200-201 Practice Test 32 — 15 Questions

Question 1

A company's security policy requires that all remote access connections be authenticated using a certificate. Which type of control is this?

Accepted Answer

Preventive. Requiring a certificate for remote access authentication enforces a specific identity verification method before granting access. This is a preventive control because it stops unauthorized connections from being established by ensuring only devices with a valid certificate can initiate the session, directly blocking access before any data exchange occurs.

Answer

Corrective

Answer

Detective

Answer

Deterrent

Question 2

In Windows, prefetch files (C:\Windows\Prefetch\*.pf) are used by the system to speed up application loading. How can an analyst leverage prefetch files during host-based analysis?

Accepted Answer

They provide evidence of file execution, including frequency and timestamps.. Prefetch files in Windows record metadata about application launches, including the executable path, run count, and last run timestamp. During host-based analysis, an analyst can examine these .pf files to determine which executables have been executed, how often, and when, providing crucial evidence of file execution activity.

Answer

They store network connection logs.

Answer

They store registry keys modified by the application.

Answer

They contain the contents of the running process memory.

Question 3

An analyst reviewing network alerts notices a rule triggered for 'ET SCAN NMAP -sU scan' based on traffic to a Linux server. The packet capture shows multiple UDP packets to various ports, and for closed ports, the server responds with ICMP Destination Unreachable (Port Unreachable). Which type of scan is being performed, and how should the analyst classify this alert?

Accepted Answer

UDP scan; true positive. UDP scans send UDP packets; closed ports respond with ICMP Port Unreachable. This matches the alert signature, indicating a true positive for a UDP scan.

Answer

TCP SYN scan; true positive

Answer

UDP scan; false positive

Answer

TCP connect scan; true negative

Question 4

Which cryptographic method uses the same key for both encryption and decryption, and is typically faster than asymmetric encryption?

Accepted Answer

AES. Symmetric encryption uses a single shared key for both operations.

Answer

Digital signature

Answer

RSA

Answer

SHA-256

Question 5

A security team implements an IPS that uses behavioral profiling. Which type of detection method is being used?

Accepted Answer

Anomaly-based. Behavioral profiling establishes a baseline of normal network traffic patterns and then flags deviations from that baseline as potential threats. This is the core mechanism of anomaly-based detection, which identifies malicious activity by comparing observed behavior against a learned model of normal behavior rather than against predefined signatures or rules.

Answer

Heuristic

Answer

Signature-based

Answer

Rule-based

Question 6

A security policy requires that all data at rest be encrypted. Which TWO of the following are considered best practices for implementing encryption?

Accepted Answer

Store encryption keys separately from the encrypted data.. Option B is correct because storing encryption keys separately from the encrypted data is a fundamental key-management best practice: it ensures that if the data store is compromised, the attacker does not automatically obtain the keys needed to decrypt it, and it supports separation of duties and use of a dedicated KMS or HSM. Option D is correct because hardware-based encryption (for example, self-encrypting drives, TPMs, or HSMs) offloads cryptographic operations from the CPU, improving performance while providing tamper-resistant key storage and stronger protection of keys at rest. Option A is not a best practice because relying on application-layer encryption alone leaves data unprotected at other layers (disk, database, backup), so defense-in-depth is preferred. Option C is wrong because weak algorithms such as DES or RC4 undermine confidentiality and should never be chosen for performance reasons; strong algorithms like AES-256 are used instead. Option E is wrong because reusing a single key for all data creates a single point of failure and broadens the blast radius of any key compromise; per-data or per-tenant keys with proper rotation are preferred.

Answer

Implement encryption at the application layer only.

Answer

Use weak encryption algorithms to reduce performance impact.

Answer

Use the same key for all data to simplify management.

Question 7

A security analyst is reviewing firewall logs and notices a high number of denied outbound connections from an internal workstation to various external IP addresses on port 445 (SMB). What is the most likely explanation for this activity?

Accepted Answer

The workstation is infected with malware attempting to spread via SMB. Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

Answer

The user is browsing the web and the firewall is blocking HTTP

Answer

The workstation is performing a DNS lookup

Answer

The workstation is performing a legitimate file transfer using FTP

Question 8

In the context of risk management, which term describes the risk that remains after implementing security controls?

Accepted Answer

Residual risk. Residual risk is the risk left after controls are applied. It must be accepted or further treated.

Answer

Acceptable risk

Answer

Inherent risk

Answer

Transfer risk

Question 9

Which TWO types of network traffic should be analyzed to detect a data exfiltration attempt via HTTP? (Choose two.)

