200-201 Practice Test 31 — 15 Questions

Question 1

During a security incident, a SOC analyst finds that the SIEM is not receiving logs from a critical firewall due to a network issue. The analyst needs to ensure that no alerts are missed during the outage. What should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the firewall to queue logs locally and forward when connectivity is restored.. Configuring the firewall to queue logs locally ensures that log data generated during the network outage is stored in a local buffer (often using syslog buffering or a local log file) and automatically forwarded once connectivity to the SIEM is restored. This prevents any gap in security monitoring and ensures that all alerts are captured for analysis, even during transient network failures.

Answer

Restart the SIEM collector service.

Answer

Manually monitor the firewall console.

Answer

Ignore the gap because logs are not critical.

Question 2

A company's web server is overwhelmed with traffic from many compromised devices, causing legitimate users to be unable to access the site. What type of attack is this?

Accepted Answer

DDoS. A DDoS (Distributed Denial of Service) attack uses many compromised devices — often a botnet — to flood a target with traffic, overwhelming its resources so legitimate users cannot connect. The key distinguishing factor in the question is 'many compromised devices,' which indicates distribution across multiple sources rather than a single attacking host. This matches the definition of DDoS and differentiates it from a single-source DoS attack.

Answer

ARP spoofing

Answer

DoS

Answer

DNS poisoning

Question 3

You are a security administrator for a company with 500 employees. The company uses a SIEM with basic correlation rules. Recently, the HR department reported that several employees received phishing emails with a link to a fake login page. The emails bypassed the spam filter. You want to detect if any employees clicked the link. You have access to web proxy logs, DNS logs, and endpoint antivirus logs. The phishing link is 'http://malicious-login.com/verify'. Which action should you take first to identify affected users?

Accepted Answer

Query the web proxy logs for HTTP requests containing the URL.. The web proxy logs record all HTTP requests made by clients, including the full URL path. Querying for 'http://malicious-login.com/verify' directly shows which employees clicked the link, because the proxy captures the exact destination and timestamp of each request. This is the most direct and reliable evidence of user interaction with the phishing link.

Answer

Run a vulnerability scan on all employee workstations.

Answer

Search DNS logs for queries to 'malicious-login.com'.

Answer

Search endpoint logs for any malware detections.

Question 4

An analyst is tuning Snort IDS rules and wants to reduce false positives. Which TWO rule options can be adjusted to decrease sensitivity?

Accepted Answer

Add a 'suppress' rule to ignore traffic from known benign IPs. Option B is correct because a 'suppress' rule in Snort tells the IDS to ignore alerts generated by a specific rule for a given source or destination IP, which directly eliminates false positives caused by known benign hosts. Option E is correct because 'detection_filter' (or its predecessor 'threshold') requires a specified number of matches within a time interval before an alert fires, raising the bar for triggering and thereby reducing sensitivity to isolated or incidental events. Option A is incorrect because changing the action from 'alert' to 'drop' alters the response mode (inline IPS behavior) rather than decreasing detection sensitivity, and it may even increase impact. Option C is incorrect because switching the protocol from TCP to UDP changes what traffic the rule inspects, not the sensitivity threshold, and would likely miss the intended traffic. Option D is incorrect because increasing priority from low to high only affects alert ranking and does not reduce the number of false positives generated.

Answer

Change the rule action from 'alert' to 'drop'

Answer

Change protocol from TCP to UDP

Answer

Increase the rule priority from low to high

Question 5

An organization wants to protect sensitive data at rest and in transit. Which THREE cryptographic methods can provide confidentiality? (Choose three.)

Accepted Answer

Transport Layer Security (TLS). TLS (B) is correct because it provides confidentiality for data in transit by encrypting the session between client and server using negotiated symmetric ciphers (e.g., AES) after an asymmetric handshake. Symmetric encryption (C) is correct because it uses a shared secret key with algorithms such as AES to encrypt data at rest or in transit, directly providing confidentiality. Asymmetric encryption (E) is correct because it uses public/private key pairs (e.g., RSA, ECC) to encrypt data so that only the holder of the corresponding private key can decrypt it, protecting confidentiality. Digital signature (A) is not correct because it provides integrity, authentication, and non-repudiation, not confidentiality. Hashing (D) is not correct because it is a one-way function used for integrity verification and cannot encrypt or conceal data.

Answer

Digital signature

Answer

Hashing

Question 6

In Security Onion, an analyst runs 'squert' and sees a high number of alerts from a single source IP across multiple destination ports. What is the most likely cause?

Accepted Answer

Port scan. Squert is a web interface for Sguil in Security Onion that visualizes alert data from the intrusion detection system (IDS). A high number of alerts from a single source IP targeting multiple destination ports is a classic signature of a port scan, where the attacker probes a range of ports on one or more targets to discover open services. The IDS triggers multiple alerts because each probe (e.g., SYN packets to different ports) matches a detection rule, such as those for TCP SYN scans.

Answer

Denial of service

Answer

SQL injection

Answer

Phishing attack

Question 7

A company is deploying a new web application and wants to ensure it is secure against common web attacks. Which of the following is the most effective approach to validate the security of the application before going live?

