200-201 Practice Test 2 — 30 Questions

Question 1

Which two Sysmon Event IDs are most commonly associated with code injection techniques?

Accepted Answer

Event ID 8 (CreateRemoteThread). Sysmon Event ID 8 (CreateRemoteThread) is directly associated with code injection because it logs when a thread is created in a remote process, a common technique used by malware to inject malicious code into a legitimate process. Event ID 10 (ProcessAccess) is also critical as it records when a process opens a handle to another process, often a precursor to injecting code via APIs like OpenProcess and WriteProcessMemory.

Answer

Event ID 3 (Network connect)

Answer

Event ID 1 (Process creation)

Answer

Event ID 7 (Image loaded)

Question 2

An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)

Accepted Answer

Large DNS response packets. Large DNS response packets (Option B) are indicative of data exfiltration because attackers often encode stolen data into DNS TXT or other record types, causing response sizes to exceed the typical 512-byte limit and triggering EDNS0 extensions. This anomaly stands out against normal DNS traffic, where most responses are small.

Answer

Use of standard DNS ports

Answer

DNSSEC enabled

Answer

Frequent DNS query retransmissions

Question 3

A company's web server is overwhelmed by traffic from multiple compromised systems, causing it to become unresponsive to legitimate users. Which type of attack is this?

Accepted Answer

DDoS. (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Answer

MitM

Answer

DoS

Answer

Botnet

Question 4

Given a packet capture showing TCP packets with flags: first packet SYN, second packet SYN-ACK, third packet ACK, then a fourth packet with RST flag. What should the analyst suspect?

Accepted Answer

Port scan. The three-way handshake (SYN, SYN-ACK, ACK) completes a TCP connection, but the immediate RST after the ACK indicates the client terminated the connection without sending any application data. This pattern is characteristic of a port scan (e.g., using nmap's connect scan), where the scanner verifies the port is open by completing the handshake and then immediately resets to avoid leaving the connection half-open.

Answer

Normal traffic

Answer

SYN flood

Answer

Denial of service

Question 5

Which of the following is an example of an Indicator of Compromise (IoC)?

Accepted Answer

A file hash (SHA-256). An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Answer

A SIEM dashboard

Answer

A firewall rule

Answer

A network baseline

Question 6

A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:

Accepted Answer

False positive. A false positive occurs when an alert is triggered but no actual attack exists. The file is benign, so the alert is incorrect.

Answer

True positive

Answer

False negative

Answer

True negative

Question 7

You are a security analyst at a multinational corporation. The company has implemented a security policy that requires all employees to use company-issued laptops with full disk encryption. During a routine audit, you discover that a senior executive's laptop is not encrypted. The executive claims that IT support had disabled encryption because the laptop was running slowly. The current policy does not allow exceptions without management approval. The executive's laptop contains sensitive client data. What should you do?

Accepted Answer

Report the violation to the security manager and advise that the laptop remain in use but monitored closely until encryption can be applied during next maintenance window.. It follows the security policy by reporting the violation to the security manager and proposing a monitored approach until encryption can be applied during the next maintenance window, balancing security and operational continuity. Option B is insufficient as it creates an informal exception without proper authorization. Option C is an overreaction without evidence of data exposure. Option D violates policy by taking unauthorized action.

Answer

Accept the executive's explanation and document it as an informal exception.

Answer

Escalate to the incident response team to treat this as a data breach because data may have been exposed.

Answer

Immediately re-enable encryption on the laptop and submit an exception request after the fact.

Question 8

Drag and drop the steps to configure a Cisco ASA firewall for basic network access into the correct order.

Accepted Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Apply access-list to interface
5. Verify configuration. The correct order for basic Cisco ASA configuration is: global configuration mode, interface configuration (nameif, IP address, security-level), ACL creation, ACL application to interface, and verification. This sequence ensures interfaces are ready, ACLs exist before being applied, and verification confirms the policy is active. Common mistakes include creating or applying ACLs before interfaces are configured, or verifying before applying the ACL.

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Configure interfaces (nameif, ip address, security-level)
4. Apply access-list to interface
5. Verify configuration

Answer

1. Enter global configuration mode
2. Configure interfaces (nameif, ip address, security-level)
3. Create access-list rules
4. Verify configuration
5. Apply access-list to interface

Answer

1. Enter global configuration mode
2. Create access-list rules
3. Apply access-list to interface
4. Configure interfaces (nameif, ip address, security-level)
5. Verify configuration

Question 9

An analyst is reviewing a memory dump and uses Volatility's cmdline plugin to view process command lines. One process shows command line arguments that include a long base64-encoded string. What should the analyst suspect?

Accepted Answer

The process may be running obfuscated malicious code. The presence of a long base64-encoded string in a process command line is a strong indicator of obfuscation, commonly used by malware to hide payloads or configuration data from static analysis. Base64 encoding is not encryption; it is a simple encoding scheme that can be easily decoded, but it obscures the string's content from casual inspection. Volatility's cmdline plugin reveals this artifact, and an analyst should suspect that the process is executing obfuscated malicious code, as attackers frequently use this technique to evade signature-based detection.

Answer

The process is benign and the string is a normal parameter

Answer

The string is a hash for integrity verification

Answer

The process is using encryption

Question 10

Which of the following best describes the relationship between a vulnerability, threat, and risk in cybersecurity?

