200-201 Practice Test 29 — 15 Questions

Question 1

A network administrator wants to detect SQL injection attacks against web servers. Which type of IDS/IPS sensor placement would be most effective?

Accepted Answer

Inside the firewall on the DMZ. Placing the IDS/IPS inside the firewall on the DMZ allows it to inspect traffic that has already passed the firewall's initial access controls but is still destined for the web servers. SQL injection attacks target application-layer vulnerabilities in web services, and the DMZ is the network segment where these servers reside. This placement ensures the sensor can analyze decrypted HTTP/HTTPS payloads for malicious SQL patterns without being overwhelmed by general internet noise, while the firewall provides a first line of defense against non-web threats.

Answer

Outside the firewall

Answer

At the core switch

Answer

On the internal network

Question 2

During an incident response, an analyst extracts a file from network traffic using Zeek's file analysis feature. The file has a SHA-256 hash that matches a known malware indicator. Which type of IoC is this?

Accepted Answer

File-based IoC. A file hash is a file-based IoC that uniquely identifies a malicious file.

Answer

Behavioral IoC

Answer

Network-based IoC

Answer

Host-based IoC

Question 3

An analyst is examining the Windows Registry on a host suspected of persistence via a malicious service. Which two registry keys are most relevant to investigate?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The Services key under CurrentControlSet lists all registered Windows services, including their executable paths and startup types. Malicious services often register here to achieve persistence by starting automatically with the system. Examining this key allows an analyst to identify suspicious service names, image paths, or startup configurations that indicate persistence.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Answer

HKEY_CLASSES_ROOT\exefile\shell\open\command

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Question 4

During a security incident, an analyst needs to preserve network evidence for forensic analysis. Which action should be taken first?

Accepted Answer

Capture the contents of volatile memory from affected systems.. During a security incident, the first priority is to capture volatile memory (RAM) because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. Option D is correct because volatile data is ephemeral and must be collected before any action that could alter the system state, such as shutdown or isolation.

Answer

Isolate the affected systems from the network.

Answer

Create a forensic image of all hard drives.

Answer

Shut down the affected systems to prevent further damage.

Question 5

You are a security analyst for a medium-sized enterprise. You notice that the network monitoring system has flagged an unusual amount of traffic between two internal hosts: 192.168.1.10 (a file server) and 192.168.1.20 (a workstation in the sales department). The traffic is occurring on port 445 (SMB) and is happening outside of normal business hours. The volume of data transferred is significantly higher than typical usage. The file server logs show that the sales workstation has been accessing a large number of files in quick succession. The sales employee reports that they have been working late, but they cannot explain the high volume of file access. You have access to the file server logs, network flow data, and the workstation's event logs. The workstation has antivirus software installed that is up to date. What should you do FIRST?

Accepted Answer

Isolate the workstation from the network immediately. The anomalous SMB traffic on port 445, occurring outside business hours with a high volume of file access in quick succession, strongly indicates a ransomware or data exfiltration attack. Isolating the workstation immediately contains the threat, preventing lateral movement and further encryption or exfiltration of sensitive data. This aligns with the first step in incident response: containment before analysis.

Answer

Reimage the workstation to ensure it is clean

Answer

Run a full antivirus scan on the workstation

Answer

Analyze network flow data to identify the destination of the data

Question 6

Which OSI layer is associated with protocols such as HTTP, FTP, and SMTP, and is commonly targeted by application-layer attacks?

Accepted Answer

Layer 7 - Application. HTTP, FTP, and SMTP are application-layer protocols that operate at Layer 7 of the OSI model. Application-layer attacks target this layer by exploiting vulnerabilities in the application logic, input validation, or protocol implementation, such as SQL injection, cross-site scripting (XSS), or buffer overflows in web servers.

Answer

Layer 2 - Data Link

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Question 7

An IDS generates an alert for a signature that matches HTTP traffic containing 'cmd.exe' in the URI. The analyst checks the packet and sees the URI is actually 'cmd.exe?help'. What should the analyst do?

Accepted Answer

Tune the signature to reduce false positives. The IDS signature triggered on the presence of 'cmd.exe' in the URI, but the actual traffic was 'cmd.exe?help', which is a legitimate help request and not an exploitation attempt. Tuning the signature to account for the query string reduces false positives without losing detection capability for actual attacks. This aligns with best practices for IDS management, where signatures are adjusted to match real threat patterns rather than exact strings.

Answer

Block the source IP

Answer

Disable the signature

Answer

Escalate to incident response

Question 8

Which THREE of the following are best practices for implementing security logging and monitoring? (Select 3)

Accepted Answer

Define alert thresholds based on baselines. Defining alert thresholds based on baselines is a best practice because it allows the security monitoring system to distinguish between normal and anomalous behavior. By establishing a baseline of typical network traffic, CPU usage, or login patterns, you can set thresholds that trigger alerts only when deviations occur, reducing false positives and ensuring that genuine security incidents are not missed.

