200-201 Practice Test 34 — 15 Questions

Question 1

A security analyst is configuring a new SIEM platform. The organization has multiple log sources, including Windows Event Logs, Linux syslog, and firewall logs. The analyst wants to ensure that logs are not lost if the SIEM becomes unavailable. Which approach best addresses this requirement?

Accepted Answer

Configure log sources to send logs to a centralized collector with local storage and forwarding capabilities.. Option B is correct because deploying a centralized collector with local storage and forwarding capabilities creates a buffer that ensures logs are not lost during SIEM unavailability. The collector receives logs from sources, stores them locally (e.g., on disk or in a queue), and forwards them to the SIEM when it becomes available again. This decouples log generation from SIEM ingestion, preventing data loss even during extended outages.

Answer

Configure the SIEM to pull logs from sources via Syslog over TCP.

Answer

Implement log replication between SIEM nodes.

Answer

Increase the storage capacity of the SIEM to hold more logs.

Question 2

An organization uses Cisco Stealthwatch for network traffic analysis. The analyst observes a sudden increase in traffic from a workstation to multiple external IPs on port 443. The traffic pattern shows consistent packet sizes of 1500 bytes, and the destination IPs are spread across different geographic regions. Which type of activity is most likely indicated?

Accepted Answer

Data exfiltration via HTTPS.. The consistent 1500-byte packet size indicates maximum-sized TCP segments, which is atypical for interactive web browsing but common when data is being padded to fill MTU for efficient exfiltration. Cisco Stealthwatch detects this anomalous volumetric pattern to external IPs on HTTPS (port 443) as a sign of data exfiltration, where an internal host sends large, uniform chunks of data to multiple external destinations to evade detection.

Answer

VoIP call initiation.

Answer

Normal web browsing activity.

Answer

A DDoS attack originating from the workstation.

Question 3

Your organization uses a SIEM solution (Cisco Secure Network Analytics and Cisco Secure Cloud Analytics) for monitoring. You are the lead analyst and receive multiple alerts: (1) A host on the internal network is making thousands of outbound connections to a known malicious IP on port 80 in a short time. (2) At the same time, there is a spike in DNS queries from the same host to a domain that is registered very recently. (3) The firewall logs show that the host is communicating with internal servers on high ports (e.g., 4444, 5555). The host is a Windows 10 workstation used by the finance department. The user reports it has been slow recently. You have access to Cisco AMP for Endpoints, Cisco Firepower NGFW, and Cisco Stealthwatch. The environment has 500 endpoints, and the network uses 802.1X authentication. What should be your first course of action?

Accepted Answer

Isolate the host from the network immediately and begin investigation.. Option D is correct because the combination of outbound connections to a known malicious IP, recent domain DNS queries, and internal C2-like traffic on high ports (4444, 5555) indicates a confirmed compromise. Immediate isolation via 802.1X or switch ACL stops lateral movement and data exfiltration while preserving forensic evidence. Cisco AMP for Endpoints can then be used to analyze the host offline without risking further spread.

Answer

Check the current baseline for the host to confirm it is anomalous.

Answer

Block the malicious IP at the firewall and continue monitoring.

Answer

Update the antivirus signatures on the host and run a full scan.

Question 4

An incident response plan specifies that containment must be completed before eradication. A security analyst identifies a malware infection on a critical server. What should be done first?

Accepted Answer

Disconnect the server from the network. According to the incident response plan, containment must be completed before eradication. Disconnecting the server from the network (Option A) is the immediate containment action that prevents the malware from spreading laterally to other hosts, preserving the integrity of the network and allowing for forensic analysis. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized to limit damage before any eradication or recovery steps are taken.

Answer

Run antivirus scans

Answer

Notify law enforcement

Answer

Reinstall the operating system

Question 5

Refer to the exhibit. A security policy requires that network traffic be classified and prioritized to ensure critical applications get bandwidth. A network engineer implements this QoS policy. However, after deployment, a security scanner reports that SSH traffic is starved. Which of the following is the most likely cause?

Accepted Answer

SSH traffic is not classified and falls into class-default, which may not get enough bandwidth.. Option D is correct because SSH traffic is not explicitly matched by any class map in the policy, so it falls into the class-default. The class-default in this policy uses fair-queue, which does not guarantee a minimum bandwidth; if higher-priority classes (like VOIP and critical data) consume most of the link, class-default can be starved. This results in SSH sessions timing out or experiencing severe packet loss.

Answer

The priority percent for VOIP is too high.

Answer

The fair-queue algorithm does not work with this policy.

Answer

The critical data class includes SSH traffic.

Question 6

A company uses Snort for intrusion detection. The analyst receives an alert for 'ET POLICY Outgoing DNS Query to Possible Malicious Domain'. The destination IP is 203.0.113.5. The analyst checks the DNS query and finds it is for 'update.software.com', which is a legitimate update server. However, the Snort rule triggered because the domain was recently added to a threat intelligence feed. What is the most likely cause of this false positive?

