200-201 Practice Test 29 — 15 Questions

Question 1

During an incident, a SOC Tier 1 analyst identifies a series of failed login attempts from an internal IP address. The analyst escalates the alert. What is the primary role of a Tier 2 analyst in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform deeper investigation and correlate events. Tier 2 analysts take escalated alerts from Tier 1 and perform deeper investigation, correlating events across multiple log sources, endpoints, and network telemetry to determine scope and root cause. In this scenario, the failed login attempts from an internal IP require correlation with authentication logs, endpoint activity, and threat intelligence — exactly the Tier 2 function.

Answer

Monitor alerts and perform initial triage

Answer

Make decisions on business impact and notification

Answer

Conduct threat hunting and advanced forensics

Question 2

Which Windows registry hive contains user-specific configuration settings that can be modified by applications?

Accepted Answer

HKEY_CURRENT_USER. HKEY_CURRENT_USER (HKCU) is the correct answer because it stores user-specific configuration settings, such as desktop preferences, environment variables, and application settings, that are loaded from the NTUSER.DAT file when a user logs in. Applications modify this hive to persist per-user customizations, making it the primary location for user-level registry changes.

Answer

HKEY_CLASSES_ROOT

Answer

HKEY_LOCAL_MACHINE

Answer

HKEY_USERS

Question 3

A security auditor reviews the SNMP configuration. Which security concern should be reported?

Accepted Answer

The community strings are set to default values. Default SNMP community strings (e.g., 'public' for read-only, 'private' for read-write) are well-known and widely documented. An attacker who discovers these defaults can query or modify the device's MIB, leading to information disclosure or unauthorized configuration changes. This is a critical security concern that must be reported.

Answer

The location and contact information is exposed

Answer

SNMP is disabled on the router

Answer

The private community string is read-only

Question 4

Which TWO network behaviors suggest an ARP spoofing attack is occurring? (Choose two.)

Accepted Answer

Packets originating from a MAC address that does not match the IP's legitimate MAC. Option C is correct because in ARP spoofing the attacker sends forged ARP replies that bind its own MAC address to a victim's IP address, so traffic for that IP arrives from a MAC that does not match the legitimate owner's MAC. Option E is correct because a classic ARP poisoning signature is multiple IP addresses (for example, the gateway and another host) resolving to the same attacker MAC address, indicating the attacker is impersonating several hosts. Option A is not specific to ARP spoofing, since TCP RST floods indicate session teardown or DoS activity rather than ARP cache manipulation. Option B is not a reliable indicator, as a single host sending many ARP requests is normal behavior during address resolution or scanning. Option D is also weak, because increased broadcast ARP traffic can result from legitimate network growth, misconfiguration, or scanning and does not by itself prove spoofing.

Answer

A high number of TCP RST packets

Answer

A single host sending numerous ARP requests

Answer

An increase in broadcast ARP traffic

Question 5

A security analyst observes repeated failed login attempts from a single external IP address, causing the authentication server to become unresponsive. Which type of attack is occurring?

Accepted Answer

Denial of Service. The scenario describes repeated failed login attempts from a single external IP that render the authentication server unresponsive — this is a Denial of Service (DoS) condition, where the volume of authentication requests exhausts server resources (CPU, connection table, lock contention) and denies service to legitimate users. The defining symptom is availability loss, not credential compromise or information gathering. A brute force attack would aim to guess credentials, but here the observed outcome is service unavailability.

Answer

Reconnaissance

Answer

Brute force attack

Answer

Man-in-the-middle

Question 6

An analyst is reviewing alerts from an IDS. A signature matched 'script' and 'alert' in HTTP request parameters. The analyst inspects the packet and sees in the URI. What is the most accurate classification of this alert?

Accepted Answer

True positive. The alert corresponds to a real attack (cross-site scripting) in the traffic, so it is a true positive.

Answer

False negative

Answer

False positive

Answer

True negative

Question 7

A security analyst is investigating a potential data exfiltration incident. Which TWO of the following network behaviors are indicators of data exfiltration?

Accepted Answer

Frequent DNS queries to a known malicious domain. Option D is correct because frequent DNS queries to a known malicious domain indicate data exfiltration via DNS tunneling, where attackers encode stolen data in DNS query names or responses to bypass perimeter controls that typically allow DNS traffic. Option E is correct because unusually large outbound traffic from a single host is a classic exfiltration indicator, as compromised systems often transfer large volumes of data to external command-and-control or drop servers, deviating from normal baseline egress patterns. Option A is not correct because a high number of ICMP echo requests typically indicates a ping sweep or network reconnaissance/DoS activity rather than data exfiltration. Option B is not correct because a single host scanning multiple internal IPs is characteristic of internal reconnaissance or lateral movement, not exfiltration of data outside the network. Option C is not correct because multiple successful login attempts from a single IP suggest credential-based access or brute-force success, which is an initial access or lateral movement indicator rather than data exfiltration.

Answer

A high number of ICMP echo requests

Answer

A single host scanning multiple internal IPs

Answer

Multiple successful login attempts from a single IP

Question 8

Match each log severity level to its description (syslog).

