addresses, ports, protocols). Encryption is a technical control that transforms plaintext data into ciphertext using algorithms like AES-256 or RSA, ensuring confidentiality during storage or transmission. Both are implemented through technology rather than administrative or physical means.

Answer

Security policy

Answer

Security awareness training

Answer

Background checks

Question 3

A company implements a policy where users must authenticate with a password and a one-time code from a token. Which AAA component is strengthened by this policy?

Accepted Answer

Authentication. Authentication is the AAA component that verifies the identity of a user. By requiring both a password (something you know) and a one-time code from a token (something you have), the policy implements multi-factor authentication (MFA), which directly strengthens the authentication process. This ensures that even if a password is compromised, an attacker cannot authenticate without the token.

Answer

Accounting

Answer

Auditing

Answer

Authorization

Question 4

Which TWO are common indicators of a phishing email? (Select two.)

Accepted Answer

Urgent call to action. Phishing emails often create a false sense of urgency to pressure recipients into acting without verifying the source. An urgent call to action, such as 'Your account will be suspended in 24 hours,' is a classic social engineering tactic that exploits fear or time pressure to bypass rational scrutiny.

Answer

Personal salutation

Answer

Proper spelling and grammar

Answer

Matching sender domain

Question 5

Which principle ensures that a user cannot deny having performed an action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action, typically by using digital signatures or cryptographic mechanisms. In network security, this is often achieved through protocols like HMAC or digital certificates that bind an action to a specific identity, providing irrefutable proof. Without non-repudiation, a user could claim they never sent a message or executed a command, undermining audit trails and legal accountability.

Answer

Authentication

Answer

Accountability

Answer

Authorization

Question 6

During a forensic investigation, an analyst acquires a hard drive image using dd. What must be done to ensure the evidence is admissible in court?

Accepted Answer

Use a write blocker. Using a write blocker ensures that the hard drive is not modified during acquisition, preserving the original data's integrity. This is critical for maintaining the chain of custody and demonstrating that the evidence has not been tampered with, which is a fundamental requirement for admissibility in court. The dd command itself does not prevent writes; a hardware or software write blocker must be used to guarantee read-only access.

Answer

Encrypt the image

Answer

Compress the image

Answer

Store the image in a shared folder

Question 7

In a risk management process, after identifying risks, the next step is to determine the potential impact and likelihood. This is known as:

Accepted Answer

Risk assessment. After risks have been identified, the next logical step in the risk management process is to evaluate their potential impact and likelihood. This evaluation is formally known as risk assessment (or risk analysis), which quantifies or qualifies the risk level to prioritize subsequent treatment decisions. In the context of the 200-201 exam, risk assessment is a core component of the NIST SP 800-30 risk management framework.

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 8

During a vulnerability assessment, a security team discovers that a web application allows users to upload files without proper validation. An attacker could upload a malicious file and execute it on the server. Which type of vulnerability is this?

Accepted Answer

Remote code execution (RCE). The vulnerability allows an attacker to upload a malicious file (e.g., a web shell) and then execute it on the server, which is the definition of remote code execution (RCE). This occurs because the application fails to validate file types, contents, or execution permissions, enabling arbitrary code to run in the server's context.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Insecure direct object reference

Question 9

A security analyst needs to ensure data integrity. Which control best achieves this?

Accepted Answer

Hashing. Hashing is the correct control for ensuring data integrity because it produces a fixed-length digest (e.g., SHA-256) from the original data. Any change to the data, even a single bit, results in a completely different hash value, allowing the analyst to detect tampering or corruption. Unlike encryption, hashing is a one-way function that does not conceal the data but verifies its unchanged state.

Answer

Logging

Answer

Encryption

Answer

Access control

Question 10

A help desk receives a phone call from someone claiming to be from IT and requesting a password reset. What type of attack is this?

Accepted Answer

Vishing. Vishing (voice phishing) is a social engineering attack conducted over voice communication, such as a phone call, where the attacker impersonates a legitimate entity (e.g., IT support) to trick the victim into revealing sensitive information or performing an action like a password reset. This matches the scenario exactly: a phone call from someone claiming to be from IT requesting a password reset.

Answer

Social engineering

Answer

Phishing

Answer

Malware

Question 11

A company implements a policy requiring all employees to use a hardware token for remote access. This is an example of which type of security control?

Accepted Answer

Preventive. A hardware token for remote access implements multifactor authentication (something you have), which directly prevents unauthorized access by requiring a physical device in addition to credentials. This is a preventive control because it stops the threat before it can occur, aligning with the NIST definition of preventive controls that block or mitigate attacks.

Answer

Compensating

Answer

Deterrent

Answer

Detective

Question 12

Which of the following is a primary goal of the CIA triad?

Accepted Answer

Availability. The CIA triad's primary goals are confidentiality, integrity, and availability. Availability ensures that authorized users have reliable and timely access to data and resources when needed, which is a core security objective. Option C is correct because availability is explicitly one of the three pillars of the CIA triad.

Answer

Redundancy

Answer

Scalability

Answer

Maintainability

Question 13

During an incident, the analyst finds that an attacker modified system files. Which security principle was primarily violated?

Accepted Answer

Integrity. Integrity ensures that data and system files are not altered by unauthorized entities. When an attacker modifies system files, the trustworthiness and accuracy of those files are compromised, directly violating the integrity principle. This is distinct from confidentiality (unauthorized disclosure) or availability (denial of service).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 14

What is the primary goal of the 'integrity' pillar of the CIA triad?

Accepted Answer

Protect data from unauthorized modification. The 'integrity' pillar of the CIA triad ensures that data is not altered or tampered with by unauthorized parties. This is achieved through mechanisms such as hashing (e.g., SHA-256), checksums, and digital signatures that detect any unauthorized modification. Option D correctly identifies this goal, as protecting data from unauthorized modification is the core purpose of integrity controls.

Answer

Keep data secret from unauthorized users

Answer

Ensure data is accessible when needed

Answer

Provide proof that a user performed an action

Question 15

An organization deploys a firewall to block unauthorized traffic. This is an example of which type of security control?

Accepted Answer

Technical. A firewall is a technical control because it uses software or hardware mechanisms—such as packet filtering, stateful inspection, or application-layer filtering—to enforce security policies and block unauthorized traffic. Technical controls are implemented through technology systems (e.g., routers, firewalls, IDS/IPS) rather than through physical barriers or administrative procedures.

Answer

Detective

Answer

Physical

Answer

Administrative