200-201 Practice Test 33 — 15 Questions

Question 1

A security analyst receives an alert that an employee's workstation is generating outbound traffic to a known malware command-and-control IP address at 3:00 AM. According to the company's incident response policy, what is the FIRST action the analyst should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the workstation from the network by disabling the switch port.. The first action is to isolate the workstation from the network by disabling the switch port. This immediately stops the outbound command-and-control (C2) traffic, preventing data exfiltration and further compromise, while preserving the system state for forensic analysis. According to the incident response policy, containment takes precedence over eradication or recovery to limit damage.

Answer

Reimage the workstation immediately to remove the malware.

Answer

Apply the latest security patches to the workstation.

Answer

Call the employee to ask if they are working late.

Question 2

A user reports that they cannot access a file server. The security policy requires that all access be logged and monitored. What is the most likely reason for the access failure?

Accepted Answer

The user's IP address is not in the allowed list. The security policy requiring all access to be logged and monitored strongly implies that access controls are enforced at the network level, such as through an IP-based allow list (e.g., a firewall ACL or host-based security group). If the user's IP address is not in the allowed list, the connection will be dropped or rejected before any authentication or file-sharing protocol (like SMB or NFS) can proceed, resulting in an access failure. This is the most likely cause because it directly aligns with the policy's enforcement mechanism, whereas account lockouts or password expiry would still generate authentication attempts that could be logged.

Answer

The user's account is locked

Answer

The file server is down

Answer

The user's password has expired

Question 3

Which THREE of the following are common elements of an incident response policy?

Accepted Answer

Procedures for containment and eradication. Containment and eradication are core phases of the NIST SP 800-61 incident response lifecycle. Containment limits the scope of the incident (e.g., isolating a compromised host via VLAN access control lists), while eradication removes the root cause (e.g., deleting malware, patching vulnerabilities). These procedures are explicitly documented in an incident response policy to ensure consistent, repeatable actions during a security event.

Answer

Data classification levels

Answer

Acceptable use of company resources

Question 4

Drag and drop the steps to implement a disaster recovery plan for a critical server into the correct order.

Accepted Answer

Step 1: Identify critical assets and risks, Step 2: Backup data and configurations, Step 3: Test recovery procedures, Step 4: Document the plan, Step 5: Execute recovery when needed. The correct sequence for implementing a disaster recovery plan is Identify, Backup, Test, Document, Execute. This ensures you know what to protect, create usable backups, validate recovery procedures, maintain a clear plan, and act effectively during a disaster.

Answer

Step 1: Backup data and configurations, Step 2: Identify critical assets and risks, Step 3: Test recovery procedures, Step 4: Document the plan, Step 5: Execute recovery when needed

Answer

Step 1: Identify critical assets and risks, Step 2: Backup data and configurations, Step 3: Document the plan, Step 4: Test recovery procedures, Step 5: Execute recovery when needed

Answer

Step 1: Identify critical assets and risks, Step 2: Test recovery procedures, Step 3: Backup data and configurations, Step 4: Document the plan, Step 5: Execute recovery when needed

Question 5

Based on the exhibit, what action should the analyst take to further investigate this alert?

Accepted Answer

Extract the URL from the alert and check the file hash.. The analyst should extract the URL from the alert and check the file hash because the alert indicates a potential malware download via HTTP. By retrieving the file referenced in the URL, the analyst can compute its hash (e.g., MD5, SHA256) and compare it against known threat intelligence databases (e.g., VirusTotal) to confirm maliciousness and identify the specific malware family. This directly validates whether the detected event is a true positive and provides actionable indicators for containment.

Answer

Search the PCAP for the same signature ID.

Answer

Perform a DNS lookup on the destination IP.

Answer

Check the firewall logs for any blocked connections.

Question 6

A security analyst notices that a workstation is generating multiple DNS queries to a known malicious domain. Which host-based analysis technique would be most effective in confirming the infection?

Accepted Answer

Use Process Explorer to examine the process responsible for the DNS queries. Process Explorer is a host-based analysis tool that provides detailed information about running processes, including their network connections and DNS queries. By examining the process responsible for the DNS queries to the known malicious domain, the analyst can directly identify the infected executable or script, confirming the infection at the process level.

Answer

Review the Windows Firewall logs to see blocked connections

Answer

Check the scheduled tasks for suspicious entries

Answer

Analyze the Windows Event Log for Event ID 5156

Question 7

Which TWO of the following are symmetric encryption algorithms? (Choose two.)

Accepted Answer

AES. AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning it uses the same key for both encryption and decryption. It is widely adopted due to its strong security and efficiency, with key sizes of 128, 192, or 256 bits. 3DES (Triple Data Encryption Standard) is also symmetric, applying the DES cipher three times to each data block, effectively increasing key length and security over single DES.

Answer

RSA

Answer

Diffie-Hellman

Answer

ECC

Question 8

Drag and drop the steps to analyze a packet capture for suspicious activity into the correct order.

Accepted Answer

Open the packet capture, then Filter the traffic, then Examine the packets, then Correlate findings, then Document results.. The correct sequence for packet capture analysis starts by opening the capture file, then applying filters to isolate relevant traffic, examining the filtered packets for anomalies, correlating findings across different packets or sessions, and finally documenting the analysis results for reporting and future reference. This order ensures efficiency and accuracy.

