200-201 Practice Test 30 — 15 Questions

Question 1

During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reconnaissance. Repeated TCP SYN packets to multiple ports followed by RST responses indicate a port scan, which is a hallmark of the Reconnaissance phase of the Cyber Kill Chain. The attacker is probing for open ports and services without completing the TCP handshake, which is typical of a SYN stealth scan. This activity occurs before any exploitation or delivery.

Answer

Delivery

Answer

Weaponization

Answer

Exploitation

Question 2

An analyst is reviewing Snort alerts and notices repeated 'ET SCAN Potential SSH Scan' alerts from the same source IP. Which action should the analyst take next?

Accepted Answer

Correlate with authentication logs to confirm unsuccessful attempts.. Snort alerts for 'ET SCAN Potential SSH Scan' indicate a pattern of connection attempts to the SSH port (TCP/22), but the alert alone does not confirm whether the attempts were successful or malicious. Correlating with authentication logs (e.g., /var/log/auth.log or Windows Event ID 4625) allows the analyst to verify failed login attempts, which is the definitive evidence of an actual SSH brute-force attack. This step aligns with the network intrusion analysis methodology of validating alerts before taking action.

Answer

Run a vulnerability scan on the destination.

Answer

Ignore because it is a false positive.

Answer

Immediately block the IP on the firewall.

Question 3

After a security incident, the IR team holds a lessons learned meeting. Which THREE activities are part of the Post-Incident Activity phase?

Accepted Answer

Developing metrics to measure IR effectiveness. Option A is correct because the Post-Incident Activity phase includes developing metrics (e.g., MTTD, MTTR, containment time) to measure the effectiveness of the incident response process and inform future improvements. Option B is correct because a core output of the lessons learned meeting is identifying improvements to the IR process, such as better detection rules, communication paths, or tooling gaps. Option C is correct because findings from the lessons learned review are used to update the incident response plan, ensuring procedures, playbooks, and roles reflect what was learned. Option D is not part of this phase; initial triage of new alerts belongs to the Detection and Analysis phase. Option E is also not part of this phase; restoring systems from backup occurs during the Containment, Eradication, and Recovery phase.

Answer

Conducting initial triage of new alerts

Answer

Restoring systems from backup

Question 4

Which protocol and port pair is commonly used for secure web traffic?

Accepted Answer

HTTPS 443. HTTPS (HTTP Secure) uses port 443 for encrypted web traffic.

Answer

FTP 21

Answer

HTTP 80

Answer

SSH 22

Question 5

A security analyst reviews logs and finds multiple failed login attempts from a single IP. This is indicative of what type of attack?

Accepted Answer

Brute-force. Multiple failed login attempts from a single IP address are characteristic of a brute-force attack, where an attacker systematically tries many passwords (or usernames) against a single account or service until successful. This pattern is distinct from other attack types because it involves repeated authentication attempts from one source, aiming to guess credentials rather than intercept traffic, deceive users, or overwhelm resources.

Answer

Man-in-the-middle

Answer

Phishing

Answer

DDoS

Question 6

A Zeek connection log shows a high number of connections from a single internal IP to many different external IPs on port 25, with small payload sizes. Which behavior is most likely indicated?

Accepted Answer

Spam email campaign or SMTP scanning. Port 25 is the default SMTP port used for email transmission. A high volume of connections from a single internal IP to many different external IPs on port 25, with small payload sizes, is characteristic of a spam email campaign or SMTP scanning. This pattern suggests the host is either sending bulk spam emails or probing external mail servers for open relay or user enumeration.

Answer

DNS tunneling

Answer

Secure web browsing

Answer

Data exfiltration using FTP

Question 7

You are a security operations analyst for a medium-sized enterprise. The company's security policy requires that all endpoint devices have antivirus software installed and updated. During a routine check, you find that a group of 50 laptops used by the sales team have not received antivirus updates for over three months. The policy also states that any non-compliant devices must be quarantined from the network until they are remediated. The sales team manager argues that quarantining the laptops will disrupt critical sales activities. The company's incident response policy has a clause that allows for temporary exceptions in business-critical situations, but requires approval from the CISO. What is the best course of action?

Accepted Answer

Request a temporary exception from the CISO while expediting the updates. It balances security policy compliance with business continuity. The incident response policy explicitly allows temporary exceptions for business-critical situations with CISO approval, and expediting the updates ensures the 50 laptops are remediated quickly. Quarantining without considering the business impact could violate the company's own exception clause, while ignoring the issue or updating without quarantining bypasses the security controls required by policy.

Answer

Ignore the issue to avoid disrupting sales activities

Answer

Quarantine the laptops immediately as per policy

Answer

Update the antivirus without quarantining, then report to management

Question 8

A security analyst observes a NetFlow record showing a single internal IP communicating with many external IPs on port 445 within seconds. This pattern is indicative of:

Accepted Answer

SMB scanning. A single internal host contacting many external IPs on TCP/445 in a short window is the signature of SMB scanning — the host is enumerating SMB services across the internet or a target range. Port 445 is the SMB-over-TCP port, and the fan-out to many destinations distinguishes scanning from a single-target connection. This is often a precursor to SMB exploitation (EternalBlue, SMBGhost) or lateral movement.

