200-201 Practice Test 32 — 15 Questions

Question 1

A Security Operations Center (SOC) uses Security Information and Event Management (SIEM) with event correlation. Analysts notice that alerts for a specific malware signature have decreased sharply after a new firewall rule was deployed. However, endpoint scans still show infections on several hosts. What is the most likely explanation for the decrease in SIEM alerts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall rule blocks the malware's C2 traffic, so SIEM no longer receives network alerts, but endpoint infections persist. The firewall rule specifically blocks command-and-control (C2) traffic, which is the network communication channel the malware uses to send data or receive instructions. Since the SIEM relies on network-based alerts (e.g., from intrusion detection systems or firewall logs) to detect this traffic, blocking the C2 traffic eliminates those network alerts. However, the malware remains on the endpoints because the firewall does not remove the infection; it only prevents outbound communication, so endpoint scans still detect the malware files or processes.

Answer

The SIEM correlation rules were accidentally disabled during the firewall update

Answer

The SIEM is not receiving logs from the endpoint detection and response (EDR) tool

Answer

The malware has mutated into a different variant that evades detection

Question 2

Your organization recently deployed a new web application that uses HTTPS. The security team notices that the IDS is generating a large number of alerts for 'SSL/TLS handshake anomalies' and 'self-signed certificates'. After investigating, you find that many of these alerts are coming from a legitimate internal scanning tool that uses a self-signed certificate. The IDS also reports a high rate of 'TLS renegotiation' attempts from the same source. The CISO wants to reduce false positives while maintaining visibility. The IDS is based on Suricata and uses a default rule set. What is the best course of action?

Accepted Answer

Create a custom Suricata pass rule that excludes traffic from the specific IP address of the scanning tool.. Creating a custom Suricata pass rule for the specific IP address of the legitimate scanning tool will suppress alerts for that known source while maintaining full visibility into all other traffic. This approach reduces false positives without disabling broader security monitoring, as the IDS continues to inspect and alert on SSL/TLS anomalies and self-signed certificates from all other hosts.

Answer

Add a whitelist rule that ignores any traffic from any host using self-signed certificates.

Answer

Disable the Suricata rules that match self-signed certificates and TLS renegotiation.

Answer

Recommend removing the scanning tool from the network and using a different tool that uses a trusted certificate.

Question 3

Based on the exhibit, what condition triggers an alert?

Accepted Answer

More than 1000 DNS queries from a single source within 60 seconds.. The exhibit shows a rule configured to trigger an alert when the number of DNS queries from a single source IP exceeds 1000 within a 60-second sliding window. This is a rate-based threshold designed to detect DNS amplification or tunneling attacks, where a single host generates an abnormally high volume of DNS requests. Option A correctly describes this condition.

Answer

A single DNS query to a known malicious domain.

Answer

Any UDP traffic to port 53 exceeding 1000 packets per second.

Answer

More than 1000 UDP connections to port 53 within 60 seconds.

Question 4

An analyst is investigating a potential data exfiltration. The logs show a series of DNS queries with subdomains that appear to be base64-encoded strings. Which technique is likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (e.g., exfiltrated files) into subdomains of DNS queries, which are then sent to a malicious authoritative DNS server controlled by the attacker. The base64-encoded subdomains in the logs are a classic indicator of this technique, as the attacker uses the DNS protocol to bypass network security controls and covertly transmit data.

Answer

DNS amplification

Answer

Fast flux

Answer

Domain generation algorithm

Question 5

You are monitoring network traffic and notice a sudden spike in outbound UDP traffic from a single internal host to various external IPs on port 123 (NTP). The traffic pattern shows a high volume of small packets. The host in question is a Linux server that does not run any NTP services. The IDS does not generate any alerts for this traffic. Which type of attack is most likely occurring?