Answer

Minimize log retention to reduce storage costs

Answer

Log only during incident response to reduce noise

Question 9

Which two characteristics are commonly associated with a distributed denial-of-service (DDoS) attack?

Accepted Answer

High volume of traffic from multiple sources. A DDoS attack is characterized by a high volume of traffic originating from multiple compromised sources (a botnet) to overwhelm a target. This distributed nature distinguishes it from a DoS attack, which typically uses a single source. The goal is to exhaust the target's bandwidth, processing capacity, or application resources, causing denial of service for legitimate users.

Answer

Multiple failed login attempts

Answer

Slow application response time

Answer

Traffic from a single IP address

Question 10

A security analyst at a financial firm is investigating a potential data breach. The company uses Cisco Firepower NGFW and Stealthwatch for network visibility. Over the past week, an internal server with IP 10.10.10.50 has been sending large amounts of data to an external IP 203.0.113.55 on TCP port 443. The Stealthwatch flow records show that the server typically communicates with only internal hosts and a few known external update servers. The analyst checks the Firepower events and sees no alerts for this traffic. The server is running a custom web application that handles financial transactions. The analyst suspects data exfiltration. What should the analyst do next?

Accepted Answer

Capture a packet trace of the suspicious traffic and analyze the SSL/TLS handshake to determine if the traffic is legitimate.. The traffic is encrypted over TCP port 443 (HTTPS), so the analyst cannot determine the content or legitimacy of the data transfer without decrypting or inspecting the SSL/TLS handshake. Capturing a packet trace allows the analyst to examine the TLS handshake details, such as the server certificate, cipher suites, and SNI, which can reveal whether the external IP is a legitimate service or an unauthorized endpoint. This step is non-disruptive and provides forensic evidence before taking any blocking or quarantine actions.

Answer

Immediately block the destination IP on the firewall and quarantine the server.

Answer

Review the server's web server logs for any unusual requests or responses.

Answer

Check the server's running processes and network connections with a command line tool like netstat.

Question 11

Which THREE types of network traffic anomalies are strong indicators of a data exfiltration attempt?

Accepted Answer

TCP connections with unusual port numbers (e.g., using SSH on port 80). Data exfiltration often involves tunneling covert traffic over non-standard ports to bypass firewall rules. For example, using SSH on TCP port 80 (HTTP) allows an attacker to hide command-and-control or file transfer traffic within allowed web traffic, making it difficult for basic port-based ACLs to detect.

Answer

Frequent ARP requests from a single host

Answer

High number of SYN packets without corresponding ACKs

Question 12

Drag and drop the steps to configure SSH access on a Cisco IOS switch into the correct order.

Accepted Answer

1. Configure hostname and domain name
2. Generate RSA keys
3. Create a local user account
4. Configure VTY lines to use SSH transport. SSH configuration requires domain name, RSA keys, a local user, and enabling SSH on vty lines.

Answer

1. Generate RSA keys
2. Configure hostname and domain name
3. Create a local user account
4. Configure VTY lines to use SSH transport

Answer

1. Create a local user account
2. Configure hostname and domain name
3. Generate RSA keys
4. Configure VTY lines to use SSH transport

Answer

1. Configure VTY lines to use SSH transport
2. Generate RSA keys
3. Configure hostname and domain name
4. Create a local user account

Question 13

Drag and drop the steps for the TCP three-way handshake into the correct order.

Accepted Answer

Step 1: SYN, Step 2: SYN-ACK, Step 3: ACK. The TCP three-way handshake must occur in the order: SYN, SYN-ACK, ACK. This sequence synchronizes sequence numbers and establishes a reliable connection before data transfer. Any deviation breaks protocol rules and prevents connection setup.

Answer

Step 1: SYN, Step 2: ACK, Step 3: SYN-ACK

Answer

Step 1: SYN-ACK, Step 2: SYN, Step 3: ACK

Answer

Step 1: ACK, Step 2: SYN, Step 3: SYN-ACK

Question 14

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Accepted Answer

Brute force attempt on Telnet service. The log shows repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23, which is the default port for Telnet. Multiple failed connection attempts to a Telnet service indicate a brute force attack, where an attacker tries to guess credentials by repeatedly attempting to log in.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

ICMP flood attack

Question 15

Which TWO are examples of risk treatment options? (Select two.)

Accepted Answer

Mitigate. Mitigate and accept are common risk treatment options; avoid and transfer are others, but avoid is not listed as a standard option here; the correct ones are mitigate and accept.

Answer

Neglect

Answer

Ignore

Answer

Amplify