200-201 Practice Test 33 — 15 Questions

Question 1

A security analyst is investigating an alert from a host-based intrusion detection system (HIDS) that detected a file modification in the system32 directory. Which log source should the analyst check first to understand the process that made the change?

Accepted Answer

Windows Event Logs.. Windows Event Logs (specifically Security Event ID 4656 or 4663) record detailed information about file operations, including the process that initiated the modification. Since the HIDS detected a file change in system32, the Event Logs provide the process name, user account, and timestamp needed to trace the source of the modification.

Answer

Firewall logs.

Answer

NetFlow data.

Answer

DNS logs.

Question 2

A SOC team is implementing a security monitoring solution for a cloud-based infrastructure. Which of the following is the most important consideration for effective monitoring?

Accepted Answer

Centralized logging from all cloud services and on-premises.. Centralized logging is the most important consideration because it provides a single, unified view of security events across all cloud services and on-premises infrastructure. Without aggregation, the SOC cannot correlate events, detect distributed attacks, or perform effective threat hunting. This aligns with the principle of 'visibility first' in security monitoring.

Answer

Encrypting all logs at rest.

Answer

Reducing log retention to save cost.

Answer

Using only native cloud monitoring tools.

Question 3

Which TWO of the following are best practices when configuring a SIEM correlation rule to detect lateral movement?

Accepted Answer

Include a time window to limit the correlation to a few minutes between events.. Option A is correct because including a time window (e.g., 5 minutes) in a SIEM correlation rule ensures that only events occurring within a short, defined interval are correlated. This is critical for detecting lateral movement, where an attacker must quickly pivot from one host to another; without a time window, the rule would match events that are too far apart in time, generating excessive false positives. The time window aligns with the typical speed of automated tools like PsExec or RDP brute-force scripts, which execute logons in rapid succession.

Answer

Exclude the source IP address from the correlation to focus on user identity.

Answer

Use only a single log source, such as domain controller logs, to simplify the rule.

Answer

Set the rule to trigger on any Event ID 4624 (successful logon) regardless of type.

Question 4

Refer to the exhibit. What type of activity does this log represent?

Accepted Answer

Brute force SSH attack.. The log shows repeated SSH connection attempts with 'Failed password' messages from the same source IP (10.10.0.5) to the same destination IP (10.10.0.3) for user 'admin'. This pattern of multiple failed authentication attempts in a short time window is characteristic of a brute force SSH attack, where an attacker systematically tries different passwords to gain unauthorized access.

Answer

Man-in-the-middle attack.

Answer

Denial-of-service (DoS) attack.

Answer

Port scan.

Question 5

Which TWO of the following are common sources of security events used in security monitoring?

Accepted Answer

Firewall logs. Firewall logs (B) are a primary source of security events because they record allowed and denied traffic based on access control lists (ACLs), providing critical data on attempted intrusions, policy violations, and reconnaissance scans. DNS query logs (E) are equally vital as they capture domain resolution requests, enabling detection of malware command-and-control (C2) communication, DNS tunneling, and connections to known malicious domains. Both are standard inputs for SIEM systems and security monitoring platforms.

Answer

Employee attendance records

Answer

Marketing campaign results

Answer

Company newsletter subscriptions

Question 6

Which THREE of the following are indicators that a network may be compromised by a botnet?

Accepted Answer

Unusual outbound traffic to known command-and-control servers.. Option A is correct because botnet-infected systems typically communicate with command-and-control (C2) servers to receive instructions or exfiltrate data. Unusual outbound traffic to known C2 IPs or domains is a strong indicator of botnet activity, as legitimate traffic rarely targets these addresses. Security monitoring tools often use threat intelligence feeds to flag such connections.

Answer

High volume of ICMP echo requests.

Answer

Increase in legitimate business traffic.

Question 7

Which TWO of the following are best practices for configuring syslog in a secure monitoring environment? (Choose two.)

Accepted Answer

Configure a maximum log file size to prevent disk exhaustion. Configuring a maximum log file size prevents syslog messages from filling up the disk, which could cause the system to crash or become unresponsive. This is a critical best practice in secure monitoring to ensure logging continues without exhausting storage resources.

Answer

Use UDP as the transport protocol to ensure reliable delivery

Answer

Set log files to overwrite daily

Answer

Change the default syslog port to avoid detection by attackers

Question 8

An analyst is monitoring network traffic and sees a sudden spike in outbound data transfer from an internal server to an external IP that is known to be malicious. What is the most likely scenario?

Accepted Answer

Data exfiltration.. A sudden spike in outbound data transfer from an internal server to a known malicious external IP is a classic indicator of data exfiltration. Attackers often use compromised servers to siphon sensitive data (e.g., credentials, databases) to a command-and-control (C2) server. This behavior aligns with the post-compromise phase of an attack, where the goal is to extract data without triggering immediate alarms.