Accepted Answer

Emergency: System is unusable. Syslog severity levels are from 0 (Emergency) to 7 (Debug). Emergency, Alert, Critical, Error, Warning, Notice, Informational, and Debug are standard levels. Common confusions involve swapping levels with similar descriptions.

Answer

Critical: Warning conditions

Answer

Warning: Critical conditions

Question 9

Based on the exhibit, what does the sequence of events indicate?

Accepted Answer

A process masquerading as svchost.exe was spawned by wmiprvse.exe (likely via WMI), and then that malicious process launched calc.exe, a suspicious behavior.. The exhibit shows wmiprvse.exe (the WMI Provider Host) spawning svchost.exe, which then launches calc.exe. In normal operations, wmiprvse.exe does not spawn svchost.exe; svchost.exe is a generic host process for Windows services and is typically launched by services.exe. The sequence indicates process masquerading: an attacker used WMI to execute a malicious binary named svchost.exe, which then launched calc.exe as a suspicious payload. This is a classic indicator of lateral movement or privilege escalation via WMI.

Answer

The wmiprvse.exe process is known to spawn svchost.exe for system health checks.

Answer

The user is executing a macro that opens Calculator.

Answer

A legitimate system process (wmiprvse.exe) launched a service host, which then launched calc.exe for maintenance.

Question 10

Match each cybersecurity framework/standard to its focus.

Accepted Answer

NIST Cybersecurity Framework: Focuses on improving cybersecurity for critical infrastructure.. Correct matches: NIST CSF for critical infrastructure, ISO 27001 for ISMS, PCI DSS for cardholder data, CIS Controls for prioritized security actions. Common confusions include swapping these terms.

Answer

NIST Cybersecurity Framework: Focuses on a prioritized set of security actions.

Answer

ISO/IEC 27001: Focuses on protection of cardholder data.

Question 11

An analyst notices that a host is sending large amounts of data to an external IP address on TCP port 22 during non-business hours. What is the most likely activity?

Accepted Answer

Data exfiltration via SSH. SSH (TCP port 22) is commonly used for secure remote administration, but the scenario describes large data transfers to an external IP during non-business hours, which is a classic indicator of data exfiltration. Attackers often use SSH tunneling to bypass security controls and exfiltrate data because SSH encrypts the traffic, making it difficult for network monitoring tools to inspect the payload. The combination of high volume, external destination, and off-hours activity strongly suggests malicious data theft rather than legitimate administrative tasks.

Answer

Remote administration

Answer

DNS query

Answer

FTP file transfer

Question 12

An analyst notices that a DNS query for 'www.attacker.com' contains a long subdomain with Base64-encoded data. This activity is observed every 5 minutes. What exfiltration technique is most likely in use?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses, often using Base64 or hex in subdomains, and is characterized by periodic, high-volume queries to a single domain. The long Base64-encoded subdomain and 5-minute interval are classic indicators of data exfiltration via DNS. Attackers use this because DNS is rarely blocked and often overlooked by security controls.

Answer

Steganography

Answer

HTTP POST exfiltration

Answer

FTP exfiltration

Question 13

A security analyst is monitoring network traffic and notices a sudden increase in outbound connections from a single workstation to multiple IP addresses on port 443 at regular intervals. The workstation is used for standard office applications. Which action should the analyst take first?

Accepted Answer

Correlate the connections with firewall logs and endpoint telemetry. The sudden increase in outbound connections to multiple IPs on port 443 (HTTPS) from a single workstation could indicate command-and-control (C2) traffic, data exfiltration, or a compromised system. The first step should be to correlate these connections with firewall logs and endpoint telemetry to gather contextual evidence—such as process names, parent processes, and connection durations—before taking any disruptive action. This aligns with the NIST incident response process (Preparation, Detection & Analysis, Containment, Eradication, Recovery) where analysis precedes containment.

Answer

Immediately block all outbound traffic from the workstation

Answer

Escalate to the incident response team immediately

Answer

Isolate the workstation from the network

Question 14

An analyst finds a registry modification under 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options'. What is the primary use of this registry key?

Accepted Answer

To set a debugger that runs when the image is executed. The Image File Execution Options (IFEO) registry key is used to specify a debugger that launches when a particular executable is started. Attackers abuse this by setting a 'Debugger' value to a malicious binary, achieving persistence and execution hijacking. Legitimate use includes attaching debuggers to specific processes, but the primary security-relevant function is debugger redirection.

Answer

To configure network firewall rules for the image

Answer

To change the file extension association for the image

Answer

To log all execution of the image to the Event Log

Question 15

An analyst is configuring a Snort rule to detect a known exploit targeting Apache web servers. The exploit sends a malicious HTTP POST request with a long User-Agent string. Which Snort rule header and options are most appropriate?

Accepted Answer

alert tcp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;). The rule must alert on TCP traffic to port 80 because HTTP POST requests use TCP, and Apache web servers typically listen on port 80 for unencrypted HTTP. The content match for 'POST' and the PCRE regex looking for a User-Agent string of 200 or more characters correctly targets the described exploit. This combination of protocol, port, and payload inspection is the most appropriate Snort rule.

Answer

alert icmp any any -> any 80 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert tcp any any -> any 443 (content:"POST"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)

Answer

alert udp any any -> any 80 (content:"GET"; pcre:"/User-Agent:.{200,}/R"; sid:1000001;)