Accepted Answer

The host is participating in an NTP amplification DDoS attack.. The sudden spike in outbound UDP traffic from a single internal host to multiple external IPs on port 123 (NTP) with small packets indicates the host is being used as a reflector in an NTP amplification DDoS attack. The attacker spoofs the victim's IP address and sends small queries to open NTP servers, which respond with large replies directed at the victim, but in this scenario the internal host is the one sending the queries (likely due to malware or misconfiguration), making it the amplifier. The lack of IDS alerts suggests the traffic matches normal NTP patterns, but the volume and destination diversity confirm the attack.

Answer

The host is scanning for open NTP servers.

Answer

Data exfiltration via NTP tunneling.

Answer

The host is performing an NTP time synchronization query.

Question 6

An organization uses Cisco AMP for Endpoints. A file with a low prevalence score is executed on multiple endpoints, and AMP identifies it as malicious after behavioral analysis. The analyst needs to ensure that all endpoints are protected from this file. Which action should be taken?

Accepted Answer

Create a custom IOC for the file hash and apply it to an outbreak policy.. Creating a custom IOC for the file hash and applying it to an outbreak policy is correct because Cisco AMP for Endpoints uses outbreak policies to rapidly deploy protections across all endpoints. Once behavioral analysis identifies the file as malicious, the IOC (based on the file's SHA-256 hash) can be pushed via an outbreak policy to block execution, quarantine, or remediate the file on every endpoint, regardless of prior prevalence. This ensures immediate, global protection without waiting for cloud signature updates.

Answer

Isolate all endpoints that executed the file.

Answer

Disable cloud connectivity for AMP to prevent recurrence.

Answer

Run a scan on each endpoint using the local AMP engine.

Question 7

Drag and drop the steps for the DHCP DORA process (dynamic host configuration) into the correct order.

Accepted Answer

Step 1: Discover, Step 2: Offer, Step 3: Request, Step 4: Acknowledge. The DHCP DORA process stands for Discover, Offer, Request, Acknowledge. It begins with the client broadcasting a Discover message to find DHCP servers. Servers respond with an Offer of an available IP address. The client then sends a Request to accept one of the offers. Finally, the server sends an Acknowledge to confirm the lease, completing the process. This sequence ensures proper assignment of IP addresses and avoids conflicts.

Answer

Step 1: Discover, Step 2: Request, Step 3: Offer, Step 4: Acknowledge

Answer

Step 1: Offer, Step 2: Discover, Step 3: Request, Step 4: Acknowledge

Answer

Step 1: Discover, Step 2: Offer, Step 3: Acknowledge, Step 4: Request

Question 8

A company uses a SIEM that collects logs from firewalls, servers, and endpoints. The SIEM is generating a high volume of low-priority events, causing analysts to miss critical alerts. Which approach would best improve the signal-to-noise ratio?

Accepted Answer

Implement event filtering and correlation rules to reduce false positives.. The SIEM's high volume of low-priority events indicates a poor signal-to-noise ratio, where benign or irrelevant events drown out critical alerts. Implementing event filtering and correlation rules directly reduces false positives by discarding known noise (e.g., repeated benign scans) and grouping related events into meaningful alerts, allowing analysts to focus on genuine threats. This is the standard approach in SIEM tuning to improve detection fidelity without adding resources or data.

Answer

Deploy additional sensors to collect more data.

Answer

Hire more analysts to review all events.

Answer

Increase the storage capacity of the SIEM.

Question 9

An analyst reviews Snort alert logs and sees many alerts for 'SQL Injection Attempt' from a single external IP to a public-facing web server. Which analysis step is most effective?

Accepted Answer

Check the web server logs for the same IP. Checking the web server logs for the same IP is the most effective step because it allows the analyst to correlate the Snort alerts with actual HTTP requests. This confirms whether the SQL injection attempts were successful or merely reconnaissance, and provides context such as the specific URI, parameters, and response codes (e.g., 200 vs 500) needed to assess impact.

Answer

Block the IP at the firewall immediately

Answer

Run a port scan against the IP

Answer

Disable the SQL injection signature

Question 10

A security analyst is reviewing logs from a web proxy and sees that a user's machine is making frequent connections to a domain that is registered recently and has a low reputation score. What is the best action?