Answer

Software update.

Answer

User downloading a large file.

Answer

Normal backup operation.

Question 9

During a security incident, a SOC analyst finds that the SIEM is not receiving logs from a critical firewall due to a network issue. The analyst needs to ensure that no alerts are missed during the outage. What should the analyst do?

Accepted Answer

Configure the firewall to queue logs locally and forward when connectivity is restored.. Option C is correct because configuring the firewall to queue logs locally ensures that log data generated during the network outage is stored in a local buffer (often using syslog buffering or a local log file) and automatically forwarded once connectivity to the SIEM is restored. This prevents any gap in security monitoring and ensures that all alerts are captured for analysis, even during transient network failures.

Answer

Restart the SIEM collector service.

Answer

Manually monitor the firewall console.

Answer

Ignore the gap because logs are not critical.

Question 10

A security analyst is reviewing logs from a web proxy and sees that a user's machine is making frequent connections to a domain that is registered recently and has a low reputation score. What is the best action?

Accepted Answer

Check if the user has a legitimate need to access the domain.. The best action is to check if the user has a legitimate need to access the domain because a recently registered domain with a low reputation score is a strong indicator of potential malicious activity, but it could also be a false positive or a legitimate new service. Security analysts must validate the context through user inquiry or additional log correlation before taking irreversible actions like blocking or disabling access. This aligns with the principle of least disruption and evidence-based decision-making in security monitoring.

Answer

Disable the user's network access.

Answer

Block the domain immediately.

Answer

Ignore because it might be a false positive.

Question 11

A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?

Accepted Answer

The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.. Option B is correct because the SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.

Answer

The SIEM is not receiving logs from the authentication server.

Answer

The analyst is monitoring the wrong log source.

Answer

The SIEM correlation rule requires a minimum of 15 failed attempts.

Question 12

A SOC analyst receives an alert from the SIEM indicating a high number of outbound DNS queries from an internal host to a domain known for malicious activity. The analyst reviews the logs and finds that the host is a DNS server. What should be the analyst's first action?

Accepted Answer

Isolate the DNS server from the network and escalate to incident response.. The correct first action is to isolate the DNS server from the network and escalate to incident response. A DNS server generating outbound DNS queries to a known malicious domain indicates a likely compromise (e.g., DNS tunneling or malware command-and-control), not normal recursive resolution. Immediate containment prevents further data exfiltration or lateral movement, aligning with incident response best practices.

Answer

Check the baseline of DNS traffic to confirm it is anomalous.

Answer

Block the domain at the firewall and close the alert.

Answer

Restart the DNS service on the server and monitor.

Question 13

A SOC analyst is reviewing a security alert generated by the SIEM. The alert indicates a successful login from an unusual geographic location for a user who typically logs in from the corporate office. The analyst verifies that the user is currently on vacation and should not be accessing the network. What should the analyst do next?

Accepted Answer

Disable the user account and begin an investigation. Option D is correct because the alert indicates a clear security incident: a successful login from an unusual geographic location for a user who is on vacation and should not be accessing the network. Disabling the user account immediately contains the threat by preventing further unauthorized access, and beginning an investigation allows the analyst to determine if the account was compromised or if credentials were stolen. This aligns with the NIST SP 800-61 incident response process, where containment is a priority before proceeding to eradication and recovery.

Answer

Ignore the alert because the user might be using a VPN

Answer

Block the IP address in the firewall

Answer

Start a full incident investigation before taking any action

Question 14

Which TWO of the following are valid sources of security monitoring data in a Cisco security architecture?

Accepted Answer

Syslog messages. Syslog messages (C) are a standard protocol for logging events from network devices, servers, and applications, making them a primary source of security monitoring data. NetFlow records (E) provide IP traffic flow statistics, enabling network behavior analysis and anomaly detection. Both are explicitly listed as valid data sources in Cisco's security monitoring architecture.

Answer

RADIUS accounting

Answer

SNMP traps

Answer

WMI queries

Question 15

During a security incident, a network engineer captures traffic with tcpdump and saves it to a pcap file. The analyst needs to extract all HTTP POST requests containing a specific string in the URI. Which command should be used?

Accepted Answer

tcpdump -r traffic.pcap 'tcp port 80' -A | grep 'POST' | grep 'string'. Option B is correct because it uses tcpdump with the `-r` flag to read the pcap file, filters for TCP port 80 (HTTP), uses `-A` to print packet payloads in ASCII, and then pipes the output through two grep commands: first to isolate lines containing 'POST' (indicating HTTP POST requests) and second to filter for the specific string in the URI. This combination efficiently extracts only the relevant HTTP POST requests with the target string from the captured traffic.

Answer

tcpdump -r traffic.pcap -X | grep 'string'

Answer

ngrep -q -W byline 'POST.*string' port 80

Answer

tcpdump -r traffic.pcap -nn 'host 10.0.0.1'