200-201 Practice Test 30 — 15 Questions

Question 1

A SOC analyst is monitoring network traffic and notices a large amount of data being transferred from the HR file server to an external IP address during off-hours. The server is supposed to be used only during business hours. The analyst checks the server logs and sees that a user account named 'backup_service' has been active and copying files. The 'backup_service' account is a service account that is normally used for automated backups, but the backup schedule is set to run at midnight, and the current time is 3 AM. The analyst suspects credential theft. Which of the following should the analyst do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture a memory dump of the server for forensic analysis.. Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory credentials) that is critical for forensic analysis of a suspected credential theft incident. This aligns with the NIST SP 800-86 forensic process, where memory acquisition is prioritized before any system shutdown or network changes to avoid losing evidence of the attacker's active session or malicious code.

Answer

Disable the 'backup_service' account immediately.

Answer

Take the HR file server offline.

Answer

Block the external IP address at the firewall.

Question 2

Drag and drop the steps to configure a VLAN on a Cisco switch into the correct order.

Accepted Answer

Enter global configuration mode, then create the VLAN, then name the VLAN, then assign ports to the VLAN.. The correct sequence for VLAN configuration on a Cisco switch is to first enter global configuration mode with 'configure terminal', then create the VLAN using 'vlan vlan-id', which places you in VLAN configuration mode. Next, assign a name with 'name vlan-name', and finally exit VLAN config mode and configure interfaces to belong to the VLAN using 'switchport access vlan vlan-id'. This order ensures the VLAN exists and has a meaningful identifier before ports are assigned.

Answer

Enter global configuration mode, then name the VLAN, then create the VLAN, then assign ports to the VLAN.

Answer

Create the VLAN, then enter global configuration mode, then name the VLAN, then assign ports to the VLAN.

Answer

Enter global configuration mode, then create the VLAN, then assign ports to the VLAN, then name the VLAN.

Question 3

A Cisco Firepower appliance generates an intrusion specific event with the message 'MALWARE-CNC generic command and control traffic detected'. The analyst needs to determine if the alert is a true positive. Which additional data source would provide the most corroborating evidence?

Accepted Answer

DNS query logs. DNS query logs are the most corroborating evidence because malware command-and-control (C2) traffic often relies on DNS to resolve the IP address of the C2 server. A sudden spike in NXDOMAIN responses, queries to algorithmically generated domains (DGA), or requests to known malicious domains in the DNS logs would directly confirm the C2 activity. This aligns with the 'MALWARE-CNC' signature, which specifically targets C2 communication patterns.

Answer

Application control logs

Answer

URL filtering logs

Answer

NetFlow records

Question 4

Refer to the exhibit. What type of activity does this log represent?

Accepted Answer

Brute force SSH attack.. The log shows repeated SSH connection attempts with 'Failed password' messages from the same source IP (10.10.0.5) to the same destination IP (10.10.0.3) for user 'admin'. This pattern of multiple failed authentication attempts in a short time window is characteristic of a brute force SSH attack, where an attacker systematically tries different passwords to gain unauthorized access.

Answer

Man-in-the-middle attack.

Answer

Denial-of-service (DoS) attack.

Answer

Port scan.

Question 5

An organization is implementing a security policy that requires all remote access to the corporate network to be authenticated using multi-factor authentication (MFA). Which TWO of the following are valid MFA factors?

Accepted Answer

Smart card. Smart card (Option B) is a valid MFA factor because it falls under the 'something you have' category. Multi-factor authentication requires at least two different categories from 'something you know' (e.g., password), 'something you have' (e.g., smart card, token), and 'something you are' (e.g., biometric). A smart card stores a digital certificate and private key, used for cryptographic authentication, typically requiring a PIN (knowledge factor) to unlock it, thus providing two-factor authentication when combined.

Answer

IP address whitelist

Answer

Password

Answer

Security question

Question 6

An analyst is reviewing Sysmon logs on a Windows host and sees Event ID 1 (process creation) with a signed parent process but an unsigned child. The child has a CommandLine that includes 'powershell -EncodedCommand'. What is the most likely threat?

Accepted Answer

PowerShell-based malware using encoded commands to evade detection. Event ID 1 with a signed parent process and an unsigned child using 'powershell -EncodedCommand' strongly indicates PowerShell-based malware. Attackers use Base64-encoded commands to obfuscate malicious actions and bypass simple string-based detection, as the encoded payload is decoded and executed by PowerShell at runtime.

Answer

Privilege escalation attempt

Answer

Process hollowing attack

Answer

Phishing email attachment

Question 7

A security analyst is creating a procedure for responding to a phishing email reported by a user. Which TWO steps should be included?

Accepted Answer

Immediately block the sender's email address at the gateway.. Immediately blocking the sender's email address at the gateway (e.g., using SMTP rejection or a content filter rule) prevents the same phishing email from reaching other users, containing the threat at the perimeter. This step aligns with incident response containment procedures and leverages email security controls like SPF, DKIM, or DMARC checks to stop further delivery.

Answer

Delete the email from the user's inbox remotely.

Answer

Ask the user to forward the original email to the security team.

Answer

Require the user to change their password.

Question 8

An incident response plan specifies that containment must be completed before eradication. A security analyst identifies a malware infection on a critical server. What should be done first?