Answer

Open the packet capture, then Examine the packets, then Filter the traffic, then Correlate findings, then Document results.

Answer

Open the packet capture, then Filter the traffic, then Document results, then Examine the packets, then Correlate findings.

Answer

Document results, then Correlate findings, then Examine the packets, then Filter the traffic, then Open the packet capture.

Question 9

Which TWO are common indicators of a compromised host? (Choose two.)

Accepted Answer

Unusual spikes in outbound network traffic at odd hours.. Unusual spikes in outbound network traffic at odd hours (Option C) are a common indicator of a compromised host because they often signal data exfiltration, command-and-control (C2) beaconing, or botnet activity. Attackers frequently schedule malicious traffic during off-peak hours to evade detection, and the abnormal volume or timing relative to baseline behavior is a key anomaly in security monitoring.

Answer

User logging in during business hours.

Answer

Scheduled tasks running at regular intervals.

Answer

Antivirus updates occurring daily.

Question 10

Refer to the exhibit. A security analyst views these log entries from a Cisco router. What conclusion can be drawn about ACL 101?

Accepted Answer

ACL 101 denies Telnet and permits HTTP. ACL 101 contains an explicit deny statement for TCP port 23 (Telnet) followed by a permit statement for TCP port 80 (HTTP). Since ACLs process rules sequentially, Telnet traffic is denied and HTTP traffic is permitted. This matches option C exactly.

Answer

ACL 101 blocks HTTP traffic

Answer

ACL 101 applies only to inbound traffic

Answer

ACL 101 permits all traffic

Question 11

You are a SOC analyst for a financial services firm. The firm uses a combination of Cisco Firepower IPS, Windows Event Log collection, and a custom SIEM. At 10:00 AM, the SIEM generates an alert: 'Event ID 4625: Multiple failed logins for user 'jdoe' from IP 10.0.0.100'. The alert fires 10 times within 5 minutes. The source IP is a file server. You check the file server's logs and see that it is running a scheduled script that attempts to map a network drive using jdoe's credentials. The script is legitimate and has been running for months. However, the script's credentials may have expired or changed. The user jdoe is currently on leave. The file server administrator confirms that the script is part of a backup process. What is the best course of action?

Accepted Answer

Update the script with correct credentials and clear the alert. The alert is a false positive triggered by a legitimate scheduled script that has been running for months. The root cause is expired or changed credentials for user 'jdoe'. Updating the script with the correct credentials resolves the issue without disrupting operations. Clearing the alert removes the noise from the SIEM, allowing the SOC to focus on genuine threats.

Answer

Escalate the alert to the incident response team for investigation

Answer

Disable user jdoe's account immediately to prevent further attempts

Answer

Block the file server's IP address in the firewall

Question 12

Which three types of data are commonly collected and analyzed for network intrusion detection? (Choose three.)

Accepted Answer

Syslog messages. Syslog messages are a standard protocol (RFC 5424) used to forward log messages from network devices, servers, and applications to a central logging server. In intrusion detection, syslog data provides critical event information such as authentication failures, interface status changes, and security policy violations, which analysts correlate with other data sources to identify malicious activity.

Answer

Windows event logs

Answer

DNS query logs

Question 13

During a PCAP analysis, an analyst sees an ICMP echo reply packet that is larger than usual (2000 bytes). What is this likely indicating?

Accepted Answer

Ping of death attempt. A standard ICMP echo reply packet has a payload of 56 bytes (or 64 bytes including the ICMP header) for a total IP packet size of 84 bytes. A 2000-byte ICMP echo reply exceeds the maximum allowed size for an ICMP packet (65535 bytes for IPv4, but typical implementations limit the data portion to much smaller values). This oversized packet is characteristic of a Ping of Death attack, where the attacker sends a malformed ICMP packet that, when reassembled, causes a buffer overflow on the target system, leading to a crash or denial of service.

Answer

ICMP flood

Answer

Fragmented packet

Answer

Smurf attack

Question 14

A security policy requires that all changes to firewall rules be approved by two administrators. This is an example of which security principle?

Accepted Answer

Separation of duties. The requirement that two administrators must approve firewall rule changes enforces separation of duties, a security principle that prevents any single individual from having exclusive control over a critical operation. This reduces the risk of unauthorized or malicious rule modifications by ensuring collusion or independent review is required. In firewall management, this is often implemented via change management workflows with distinct approval and implementation roles.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege

Question 15

A company's security policy states that all remote access must be through a VPN. An employee complains that the VPN is too slow and asks for an exception to access a specific internal server directly over the internet. What should the security analyst recommend?

Accepted Answer

Investigate the VPN performance issue and optimize if possible.. The security policy mandates VPN for all remote access, and bypassing it would violate the principle of least privilege and expose the internal server directly to the internet. The analyst should first investigate the VPN performance issue—common causes include MTU mismatch, high latency, or encryption overhead—and optimize it (e.g., adjusting MTU, using split tunneling, or upgrading hardware) rather than granting an exception that undermines security.

Answer

Configure a separate VPN profile with lower encryption.

Answer

Allow direct access but only from the employee's home IP.

Answer

Grant the exception temporarily and monitor the connection.