200-201 Practice Test 33 — 15 Questions

Question 1

A firewall log shows repeated denied packets from IP 10.0.0.5 to destination 192.168.1.10 on port 22. What is the most likely attack?

Accepted Answer

SSH brute force. Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Answer

HTTP flood

Answer

SMB exploit

Answer

DNS amplification

Question 2

A company's security policy states that employees must not use corporate laptops for personal web browsing. An employee is found to have streamed video during work hours, consuming significant bandwidth. What is the best course of action?

Accepted Answer

Report the violation to HR for disciplinary action per the existing policy. When a security policy already exists and an employee is found to have violated it, the correct action is to follow the established disciplinary process — typically reporting the violation to HR so the organisation's policy is enforced consistently. This preserves due process, creates an auditable record, and avoids ad-hoc decisions by the security team. Terminating immediately or ignoring the violation both undermine the policy's authority.

Answer

Give a verbal warning and take no further action

Answer

Update the policy to allow streaming under certain conditions

Answer

Immediately terminate the employee

Question 3

An analyst needs to review the Windows event logs from a host to determine if a user's account was used to log in at an unusual time. Which log type should the analyst check?

Accepted Answer

Security. The Security log in Windows Event Viewer records audit events, including successful and failed logon attempts (Event ID 4624 for successful logons). This log type is the correct source for determining if a user's account was used to log in at an unusual time, as it captures the timestamp and details of each authentication event.

Answer

Application

Answer

System

Answer

Setup

Question 4

Which log source would provide the most detailed information about HTTP requests, including URLs and user agents?

Accepted Answer

Web server logs. Web server logs capture HTTP requests with details like URL, method, response code, and user-agent. They are the best source for HTTP traffic details.

Answer

DNS logs

Answer

Firewall logs

Answer

System logs

Question 5

A host is infected with malware that uses DNS tunneling to exfiltrate data. Which type of analysis would best detect this activity?

Accepted Answer

DNS log analysis. DNS tunneling encodes exfiltrated data within DNS queries or responses, often using TXT or A record types to bypass network security controls. DNS log analysis is the most direct detection method because it reveals anomalous patterns such as unusually long domain names, excessive NXDOMAIN responses, or high volumes of DNS traffic to a single external server, which are hallmarks of tunneling activity.

Answer

Windows event log analysis

Answer

Firewall log analysis

Answer

NetFlow analysis

Question 6

A network baseline shows that a server typically sends 1-2 MB of data per hour to external IPs. Suddenly, the server sends 50 MB of data to an IP in a foreign country within 10 minutes. The traffic is encrypted. Which monitoring tool would best confirm data exfiltration?

Accepted Answer

NetFlow/IPFIX analysis comparing current traffic to baseline. NetFlow/IPFIX provides flow records with byte counts, enabling detection of unusual data volumes, even with encrypted payloads.

Answer

Snort IDS with a rule to detect large file transfers

Answer

Wireshark packet capture with a display filter for the destination IP

Answer

Windows Event Logs for file access

Question 7

During an investigation, an analyst finds that an internal host has been communicating with a known malicious IP on port 445. Which protocol is most likely involved?

Accepted Answer

SMB. Port 445 is the default port for Microsoft SMB (Server Message Block) over TCP, used for file sharing, printer sharing, and other network services. Communication with a known malicious IP on this port strongly indicates SMB-based activity, such as exploitation of vulnerabilities like EternalBlue (MS17-010) or unauthorized file access.

Answer

SSH

Answer

RDP

Answer

HTTP

Question 8

A security analyst reviews the firewall log. What is the most likely reason for the denied connection?

Accepted Answer

The access control list does not permit the traffic. The firewall log shows a denied connection, and the most likely reason is that the access control list (ACL) does not permit the traffic. Firewalls enforce security policies by evaluating traffic against ACL rules; if no rule explicitly allows the packet (based on source/destination IP, port, and protocol), the implicit deny at the end of the ACL drops the connection. This is the default behavior for stateful firewalls and is the most common cause of denied connections in logs.

Answer

The destination port is blocked by default

Answer

The source IP address is an external threat

Answer

The destination IP is a known malicious host

Question 9

A SOC analyst examines an alert generated by an IDS. The alert indicates a potential SQL injection attempt. However, the analyst finds that the source IP is a known internal web server that performs legitimate database queries. What is the most likely explanation?

Accepted Answer

The traffic is legitimate but the IDS has a false positive. The source IP is a known internal web server that performs legitimate database queries. IDS signatures often trigger on SQL-like patterns in traffic, and when the traffic matches the signature but is actually benign (e.g., a web server sending parameterized queries), it constitutes a false positive. The analyst's verification that the source is a trusted internal server performing expected operations confirms the alert is not a true threat.

