200-201 Practice Test 3 — 10 Questions

Question 1

Which type of traffic is most prominent in this NetFlow data?

Accepted Answer

HTTP. HTTP traffic is most prominent because the NetFlow data shows a high volume of packets and bytes on TCP port 80, which is the default port for HTTP. NetFlow records summarize traffic flows, and the large number of flows and bytes on port 80 indicates that HTTP is the dominant protocol in the captured data.

Answer

SSH

Answer

DNS

Answer

HTTPS

Question 2

A security analyst observes a large number of SYN packets sent to various ports on a target host, receiving RST responses for closed ports and no response for open ports. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Reconnaissance. The observed behavior—sending a large number of SYN packets to various ports and analyzing RST responses (closed ports) versus no response (open ports)—is a classic port scan, specifically a SYN scan. This activity maps the target's attack surface by identifying live hosts and open ports, which aligns with the Reconnaissance phase of the Cyber Kill Chain, where the adversary gathers information to plan an attack.

Answer

Weaponisation

Answer

Exploitation

Answer

Delivery

Question 3

A SOC analyst needs to create a SIEM correlation rule to detect a brute force attack against SSH on a server. Which of the following would be the most effective rule logic?

Accepted Answer

Alert when more than 10 failed SSH logins from the same source IP occur within 1 minute.. A brute force attack is characterized by a high volume of failed authentication attempts from a single source within a short time window. By alerting on more than 10 failed SSH logins from the same source IP within 1 minute, the rule effectively distinguishes malicious automated guessing from isolated user errors, minimizing false positives while capturing the core behavior of a brute force attempt.

Answer

Alert when a single failed SSH login occurs.

Answer

Alert when successful SSH logins occur outside business hours.

Answer

Alert when multiple failed SSH logins from various IPs occur in one hour.

Question 4

In the Cyber Kill Chain model, which phase involves delivering the exploit to the target, such as via email attachment or malicious link?

Accepted Answer

Delivery. The delivery phase is where the weaponized payload is transmitted to the victim, e.g., via phishing email or drive-by download.

Answer

Installation

Answer

Exploitation

Answer

Weaponization

Question 5

A security policy states that user activity logs must be retained for at least one year. What is the primary purpose of this requirement?

Accepted Answer

To support forensic investigations of security incidents. The primary purpose of retaining user activity logs for at least one year is to support forensic investigations of security incidents. When a breach or policy violation occurs, security analysts need historical log data to reconstruct the timeline of events, identify the initial compromise vector, and determine the scope of damage. Without long-term retention, critical evidence may be overwritten or purged before an incident is discovered, making root cause analysis impossible.

Answer

To improve system performance through log analysis

Answer

To comply with regulatory requirements only

Answer

To enable real-time monitoring of user behavior

Question 6

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

Accepted Answer

Periodic connections at regular intervals to an external IP. Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.

Answer

Large data transfers to a known cloud provider

Answer

ICMP echo requests to multiple hosts

Answer

Random intervals with varying packet sizes

Question 7

Which security policy defines the process for reporting discovered security vulnerabilities to the organization?

Accepted Answer

Vulnerability Disclosure Policy. A Vulnerability Disclosure Policy (VDP) defines how external researchers and the public should report security vulnerabilities to an organization, including the scope, reporting channel, and expected response timeline. It is the formal mechanism that governs the inbound reporting process, distinct from internal incident response procedures.

Answer

Acceptable Use Policy

Answer

Incident Response Policy

Answer

Change Management Policy

Question 8

In Linux forensics, which file would an analyst check to see command history of a user, potentially revealing malicious commands executed?

Accepted Answer

/home/user/.bash_history. Bash history is stored in ~/.bash_history for each user.

Answer

/etc/passwd

Answer

/proc/net/tcp

Answer

/var/log/auth.log

Question 9

An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?

Accepted Answer

Command and Control. The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Answer

Delivery

Answer

Actions on Objectives

Answer

Installation

Question 10

A company uses Cisco Firepower NGFW with intrusion prevention. An analyst notices that many legitimate HTTPS connections are being blocked by an IPS rule. What is the best approach to reduce false positives?

Accepted Answer

Create a custom rule exception for the specific destination IPs.. Creating a custom rule exception for the specific destination IPs is the best approach because it allows the IPS to continue blocking malicious traffic while exempting legitimate HTTPS connections that are incorrectly flagged. This maintains security posture by not weakening the rule globally, and it directly addresses the false positive without affecting detection of other threats.

Answer

Increase the severity threshold of the rule.

Answer

Disable the IPS rule entirely.

Answer

Change the rule action from 'Drop' to 'Alert'.