Accepted Answer

HTTP request headers. HTTP request headers (B) are correct because exfiltration over HTTP often hides data in custom, non-standard, or unusually long header fields (e.g., Cookie, User-Agent, Referer, X-* headers), and inspecting them reveals anomalous values, oversized fields, or encoded payloads that indicate data being smuggled out. HTTP request body (C) is correct because the body is the primary carrier for exfiltrated content in POST/PUT requests, so examining it for large volumes, base64/hex-encoded blobs, or sensitive data patterns is essential to detect the theft. ICMP echo requests (A) are not HTTP traffic and are typically used for reachability testing or covert channels via ping payloads, not HTTP exfiltration. DNS query responses (D) relate to DNS tunneling/exfiltration, a separate protocol channel, not HTTP. The TCP three-way handshake (E) only establishes the connection (SYN, SYN-ACK, ACK) and carries no application-layer payload, so it cannot reveal exfiltrated data.

Answer

ICMP echo requests

Answer

DNS query responses

Answer

TCP three-way handshake

Question 10

An analyst is analyzing a suspicious PE file. The file's entropy is high (close to 8.0), and the section names appear random. What does this likely indicate?

Accepted Answer

The file is likely packed or encrypted.. High entropy close to 8.0 indicates that the data is highly random, which is characteristic of packed or encrypted content. Malware authors use packers and crypters to compress and encrypt the executable, making static analysis difficult. Random section names further suggest that the PE file has been modified by a packer, as legitimate compilers typically produce meaningful section names like .text and .data.

Answer

The file is a script compiled to an executable.

Answer

The file is a legitimate Windows system file.

Answer

The file has been digitally signed.

Question 11

A security analyst is identifying potential vulnerabilities in the network. Which TWO of the following are examples of passive reconnaissance?

Accepted Answer

Google search for company information. Passive reconnaissance gathers information about a target without directly interacting with its systems, so Google searches for company information (B) qualify because they use public search engines and cached data to collect OSINT such as employee names, technologies, and domains without touching the target's infrastructure. WHOIS lookup (C) is also passive because it queries public registration databases to obtain domain ownership, registrar, and contact details without sending any traffic to the target's hosts. By contrast, a vulnerability scan (A) actively probes systems for weaknesses, a ping sweep (D) sends ICMP echo requests to discover live hosts, and port scanning (E) sends TCP/UDP probes to enumerate open ports — all of which are active reconnaissance techniques that directly interact with the target and can be logged or detected.

Answer

Vulnerability scan

Answer

Ping sweep

Answer

Port scanning

Question 12

Which principle ensures that a user cannot deny having performed an action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed an action, typically by using digital signatures or cryptographic mechanisms. In network security, this is often achieved through protocols like HMAC or digital certificates that bind an action to a specific identity, providing irrefutable proof. Without non-repudiation, a user could claim they never sent a message or executed a command, undermining audit trails and legal accountability.

Answer

Authentication

Answer

Accountability

Answer

Authorization

Question 13

In the NIST SP 800-61 Rev 2 incident response process, which phase involves documenting lessons learned and updating the incident response plan?

Accepted Answer

Post-Incident Activity. The Post-Incident Activity phase of NIST SP 800-61 Rev 2 is specifically designed for conducting a lessons learned meeting, documenting findings, and updating the incident response plan based on those insights. This phase ensures continuous improvement of the incident response process by capturing what worked, what didn't, and what changes are needed for future incidents.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Preparation

Question 14

Which TWO are examples of technical security controls? (Select two.)

Accepted Answer

Firewall. A firewall (A) is a technical security control because it is a hardware or software system that enforces network traffic filtering rules (e.g., ACLs, stateful inspection) to prevent unauthorized access, operating directly on the technology rather than on people or procedures. Encryption (E) is likewise a technical control since it uses cryptographic algorithms and keys (e.g., AES, TLS) to protect data confidentiality and integrity at rest or in transit. The unmarked options do not belong because a security policy (B) is an administrative/management control, while security awareness training (C) and background checks (D) are operational/personnel controls that address human behavior rather than technical mechanisms.

Answer

Security policy

Answer

Security awareness training

Answer

Background checks

Question 15

During a security audit, it is discovered that an organization’s network is vulnerable to ARP spoofing attacks. Which type of attack could result from exploiting this vulnerability?

Accepted Answer

Man-in-the-middle. ARP spoofing allows an attacker to send forged ARP replies that associate the attacker's MAC address with a legitimate IP (e.g., the default gateway), causing victims to send traffic to the attacker instead of the real destination. The attacker then relays traffic between the victim and the gateway, positioning themselves in the path — a classic man-in-the-middle (MITM) attack that enables eavesdropping, session hijacking, and credential theft.

Answer

DNS poisoning

Answer

Phishing

Answer

DoS