200-201 Practice Test 31 — 15 Questions

Question 1

Which TWO of the following are key components of a security policy framework according to Cisco? (Choose two.)

Accepted Answer

Guidelines. In Cisco's security policy framework, guidelines and standards are foundational components. Guidelines offer recommended practices and flexible advice for implementing security controls, while standards define mandatory, specific technical requirements (e.g., encryption algorithms, password complexity) that must be followed. Together, they provide the structure for consistent security enforcement across an organization.

Answer

Incident Response Plan

Answer

Audit Logs

Answer

Firewalls

Question 2

Which TWO of the following are valid sources of security monitoring data in a Cisco security architecture?

Accepted Answer

Syslog messages. Syslog messages (C) are a standard protocol for logging events from network devices, servers, and applications, making them a primary source of security monitoring data. NetFlow records (E) provide IP traffic flow statistics, enabling network behavior analysis and anomaly detection. Both are explicitly listed as valid data sources in Cisco's security monitoring architecture.

Answer

RADIUS accounting

Answer

SNMP traps

Answer

WMI queries

Question 3

An analyst is investigating a host that was compromised via a web exploit. The analyst has a pcap file of the network traffic. Which TWO pieces of evidence would indicate that the attacker established a persistent backdoor?

Accepted Answer

Regular beaconing to an external IP on a high port. Regular beaconing to an external IP on a high port (Option B) is a classic indicator of a persistent backdoor because the compromised host periodically initiates outbound connections to a command-and-control (C2) server, often using non-standard high ports (e.g., 4444, 8080, or 1337) to evade firewall rules. This behavior maintains a communication channel that allows the attacker to issue commands or exfiltrate data over time, even if the initial exploit vector is patched.

Answer

A single large file upload to a cloud service

Answer

A change in the host's registry

Answer

An SSH connection from an external IP

Question 4

A security policy requires that employees use strong passwords. Which TWO of the following are characteristics of a strong password? (Select two.)

Accepted Answer

Uses a mix of uppercase, lowercase, numbers, and special characters. A strong password must include a mix of uppercase letters, lowercase letters, numbers, and special characters to increase entropy and resist brute-force and dictionary attacks. This complexity exponentially increases the number of possible combinations, making it computationally infeasible for attackers to guess or crack the password within a reasonable time frame.

Answer

Is changed every 90 days

Answer

Is a common dictionary word

Answer

Contains the user's username

Question 5

A network engineer sees the following event in the firewall logs: 'STATUS: intrusion prevented, action: drop, signature: "SQL Injection - SELECT"' on traffic from internal IP to a web server. What type of attack was detected?

Accepted Answer

SQL injection. The log entry explicitly states 'SQL Injection - SELECT' as the signature, which directly identifies the attack as SQL injection. The firewall detected a malicious SQL query (e.g., a SELECT statement with crafted input) in the traffic from an internal IP to a web server and dropped it, preventing the attack. SQL injection exploits improper input validation in web applications to manipulate backend databases.

Answer

Command injection

Answer

Buffer overflow

Answer

Cross-site scripting

Question 6

You are a security analyst at a healthcare organization. The organization uses Cisco Stealthwatch for network visibility and a SIEM for event correlation. You receive an alert that a medical records database server (IP 10.0.3.20) is communicating with an external IP (198.51.100.100) on port 22 (SSH) at 2:00 AM. The database server should have no outbound SSH connections; only remote administration is allowed from a management subnet via VPN. You check Stealthwatch and see that the connection duration is 30 minutes and the volume of data transferred is 500 MB. The database server logs show no local account logins at that time. The firewall logs show that the connection was initiated from the database server. The incident response team has been alerted. What is the most likely scenario and your immediate action?

Accepted Answer

Block the external IP 198.51.100.100 on the firewall and isolate the database server. The database server is initiating an outbound SSH connection to an unknown external IP at an anomalous time, transferring 500 MB of data—far beyond typical administrative traffic. This behavior, combined with no local account logins and the server's policy prohibiting outbound SSH, strongly indicates compromise (e.g., an attacker using SSH for data exfiltration). Immediate isolation and blocking the external IP are critical to contain the threat and prevent further data loss, aligning with incident response best practices.

Answer

Change the database administrator password immediately

Answer

Check if the SSH connection was an authorized remote administration session

Answer

Investigate the database server logs for signs of compromise before taking action

Question 7

Drag and drop the steps to investigate a security incident using a SIEM into the correct order.

Accepted Answer

Step 1: Identify, Step 2: Collect, Step 3: Analyze, Step 4: Contain, Step 5: Document. The correct sequence for investigating a security incident using a SIEM is to first identify the incident, then collect relevant data, analyze the data to understand the scope and impact, contain the threat to prevent further damage, and finally document all findings and actions. This order ensures a systematic and effective response, minimizing oversights and maximizing evidence preservation.

Answer

Step 1: Collect, Step 2: Identify, Step 3: Analyze, Step 4: Contain, Step 5: Document

Answer

Step 1: Identify, Step 2: Analyze, Step 3: Collect, Step 4: Contain, Step 5: Document

Answer

Step 1: Identify, Step 2: Collect, Step 3: Contain, Step 4: Analyze, Step 5: Document

Question 8

A security analyst is investigating an alert from a host-based intrusion detection system (HIDS) that detected a file modification in the system32 directory. Which log source should the analyst check first to understand the process that made the change?

Accepted Answer

Windows Event Logs.. Windows Event Logs (specifically Security Event ID 4656 or 4663) record detailed information about file operations, including the process that initiated the modification. Since the HIDS detected a file change in system32, the Event Logs provide the process name, user account, and timestamp needed to trace the source of the modification.

Answer

Firewall logs.