Accepted Answer

Check if the user has a legitimate need to access the domain.. The best action is to check if the user has a legitimate need to access the domain because a recently registered domain with a low reputation score is a strong indicator of potential malicious activity, but it could also be a false positive or a legitimate new service. Security analysts must validate the context through user inquiry or additional log correlation before taking irreversible actions like blocking or disabling access. This aligns with the principle of least disruption and evidence-based decision-making in security monitoring.

Answer

Disable the user's network access.

Answer

Block the domain immediately.

Answer

Ignore because it might be a false positive.

Question 11

Which of the following is a common indicator of a brute-force attack on an SSH server?

Accepted Answer

Repeated login attempts with different usernames and passwords in a short period.. A brute-force attack on an SSH server is characterized by a high volume of authentication attempts, typically using different usernames and passwords, in a short time window. This pattern aims to guess valid credentials through repeated trial and error, which is distinct from a single failure or a few successful logins. The rapid, automated nature of the attempts is the key indicator that distinguishes brute-force activity from normal user behavior.

Answer

A single failed login attempt.

Answer

Multiple successful logins from the same user.

Answer

High CPU usage on the server.

Question 12

An organization is implementing monitoring for encrypted traffic without decrypting it. Which approach would be most effective for detecting malicious activity?

Accepted Answer

Use NetFlow analysis to identify unusual connection patterns. NetFlow analysis examines metadata (source/destination IPs, ports, protocols, byte counts) without decrypting the payload. Unusual patterns like beaconing to a known C2 server, data exfiltration via non-standard ports, or unexpected volumetric flows can indicate malicious activity even when the traffic is encrypted. This approach preserves privacy and compliance while still enabling threat detection through behavioral anomalies.

Answer

Deploy SSL/TLS inspection to decrypt traffic

Answer

Monitor SNMP traffic from endpoints

Answer

Block all encrypted traffic except from known good sources

Question 13

A security policy requires multifactor authentication for all administrative access. Which TWO of the following are examples of factors used in MFA? (Choose two.)

Accepted Answer

Fingerprint. Fingerprint (Option C) is a correct example of a multifactor authentication factor because it falls under the 'something you are' category, which relies on biometric characteristics. In MFA, at least two different categories must be used (e.g., knowledge, possession, inherence). A fingerprint is an inherence factor, making it a valid component of MFA.

Answer

MAC address

Answer

Password

Answer

Username

Question 14

A company uses Cisco Stealthwatch to monitor network traffic. Which type of data does Stealthwatch primarily rely on for visibility?

Accepted Answer

NetFlow data. Cisco Stealthwatch is designed for network traffic analysis and relies on NetFlow data (including IPFIX and other flow protocols) to provide visibility into network behavior, traffic patterns, and anomalies. Unlike full packet captures, NetFlow metadata (source/destination IP, ports, protocols, byte counts) is lightweight and scalable for monitoring large networks, making it the primary data source for Stealthwatch's behavioral analytics and threat detection.

Answer

SNMP traps

Answer

Full packet captures

Answer

Syslog messages

Question 15

An analyst is reviewing Sysmon logs from a compromised host. They see Event ID 1 (Process creation) for cmd.exe with parent process winword.exe. What does this indicate?

Accepted Answer

A macro in a Word document executed cmd.exe as part of the attack. Event ID 1 (Process creation) with parent process winword.exe spawning cmd.exe is a classic indicator of a macro-based attack. Microsoft Word is not designed to launch command-line interpreters under normal operation; when cmd.exe appears as a child of winword.exe, it strongly suggests that a malicious macro within the document executed a shell command, often to download payloads, escalate privileges, or perform reconnaissance. This aligns with common phishing and malware delivery techniques where attackers embed VBA macros to execute system commands.

Answer

The Windows Update service initiated cmd from Word

Answer

The user launched cmd.exe manually from within Word using a shortcut

Answer

Word crashed and created a dump file using cmd