Answer

The web server is compromised

Answer

The IDS is misconfigured

Answer

The analyst should ignore the alert

Question 10

An organization wants to ensure the integrity of software updates downloaded from its vendor's website. The vendor provides a hash value for each update. Which TWO properties of hashing algorithms make them suitable for integrity verification? (Choose two.)

Accepted Answer

The same input always produces the same hash.. Option A is correct because hashing is deterministic: for a given algorithm, the same input always produces the same hash value, so a recipient can recompute the hash of a downloaded update and compare it to the vendor-published hash to verify integrity. Option B is correct because of the avalanche effect, where even a one-bit change in the input produces a drastically different hash, making any tampering with the update immediately detectable. Option C is incorrect because hashing is a one-way function and cannot be reversed to recover the original data. Option D is incorrect because, while true for a given algorithm, fixed output length is not the property that enables integrity verification of the update content. Option E is incorrect because hashing does not require a secret key; keyed constructions like HMAC use a key, but plain hashing algorithms do not.

Answer

The hash can be reversed to obtain the original data.

Answer

The hash output is always the same length for a given algorithm.

Answer

Hashing requires a secret key to generate the hash.

Question 11

Which THREE indicators are commonly found in network traffic that suggest a host is part of a botnet? (Choose three.)

Accepted Answer

Connections to known IRC servers on non-standard ports. Option A is correct because botnets historically use IRC command-and-control (C2) channels, often on non-standard ports like 6667 or 31337 to evade basic filtering, so connections to known IRC servers on such ports are a classic botnet indicator. Option C is correct because bots periodically beacon to C2 infrastructure, and repeated connections to IP addresses with poor reputation (e.g., known malicious hosts, low-reputation ASNs) strongly suggest compromised hosts checking in. Option D is correct because botnets frequently conduct distributed activities such as spam, DDoS, or scanning, producing high volumes of outbound traffic to many destinations, which is anomalous for a normal host. Option B is not a typical botnet indicator because large file downloads from external servers more often indicate legitimate patching, software distribution, or user activity rather than bot behavior. Option E is not a botnet indicator because frequent DNS queries to legitimate corporate DNS servers are normal in enterprise environments and do not by themselves suggest compromise.

Answer

Large file downloads from external servers

Answer

Frequent DNS queries to legitimate corporate DNS servers

Question 12

A company is implementing a new data classification policy. The policy defines three levels: Public, Internal, and Confidential. An employee accidentally emails a spreadsheet marked 'Confidential' to an external partner. The email system automatically encrypts all outbound emails containing 'Confidential' classification. Which security control is being demonstrated?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the control that inspects outbound content for sensitive data classifications and takes action such as encryption or blocking. The email system automatically encrypting outbound emails containing 'Confidential' classification is a classic DLP policy enforcement action based on content inspection.

Answer

Auditing

Answer

Encryption at rest

Answer

Access control

Question 13

An analyst is investigating a potential data exfiltration. The logs show a series of DNS queries with subdomains that appear to be base64-encoded strings. Which technique is likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (e.g., exfiltrated files) into subdomains of DNS queries, which are then sent to a malicious authoritative DNS server controlled by the attacker. The base64-encoded subdomains in the logs are a classic indicator of this technique, as the attacker uses the DNS protocol to bypass network security controls and covertly transmit data.

Answer

DNS amplification

Answer

Fast flux

Answer

Domain generation algorithm

Question 14

During an incident, a forensic analyst needs to preserve evidence from a compromised hard drive. Which of the following steps is essential to maintain the chain of custody?

Accepted Answer

Documenting the date, time, and person handling the evidence. Chain of custody requires documenting each transfer, including who handled evidence and when. Write-blocking prevents alteration, and hashing verifies integrity. Documentation of transfers is key.

Answer

Deleting unnecessary files to reduce data volume

Answer

Storing the hard drive in a standard office drawer

Answer

Creating a bit-for-bit copy without write-blocking

Question 15

A Windows analyst uses Process Explorer to investigate parent-child relationships. Which TWO characteristics are commonly associated with malicious processes?

Accepted Answer

A process running from a user's Temp folder with a random name. Option B is correct because malware frequently drops and executes its payload from user-writable directories such as %TEMP% (e.g., C:\Users\<user>\AppData\Local\Temp) using randomized file names to evade signature-based detection and blend into transient files. Option E is correct because a document reader like winword.exe spawning a command interpreter such as cmd.exe (or powershell.exe) is a classic indicator of a malicious macro or exploit performing code execution, since legitimate Word usage does not normally launch shells. Option A is not suspicious by itself, as validly signed parent processes are typical of legitimate software and signatures indicate trustworthiness rather than malice. Option C describes benign behavior, since long uptime with low CPU is normal for many background services. Option D is also not inherently malicious, because svchost.exe spawning explorer.exe can occur in legitimate scenarios and is not a standard malware parent-child pattern.

Answer

A parent process with a valid digital signature

Answer

A process with a long uptime and low CPU usage

Answer

A process chain where the parent is svchost.exe and child is explorer.exe