Accepted Answer

Disconnect the server from the network. According to the incident response plan, containment must be completed before eradication. Disconnecting the server from the network (Option A) is the immediate containment action that prevents the malware from spreading laterally to other hosts, preserving the integrity of the network and allowing for forensic analysis. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized to limit damage before any eradication or recovery steps are taken.

Answer

Run antivirus scans

Answer

Notify law enforcement

Answer

Reinstall the operating system

Question 9

A host is infected with malware that uses DNS tunneling to exfiltrate data. Which type of analysis would best detect this activity?

Accepted Answer

DNS log analysis. DNS tunneling encodes exfiltrated data within DNS queries or responses, often using TXT or A record types to bypass network security controls. DNS log analysis is the most direct detection method because it reveals anomalous patterns such as unusually long domain names, excessive NXDOMAIN responses, or high volumes of DNS traffic to a single external server, which are hallmarks of tunneling activity.

Answer

Windows event log analysis

Answer

Firewall log analysis

Answer

NetFlow analysis

Question 10

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Accepted Answer

Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal. Placing the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from the DMZ to internal, prevents an attacker who compromises the web server from initiating connections to the internal database server. This implements a default-deny rule for DMZ-to-internal traffic, forcing all database access to be initiated from the internal network only, which breaks the pivot chain. The DMZ acts as a buffer zone, isolating publicly accessible services from sensitive internal resources.

Answer

Place both servers on the internal network with host-based firewalls

Answer

Use a VPN between the web server and database server

Answer

Place both servers on the same VLAN with a firewall between them

Question 11

Refer to the exhibit. A network administrator applies this ACL to the WAN interface. What is the effect on BitTorrent traffic (which typically uses ports 6881-6889)?

Accepted Answer

Incoming BitTorrent traffic using ports 6881-6889 is blocked. The ACL shown in the exhibit (not provided here but implied by the question) is applied to the WAN interface and blocks incoming TCP traffic on ports 6881-6889. BitTorrent traffic typically uses these ports, so the ACL specifically denies incoming BitTorrent connections while leaving outgoing BitTorrent traffic unaffected. This is why option C is correct.

Answer

All TCP traffic is blocked

Answer

Only outgoing BitTorrent traffic is blocked

Answer

All BitTorrent traffic is permitted

Question 12

A SOC team is implementing a security monitoring solution for a cloud-based infrastructure. Which of the following is the most important consideration for effective monitoring?

Accepted Answer

Centralized logging from all cloud services and on-premises.. Centralized logging is the most important consideration because it provides a single, unified view of security events across all cloud services and on-premises infrastructure. Without aggregation, the SOC cannot correlate events, detect distributed attacks, or perform effective threat hunting. This aligns with the principle of 'visibility first' in security monitoring.

Answer

Encrypting all logs at rest.

Answer

Reducing log retention to save cost.

Answer

Using only native cloud monitoring tools.

Question 13

A security policy requires that all privileged access be logged and monitored. A junior admin uses a shared service account to perform maintenance. The logs show the account logged in from multiple IPs at the same time. What does this indicate?

Accepted Answer

The account is being used by multiple administrators simultaneously.. The scenario describes a shared service account being used by multiple administrators simultaneously, which is exactly what the logs indicate: the same account logged in from multiple IPs at the same time. This violates the security policy requiring privileged access to be logged and monitored because it breaks non-repudiation—you cannot determine which specific admin performed which action. The correct answer is C because it directly matches the observed behavior without introducing unnecessary assumptions.

Answer

There is a network issue causing duplicate logs.

Answer

The account is compromised.

Answer

The account is being used by an automated script.

Answer

The logging system is malfunctioning.

Question 14

During a security incident, an analyst captures network traffic and observes multiple connections from an internal host to a remote IP on port 4444, with irregular packet timing and small payloads. Which type of activity is most likely indicated?

Accepted Answer

C2 beaconing. The observed traffic—multiple connections from an internal host to a remote IP on TCP port 4444, with irregular timing and small payloads—is a classic signature of command-and-control (C2) beaconing. Attackers often use non-standard high ports like 4444 to evade detection, and the irregular intervals (jitter) are intentionally introduced to avoid pattern-based anomaly detection, while small payloads minimize data transfer and reduce the chance of triggering network thresholds.

Answer

DNS tunneling

Answer

File transfer

Answer

VoIP communication

Question 15

An analyst examines a PCAP file and sees multiple packets with the same source IP, destination port 443, and a payload that starts with 'GET /login.php HTTP/1.1'. The packets occur in rapid succession with slight variations in the URL parameter. Which type of attack is most likely occurring?

Accepted Answer

HTTP flood DDoS attack. The attack involves multiple packets with the same source IP, all targeting destination port 443 with HTTP GET requests to '/login.php'. The rapid succession and slight variations in URL parameters indicate an attempt to overwhelm the web server with legitimate-looking HTTP requests, which is characteristic of an HTTP flood DDoS attack. This attack exploits the application layer (Layer 7) by exhausting server resources through repeated HTTP requests, rather than exploiting SSL/TLS or network-layer vulnerabilities.

Answer

SSL/TLS renegotiation attack

Answer

DNS amplification

Answer

ARP poisoning