Answer

NetFlow data.

Answer

DNS logs.

Question 9

A security analyst is reviewing baseline network traffic and notices that the normal HTTP traffic volume has increased by 300% over the past hour. The increase is from a single client IP to a single external web server. What does this indicate?

Accepted Answer

Possible data exfiltration via HTTP. A 300% increase in HTTP traffic from a single client IP to a single external web server is anomalous and strongly suggests data exfiltration. Attackers often use HTTP (port 80) to tunnel stolen data out of a network because it is typically allowed through firewalls and proxies without inspection. The fact that the traffic is from one IP to one server indicates a targeted, non-distributed activity, which aligns with exfiltration rather than a volumetric attack.

Answer

A denial-of-service (DoS) attack against the web server

Answer

A distributed denial-of-service (DDoS) attack from botnets

Answer

Normal fluctuations during peak hours

Question 10

A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?

Accepted Answer

The threat intelligence feed contains a false positive for that domain. The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.

Answer

The Snort rule is misconfigured and should be disabled

Answer

The rule is too broad and matches all DNS queries

Answer

The Snort signature is too generic and should be tuned

Question 11

A security analyst discovers that an employee has been sharing login credentials with coworkers. Which policy violation is this?

Accepted Answer

Acceptable Use Policy violation. Sharing login credentials violates the Acceptable Use Policy (AUP), which defines how employees may use company systems and data. The AUP typically prohibits password sharing because it undermines non-repudiation and access control, as each user should have unique credentials for accountability. This is a direct breach of acceptable behavior, not a failure of remote access, incident response, or data classification procedures.

Answer

Remote Access Policy violation

Answer

Incident Response Policy violation

Answer

Data Classification Policy violation

Question 12

An analyst sees these logs. What should be the immediate course of action?

Accepted Answer

Investigate whether these are legitimate SSH attempts from authorized remote administrators.. The logs show repeated SSH connection attempts from the 10.0.0.0/24 subnet. The immediate priority is to determine whether these are legitimate administrative activities or malicious brute-force attempts. Investigating first prevents unnecessary disruption to authorized remote administration, which is critical for maintaining network operations and security. Blocking or changing configurations without verification could inadvertently lock out legitimate administrators or violate change-control policies.

Answer

Change the SSH port to a non-standard port.

Answer

Block all traffic from the 10.0.0.0/24 subnet.

Answer

Add an ACL permit rule for SSH from these sources.

Answer

Disable SSH access to the router.

Question 13

A security administrator is implementing a privileged access management (PAM) solution. Which practice best enforces the principle of least privilege for administrators?

Accepted Answer

Use Just-in-Time administration to grant temporary privileges. Just-in-Time (JIT) administration is the correct practice because it dynamically grants elevated privileges only for the duration of a specific task, then automatically revokes them. This directly enforces the principle of least privilege by ensuring administrators have no standing, permanent access beyond what is immediately needed. In contrast, shared accounts, permanent rights, or mere monitoring all leave excessive or uncontrolled privileges in place.

Answer

Create shared admin accounts for the team

Answer

Grant permanent admin rights to all senior administrators

Answer

Monitor admin activity without restricting access

Question 14

An analyst needs to review the Windows event logs from a host to determine if a user's account was used to log in at an unusual time. Which log type should the analyst check?

Accepted Answer

Security. The Security log in Windows Event Viewer records audit events, including successful and failed logon attempts (Event ID 4624 for successful logons). This log type is the correct source for determining if a user's account was used to log in at an unusual time, as it captures the timestamp and details of each authentication event.

Answer

Application

Answer

System

Answer

Setup

Question 15

A company's security team is investigating an alert from their EDR platform indicating that a workstation in the finance department has been making repeated connections to an external IP address associated with a known command-and-control (C2) server. The analyst has isolated the host from the network and is performing host-based analysis. The host is running Windows 10 with Sysmon deployed and Windows Event Logging enabled. The analyst reviews Sysmon events and finds: - Event ID 1 (Process Creation): 'powershell.exe -NoP -NonI -W Hidden -Enc JABzAD0ATgBlAHcALQBPAEI ...' (long encoded string) - Event ID 3 (Network Connect): powershell.exe connecting to the C2 IP on port 443 (HTTPS), and also to an internal IP on port 445 (SMB). - Event ID 11 (FileCreate): a file created at C:\Users\financeuser\AppData\Roaming\Microsoft\svchost.exe (size 512KB) with no signature. - Event ID 7 (Image Load): svchost.exe (from AppData) loaded 'crypt32.dll'. - Event ID 8 (CreateRemoteThread): not observed. The analyst also checks the Windows Security log and finds Event ID 4624 (Success Logon) for the user 'financeuser' from a remote workstation at 2:00 AM, which is outside normal hours. The workstation is part of the Active Directory domain. The analyst needs to determine the most effective next step to contain the threat and prevent recurrence.

Accepted Answer

Change the user's password, revoke all Kerberos tickets, and check for lateral movement using the SMB connection observed.. The SMB connection (port 445) to an internal IP strongly indicates lateral movement via techniques like PsExec or scheduled tasks. Changing the user's password and revoking Kerberos tickets (e.g., using `klist -li 0x3e7 purge`) immediately cuts off the attacker's authenticated access, while checking for lateral movement addresses the broader compromise. This aligns with the NIST incident response containment phase, prioritizing credential and token revocation over file deletion or reimaging alone.

Answer

Isolate the host further by blocking all inbound and outbound traffic via the host firewall, then perform memory acquisition and deep forensic analysis before remediation.

Answer

Remove the malicious svchost.exe file and kill the powershell process, then run a full antivirus scan.

Answer

Power off the workstation and reimage it immediately, then reset the user's password.