200-201 Practice Test 34 — 15 Questions

Question 1

Which Windows Prefetch file extension indicates that a program has been executed on the system?

Accepted Answer

.pf. Prefetch files with the .pf extension are created by Windows when a program is executed, storing metadata about the executable's loading and execution. The presence of a .pf file in C:\Windows\Prefetch is a strong indicator that the program ran on the system. This makes .pf the correct extension for indicating program execution.

Answer

.evtx

Answer

.tmp

Answer

.log

Question 2

During memory analysis using Volatility, an analyst wants to identify processes that may be hiding. Which TWO plugins are most useful for detecting hidden or injected code? (Choose two.)

Accepted Answer

malfind. Option A, malfind, is correct because it scans process memory for regions with suspicious characteristics typical of injected or hidden code, such as pages marked PAGE_EXECUTE_READWRITE (RWX) or memory that is not backed by a file on disk, which is a strong indicator of code injection or process hollowing. Option D, psxview, is correct because it cross-references multiple process-listing sources (e.g., pslist, psscan, thrdscan, csrss handles, session processes) and highlights discrepancies where a process appears in some listings but not others, which is a classic sign of a hidden process. Option B, pslist, is not correct here because it simply walks the active process linked list and will not reveal processes that have been unlinked to hide themselves. Option C, dlllist, is not correct because it enumerates loaded DLLs for a given process and does not by itself detect hidden processes or injected code. Option E, cmdline, is not correct because it only retrieves process command-line arguments and provides no mechanism for detecting hidden or injected code.

Answer

pslist

Answer

dlllist

Answer

cmdline

Question 3

An attacker intercepts communication between two parties and modifies the data before forwarding it. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Answer

DNS poisoning

Answer

Replay attack

Answer

ARP spoofing

Question 4

An attacker intercepts communication between a client and server and modifies the data being transmitted. The client and server are unaware of the modification. Which type of attack is being performed?

Accepted Answer

Man-in-the-Middle. A Man-in-the-Middle (MITM) attack occurs when an attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. In this scenario, the attacker intercepts and modifies the data in transit, and neither the client nor the server detects the modification, which is the hallmark of a MITM attack. MITM is a broad category that encompasses various techniques, including ARP spoofing and DNS poisoning, but the core definition is the active interception and modification of traffic.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 5

GreenTech Inc. is a mid-sized company with 500 employees. The company uses Microsoft Exchange Online for email and has implemented a security policy that requires all employees to report suspicious emails to the security team. The security team uses a phishing simulation tool to train employees. In the past month, several employees have reported receiving emails that appear to be from the CEO requesting urgent wire transfers. The security team has blocked the sender domains and updated the email filters. However, one employee fell for the latest scam and transferred $50,000 to an account before reporting it. The security incident response plan states that any monetary loss must be reported to the board within 24 hours. The security analyst receives the report on Monday morning. What should the analyst do first based on the policy and best practices?

Accepted Answer

Immediately contact the bank to attempt to reverse the wire transfer. The immediate priority in a wire-transfer fraud incident is to attempt to recover the funds by contacting the bank as soon as possible — the faster the bank is notified, the higher the chance of reversing or freezing the transfer. Best practices for BEC (Business Email Compromise) incidents place financial recovery first, before forensic investigation or internal notifications, because the 24-hour board notification window is still available while the wire recall window may be minutes to hours.

Answer

Disable email access for all employees to prevent further attacks

Answer

Launch a full forensic investigation to identify the source

Answer

Notify the board within the 24-hour window as per policy

Question 6

According to the principles of least privilege, which THREE of the following access controls should be implemented for a typical user account? (Choose three.)

Accepted Answer

Ability to change their own password. Option B is correct because allowing users to change their own password supports least privilege by letting them maintain the confidentiality of their own credential without granting broader account-management rights. Option D is correct because write access to their own home directory gives users the minimum file access needed to do their work while keeping other users' data and system files protected. Option E is correct because read access to a shared company calendar is a limited, role-appropriate permission that provides necessary scheduling information without granting modification or administrative control. Options A and C are not appropriate under least privilege: administrative rights to the local machine and the ability to install software both grant elevated privileges that typical users do not need and that increase the risk of malware execution or system compromise.

Answer

Administrative rights to the local machine

Answer

Ability to install software

Question 7

Which THREE types of network traffic anomalies are strong indicators of a data exfiltration attempt?

Accepted Answer

TCP connections with unusual port numbers (e.g., using SSH on port 80). Option A is correct because tunneling protocols over unexpected ports—such as SSH on TCP 80 or other non-standard port mappings—are a classic exfiltration technique that evades port-based firewall rules and blends with allowed traffic. Option B is correct because DNS exfiltration encodes stolen data in long or high-entropy subdomain labels (e.g., base32/base64 chunks) sent to an attacker-controlled authoritative name server, which is a well-known covert channel. Option E is correct because a large outbound volume to one external destination during off-hours deviates from normal baseline behavior and matches the bulk-transfer pattern of data exfiltration. Option C is not a strong exfiltration indicator; frequent ARP requests typically point to Layer 2 issues such as ARP scanning, misconfiguration, or ARP spoofing on the local segment. Option D is not a strong exfiltration indicator either; many SYNs without ACKs indicate SYN scanning or a SYN flood denial-of-service, not outbound data theft.