Answer

DNS tunneling

Answer

Data exfiltration

Answer

Port scan

Question 9

An analyst reviews an alert that triggered on a network signature for 'shellcode' in a payload. The payload contains a sequence of NOP sleds followed by executable code. Which type of exploitation technique does this indicate?

Accepted Answer

Buffer overflow with NOP sled. A NOP sled (a long run of no-operation instructions) immediately preceding shellcode is the classic signature of a stack-based buffer overflow exploit. The sled gives the attacker a large landing zone so the overwritten return address only needs to jump somewhere into the sled, which then slides execution into the payload.

Answer

Return-oriented programming (ROP)

Answer

Heap spray

Answer

Format string attack

Question 10

A NetFlow analysis shows a single internal host communicating with many external IP addresses on port 443, but the traffic volumes are very low (small packets). What is the most likely explanation?

Accepted Answer

C2 communication. The combination of a single internal host communicating with many external IPs on port 443 (HTTPS) with very low traffic volumes and small packets is a classic indicator of command-and-control (C2) beaconing. C2 malware often uses HTTPS to blend in with legitimate web traffic, but the small, periodic packets (e.g., keep-alive or heartbeat messages) distinguish it from normal web browsing, which would involve larger data transfers and consistent payload sizes.

Answer

Phishing

Answer

Web browsing

Answer

Port scanning

Question 11

You are a security analyst at a financial institution. The network consists of a traditional perimeter firewall, an internal IDS (Snort), and a separate network monitoring tool that captures full packet data. Recently, the bank experienced a breach where an attacker exfiltrated customer data via DNS tunneling. The attack went undetected for weeks. The CISO wants to improve detection of data exfiltration and has tasked you with proposing a new monitoring strategy. The current IDS has signatures for common malware C2 channels but no specific DNS tunneling rules. You have access to the full packet capture archive. Which approach would be most effective in detecting DNS tunneling while minimizing false positives?

Accepted Answer

Write custom Snort rules that monitor DNS query size, frequency, and domain name entropy, and use full packet capture to baseline typical DNS behavior.. DNS tunneling exploits legitimate DNS protocol behavior by encoding data in query payloads, making it invisible to signature-based detection. By writing custom Snort rules that monitor query size (typically > 255 bytes for TXT records), frequency (abnormally high query rates per domain), and domain name entropy (random-looking subdomains), and using full packet capture to baseline normal DNS traffic, you can detect anomalies indicative of tunneling with high precision and low false positives.

Answer

Block all DNS queries to external domains not on a whitelist, and log all blocked queries for review.

Answer

Increase the Snort signature sensitivity for all DNS-related alerts to maximum.

Answer

Deploy NetFlow monitoring on the DNS server and look for traffic volume anomalies.

Question 12

Which port is used by RDP (Remote Desktop Protocol) and is a common target for brute force attacks?

Accepted Answer

3389. RDP (Remote Desktop Protocol) operates by default on TCP port 3389, a fact that makes it a prime target for brute force attacks because it provides direct interactive access to Windows systems. Attackers frequently scan for open 3389 ports and attempt credential stuffing or password spraying to gain unauthorized remote access. The other ports listed are associated with different services: 443 for HTTPS, 22 for SSH, and 1433 for Microsoft SQL Server.

Answer

443

Answer

22

Answer

1433

Question 13

MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?

Accepted Answer

Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process. To ensure proper evidence collection and preservation of chain of custody, the analyst should make a bit-for-bit copy of the audit log files using a forensic tool, hash both the original and the copy, and document the process. This maintains the integrity of the evidence and provides a verifiable record. Hashing ensures that any tampering can be detected, and documentation establishes the chain of custody.

Answer

Export the logs to a CSV file and email them to the security team

Answer

Use a write-blocker to create a forensic image of the entire hard drive

Answer

Copy the audit logs to a USB drive and store it in a locked drawer

Question 14

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices on the same network. Which attack technique is being used?

Accepted Answer

Man-in-the-Middle. A man-in-the-middle attack is when an attacker intercepts and modifies communications between two parties who believe they are talking directly to each other. The scenario describes interception and modification of traffic between two devices on the same network, which is the defining behavior of a MITM attack. ARP spoofing is often the technique used to enable MITM on a LAN, but the attack technique described is MITM itself.

Answer

Reconnaissance

Answer

ARP spoofing

Answer

DNS poisoning

Question 15

A security analyst is reviewing the firewall log exhibit. The analyst suspects that this traffic might be part of a command-and-control (C2) communication based on the packet size and the timing of similar events. Which TWO additional pieces of evidence would most strongly support the suspicion of C2 traffic?

Accepted Answer

The destination IP is listed in a threat intelligence feed as a known C2 server.. A destination IP listed in a threat intelligence feed as a known C2 server directly indicates that the endpoint is associated with malicious command-and-control infrastructure. This external corroboration is strong evidence that the traffic is part of a C2 channel, as threat feeds aggregate confirmed indicators of compromise (IoCs) from multiple sources.

Answer

The packet size is consistently 1452 bytes across multiple connections.

Answer

The source IP also connected to multiple other external IPs on port 443 within the same hour.

Answer

The traffic is using HTTPS (port 443) which is commonly used for covert channels.