Accepted Answer

A threat exploits a vulnerability, resulting in risk.. In cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

Answer

A vulnerability is a potential danger; a threat is a weakness; risk is the impact.

Answer

A vulnerability is a potential attack; a threat is a weakness.

Answer

Risk is eliminated when a vulnerability is patched.

Question 11

A company's endpoint detection and response (EDR) agent is reporting a file that was created with a name matching a known ransomware pattern. The analyst suspects the file is malicious. What is the best first step to contain the threat?

Accepted Answer

Isolate the host from the network. Isolating the host from the network is the best first step because it immediately stops the ransomware from communicating with its command-and-control (C2) server and prevents lateral movement to other systems. The EDR agent has already flagged the file as suspicious, so the priority is containment, not further analysis or deletion, which could trigger the ransomware to encrypt data. Network isolation breaks the attack chain at the host level, buying time for forensic analysis and remediation.

Answer

Create a new firewall rule

Answer

Run a full antivirus scan

Answer

Delete the file

Question 12

A security analyst is creating a network baseline for normal traffic patterns. Which TWO metrics should be included to detect anomalies?

Accepted Answer

Average bandwidth usage per hour. Average bandwidth usage per hour is correct because it establishes a baseline of typical traffic volume over time, allowing the analyst to detect sudden spikes or drops that may indicate anomalies such as DDoS attacks or data exfiltration. Number of connections per host is correct because it provides a per-device baseline for connection counts, enabling detection of unusual behavior like port scans, botnet activity, or compromised hosts generating excessive outbound connections.

Answer

Geolocation of source IPs

Answer

MAC addresses of devices

Answer

CPU utilization of servers

Question 13

An attacker sends a fraudulent email that appears to come from the company's IT department, requesting that the recipient click a link and enter their login credentials. Which type of social engineering attack is this?

Accepted Answer

Phishing. This is a phishing attack because the attacker uses a fraudulent email that impersonates a trusted entity (the IT department) to trick the recipient into clicking a malicious link and entering sensitive login credentials. Phishing is a broad category of social engineering that relies on deceptive electronic communications, typically email, to harvest credentials or deliver malware.

Answer

Vishing

Answer

Pretexting

Answer

Spear phishing

Question 14

An analyst suspects a host is communicating with a command-and-control server using DNS tunneling. Which THREE network traffic patterns would support this hypothesis?

Accepted Answer

Frequent use of TXT record type in DNS queries. DNS tunneling often uses high query volumes, TXT records to encode data, and large response sizes.

Answer

DNS queries with TTL values greater than 86400

Answer

DNS queries for multiple well-known domains

Question 15

A company wants to monitor for unauthorized wireless access points. Which technique should they implement?

Accepted Answer

Deploy a Wireless Intrusion Prevention System (WIPS).. A Wireless Intrusion Prevention System (WIPS) is specifically designed to detect, classify, and block unauthorized wireless access points (rogue APs) by continuously monitoring the RF spectrum. Unlike wired-only controls, WIPS can identify rogue devices that are not connected to the wired network, making it the correct choice for this requirement.

Answer

Enable port security on all switches.

Answer

Use VLAN segmentation.

Answer

Implement 802.1X authentication.

Question 16

A security analyst is reviewing NetFlow records and notices a host sending data to an external IP at regular intervals during non-business hours. Which flow characteristic is most indicative of data exfiltration?

Accepted Answer

Constant bit rate and consistent packet size.. Data exfiltration often uses a steady, low-and-slow approach to evade detection. A constant bit rate and consistent packet size indicate a scripted, automated transfer, such as a beacon or a covert channel, which is highly suspicious during non-business hours. This pattern contrasts with legitimate traffic, which typically shows variable packet sizes and bursty behavior.

Answer

Random destination ports.

Answer

High number of small packets.

Answer

Low number of bytes per flow.

Question 17

Which compliance standard specifically applies to organizations that handle credit card information?

Accepted Answer

PCI DSS. PCI DSS is the Payment Card Industry Data Security Standard for credit card data.

Answer

HIPAA

Answer

GDPR

Answer

ISO 27001

Question 18

An analyst observes an alert triggered by a single SYN packet to a closed port. The packet did not complete a TCP handshake. What type of attack does this most likely indicate?

Accepted Answer

SYN scan. A SYN scan sends SYN packets to target ports. If a RST is received, the port is closed. The incomplete handshake is characteristic of a SYN scan, not a full connection scan or DoS attack.

Answer

TCP connect scan

Answer

Ping sweep

Answer

UDP scan

Question 19

A security analyst observes a large number of SYN packets sent to various ports on a target host, receiving RST responses for closed ports and no response for open ports. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Reconnaissance. The observed behavior—sending a large number of SYN packets to various ports and analyzing RST responses (closed ports) versus no response (open ports)—is a classic port scan, specifically a SYN scan. This activity maps the target's attack surface by identifying live hosts and open ports, which aligns with the Reconnaissance phase of the Cyber Kill Chain, where the adversary gathers information to plan an attack.

Answer

Weaponisation

Answer

Exploitation

Answer

Delivery

Question 20

Which organization facilitates threat intelligence sharing among members in a specific sector, such as finance or healthcare?

Accepted Answer

ISAC. ISACs (Information Sharing and Analysis Centers) are sector-specific threat intelligence sharing groups.

Answer

MISP

Answer

STIX

Answer

TAXII