Accepted Answer

Conduct a penetration test by an external firm. A penetration test by an external firm is the most effective approach because it simulates a real-world attack, combining automated tools and manual exploitation techniques to identify vulnerabilities that automated scanners or static analysis might miss. Unlike a vulnerability scanner, a penetration test actively attempts to bypass security controls, test business logic flaws, and chain multiple low-risk issues into a critical exploit, providing a holistic validation of the application's security posture before going live.

Answer

Run a vulnerability scanner against the application

Answer

Implement a web application firewall (WAF)

Answer

Perform a code review with static analysis tools

Question 8

A security analyst is reviewing baseline network traffic and notices that the normal HTTP traffic volume has increased by 300% over the past hour. The increase is from a single client IP to a single external web server. What does this indicate?

Accepted Answer

Possible data exfiltration via HTTP. A 300% increase in HTTP traffic from a single client IP to a single external web server is anomalous and strongly suggests data exfiltration. Attackers often use HTTP (port 80) to tunnel stolen data out of a network because it is typically allowed through firewalls and proxies without inspection. The fact that the traffic is from one IP to one server indicates a targeted, non-distributed activity, which aligns with exfiltration rather than a volumetric attack.

Answer

A denial-of-service (DoS) attack against the web server

Answer

A distributed denial-of-service (DDoS) attack from botnets

Answer

Normal fluctuations during peak hours

Question 9

During a security monitoring review, an analyst notices an unusual amount of traffic on port 445. Which protocol is most likely associated with this port?

Accepted Answer

SMB. Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

Answer

HTTPS

Answer

DNS

Answer

HTTP

Question 10

A Windows Event Log shows Event ID 4625 multiple times from the same source IP address. What type of activity does this indicate?

Accepted Answer

Failed logon attempts indicating a possible brute-force attack. Event ID 4625 indicates a failed logon attempt. Multiple failures from the same source suggest a brute-force attack.

Answer

Successful logon after multiple attempts

Answer

Credential validation by a domain controller

Answer

A user account was created

Question 11

A SOC Tier 3 analyst is performing threat hunting. Which activity best describes the primary focus of a Tier 3 analyst?

Accepted Answer

Proactively searching for advanced threats. A Tier 3 analyst is the most senior level in a SOC, responsible for proactive threat hunting—actively searching for advanced threats that evade existing detection tools. Unlike Tier 1 and Tier 2, which focus on alert triage and correlation, Tier 3 uses hypothesis-driven investigations, threat intelligence, and advanced analytics to uncover stealthy adversaries. This aligns with the primary focus of a Tier 3 analyst as defined in the 200-201 exam objectives.

Answer

Monitoring incoming alerts for potential incidents

Answer

Correlating alerts from multiple sources

Answer

Creating user accounts and permissions

Question 12

During a security audit, an analyst finds that a third-party vendor has access to sensitive customer data beyond what is necessary for their services. Which principle of least privilege should the policy enforce?

Accepted Answer

Enforce a data classification and access control policy. The principle of least privilege requires that users and third parties have only the minimum access necessary to perform their function. Enforcing a data classification and access control policy ensures sensitive customer data is categorized and that vendor access is restricted based on that classification, directly addressing excessive access.

Answer

Implement an incident response plan for data leaks

Answer

Update the end-user license agreement

Answer

Invoke a service-level agreement

Question 13

A Linux server has been compromised. The analyst checks for persistence mechanisms. Which THREE of the following are common Linux persistence techniques that should be examined? (Select THREE)

Accepted Answer

Creating a systemd service unit. Creating a systemd service unit is a common Linux persistence technique because systemd is the default init system for most modern Linux distributions. An attacker can place a malicious service file (e.g., /etc/systemd/system/evil.service) that automatically starts the malware at boot or after a crash, ensuring continued access even after a reboot.

Answer

Changing the system timezone

Answer

Modifying the /etc/hosts file

Question 14

An organization must retain security logs for at least one year due to regulatory compliance. However, their SIEM storage is limited. Which strategy best balances compliance and storage?

Accepted Answer

Archive logs to compressed files after 30 days and retain for one year.. Archiving logs to compressed files after 30 days and retaining them for one year balances compliance (one-year retention) with limited SIEM storage. This approach moves older logs to cheaper, compressed storage while keeping them accessible for audits. It reduces the active SIEM storage footprint without violating the retention requirement.

Answer

Delete logs after 30 days and rely on local log rotation.

Answer

Only store alerts and drop raw logs.

Answer

Increase SIEM storage without archiving.

Question 15

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Accepted Answer

Slow network performance and service unavailability. A DDoS attack floods the target with traffic from multiple sources, overwhelming network resources and causing legitimate requests to time out or be dropped. This results in slow network performance and service unavailability as the system struggles to process the excessive load. The distributed nature of the attack makes it difficult to mitigate with simple IP-based filtering.

Answer

A single IP address generating excessive traffic

Answer

Encrypted traffic from a known malware C2 server