Answer

Frequent ARP requests from a single host

Answer

High number of SYN packets without corresponding ACKs

Question 8

Which THREE of the following are valid techniques to detect a compromised host using network monitoring?

Accepted Answer

Identifying periodic outbound connections to an unknown IP at regular intervals (beaconing).. Beaconing is a classic indicator of a compromised host establishing a command-and-control (C2) channel. The host periodically sends outbound connections to an unknown IP at regular intervals, which is a behavior that network monitoring tools can detect as anomalous traffic patterns, often used by malware to maintain persistence and receive instructions.

Answer

Watching for ICMP echo requests from internal hosts to external hosts.

Answer

Monitoring for high volumes of HTTP traffic to a known CDN.

Question 9

Refer to the exhibit. What does this syslog message indicate?

Accepted Answer

Denied SSH connection attempt. The syslog message '%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22]' indicates a failed login attempt on port 22, which is the default port for SSH. Since the message explicitly shows 'localport: 22' and the login failed, it corresponds to a denied SSH connection attempt, not a successful one or a Telnet attempt (which uses port 23).

Answer

Failed telnet attempt

Answer

Successful SSH connection

Answer

Allowed TCP traffic

Question 10

An analyst reviews IDS alerts and sees multiple alerts for the same signature from different internal IPs targeting the same external server. One common cause is...

Accepted Answer

A worm spreading internally. A worm spreading internally (option C) is the most likely cause because worms self-replicate and propagate across a network, generating identical IDS alerts from multiple internal IPs as each infected host attempts to connect to the same external server (e.g., for command-and-control or payload delivery). This pattern—same signature, multiple internal sources, single external target—is a classic indicator of worm activity, where the worm's propagation logic causes each compromised host to initiate similar outbound connections.

Answer

A false positive

Answer

A DDoS attack

Answer

A misconfigured server

Question 11

An IDS generates an alert for a signature that matches HTTP traffic containing 'cmd.exe' in the URI. The analyst checks the packet and sees the URI is actually 'cmd.exe?help'. What should the analyst do?

Accepted Answer

Tune the signature to reduce false positives. The IDS signature triggered on the presence of 'cmd.exe' in the URI, but the actual traffic was 'cmd.exe?help', which is a legitimate help request and not an exploitation attempt. Tuning the signature to account for the query string reduces false positives without losing detection capability for actual attacks. This aligns with best practices for IDS management, where signatures are adjusted to match real threat patterns rather than exact strings.

Answer

Block the source IP

Answer

Disable the signature

Answer

Escalate to incident response

Question 12

Refer to the exhibit. A security analyst reviews the ACL configuration applied outbound on the external interface. Which statement is true about traffic from the 192.168.1.0/24 network to the internet?

Accepted Answer

HTTP and HTTPS traffic from the internal network is allowed, but SSH is denied.. The ACL contains permit statements for HTTP (port 80) and HTTPS (port 443) from the 192.168.1.0/24 network. It also includes an explicit deny statement for SSH (port 22) and a final permit ip any any statement (line 40). As a result, HTTP and HTTPS traffic are allowed, SSH traffic is denied, and all other traffic is permitted. Therefore, option C is correct.

Answer

All outbound traffic is denied except HTTP and HTTPS.

Answer

Only HTTP and HTTPS traffic is allowed.

Answer

SSH traffic is only denied if it originates from the 192.168.1.0/24 network.

Question 13

Which organization facilitates threat intelligence sharing among members in a specific sector, such as finance or healthcare?

Accepted Answer

ISAC. ISACs (Information Sharing and Analysis Centers) are sector-specific organizations that facilitate threat intelligence sharing among members in industries such as finance (FS-ISAC), healthcare (H-ISAC), and aviation. They provide a trusted forum for members to exchange threat data, best practices, and incident information relevant to their sector.

Answer

MISP

Answer

STIX

Answer

TAXII

Question 14

Which TWO of the following are characteristics of an advanced persistent threat (APT)?

Accepted Answer

Operates with low and slow tactics to avoid detection. An advanced persistent threat (APT) is characterized by its use of low-and-slow tactics to evade detection over long periods. This involves spreading malicious activity across many small, seemingly benign actions to avoid triggering threshold-based alerts in security monitoring systems. APTs are also defined by their targeted nature, focusing on specific organizations for espionage or data theft rather than opportunistic, broad-scale attacks.

Answer

Is typically financially motivated

Answer

Uses only commodity malware

Answer

Attacks are short-lived and quickly detected

Question 15

An analyst observes an alert triggered by a single SYN packet to a closed port. The packet did not complete a TCP handshake. What type of attack does this most likely indicate?

Accepted Answer

SYN scan. A single SYN packet to a closed port that does not complete the TCP handshake is the signature of a SYN scan (half-open scan). The scanner sends SYN; if the port is closed, the target responds with RST, and the scanner never sends ACK. This is the classic behavior of tools like Nmap's -sS scan.

Answer

TCP connect scan

Answer

Ping sweep

Answer

UDP scan