Accepted Answer

The threat intelligence feed contains a false positive for that domain. The Snort rule triggered because the domain 'update.software.com' was listed in a threat intelligence feed, but the analyst verified it is a legitimate update server. This indicates the threat intelligence feed itself incorrectly flagged the domain as malicious, making it a false positive in the feed. Option D is correct because the root cause is the feed's inaccuracy, not a misconfiguration or overly broad rule.

Answer

The Snort rule is misconfigured and should be disabled

Answer

The rule is too broad and matches all DNS queries

Answer

The Snort signature is too generic and should be tuned

Question 7

A Security Operations Center (SOC) uses Security Information and Event Management (SIEM) with event correlation. Analysts notice that alerts for a specific malware signature have decreased sharply after a new firewall rule was deployed. However, endpoint scans still show infections on several hosts. What is the most likely explanation for the decrease in SIEM alerts?

Accepted Answer

The firewall rule blocks the malware's C2 traffic, so SIEM no longer receives network alerts, but endpoint infections persist. The firewall rule specifically blocks command-and-control (C2) traffic, which is the network communication channel the malware uses to send data or receive instructions. Since the SIEM relies on network-based alerts (e.g., from intrusion detection systems or firewall logs) to detect this traffic, blocking the C2 traffic eliminates those network alerts. However, the malware remains on the endpoints because the firewall does not remove the infection; it only prevents outbound communication, so endpoint scans still detect the malware files or processes.

Answer

The SIEM correlation rules were accidentally disabled during the firewall update

Answer

The SIEM is not receiving logs from the endpoint detection and response (EDR) tool

Answer

The malware has mutated into a different variant that evades detection

Question 8

A critical security patch for a widely exploited vulnerability is released. The patch requires a system reboot during business hours. According to change management policy, what is the best procedure?

Accepted Answer

Submit an emergency change request for immediate approval. Option C is correct because when a critical security patch addresses a widely exploited vulnerability, the immediate risk to the organization outweighs standard change windows. Change management policy typically includes an emergency change process that bypasses normal scheduling to allow rapid deployment with expedited approval, even if a reboot during business hours is required. This aligns with the principle of prioritizing security over availability in high-severity scenarios.

Answer

Deploy the patch only at the end of the business day

Answer

Wait for the next scheduled change window

Answer

Install the patch without approval

Question 9

An organization uses both network-based intrusion detection (NIDS) and host-based intrusion detection (HIDS). A HIDS alert reports that a critical server's registry key was modified. The NIDS shows no corresponding network activity. The change occurred during a scheduled maintenance window. What is the best course of action for the analyst?

Accepted Answer

Check the change management system to see if the modification was authorized. Option B is correct because the registry modification occurred during a scheduled maintenance window, which is a legitimate time for authorized changes. The analyst should first verify the change management system to confirm whether the modification was planned and approved, as this aligns with standard change control processes. The absence of NIDS alerts further suggests the change was likely local and non-malicious, but confirmation via change management is essential before taking any action.

Answer

Ignore the alert because it occurred during maintenance

Answer

Escalate the alert as a potential security incident

Answer

Immediately revert the registry change

Question 10

A company has implemented a role-based access control (RBAC) policy for its network devices. A network engineer needs temporary access to configure a router in a different region. According to the RBAC policy, what is the appropriate procedure?

Accepted Answer

Submit a request to the security team for temporary role elevation with a specified time limit. Option D is correct because RBAC policies require that any deviation from assigned roles, such as temporary access to a router in a different region, must be handled through a formal privilege elevation process. This typically involves submitting a request to the security team, who can grant temporary role elevation with a specified time limit, ensuring that access is auditable, time-bound, and revoked automatically. This aligns with the principle of least privilege and maintains the integrity of the RBAC model by avoiding permanent or shared credentials.

Answer

Have the root password shared via encrypted email to the engineer

Answer

Use the shared admin account for the duration of the task

Answer

Ask another engineer with access to perform the configuration changes

Question 11

A company's remote access policy requires VPN connections to use two-factor authentication (2FA). An employee reports they cannot connect because their token is not syncing. What is the best course of action?

Accepted Answer

Provide a new token and synchronize it correctly. Option D is correct because the core issue is a synchronization problem between the employee's token and the authentication server. Two-factor authentication (2FA) relies on time-based one-time passwords (TOTP) or event-based (HOTP) algorithms; if the token's clock drifts or the counter becomes out of sync, authentication fails. Providing a new token and correctly synchronizing it (e.g., via NTP time alignment or reseeding the HMAC-based OTP counter) restores secure access without bypassing the security policy.

Answer

Disable 2FA for the employee

Answer

Replace the token and allow access anyway

Answer

Temporarily allow connections without 2FA

Question 12

During a security audit, it is discovered that several users have passwords set to never expire. According to the security policy, passwords must be changed every 90 days. What is the best course of action?

Accepted Answer

Update the password policy in Active Directory to enforce 90-day expiration. Option D is correct because the most efficient and enforceable way to ensure all users comply with the 90-day password expiration policy is to configure a Group Policy Object (GPO) in Active Directory that sets the 'Maximum password age' to 90 days. This automatically forces password changes at login after the expiration period, ensuring uniform enforcement without manual intervention or disruption.

Answer

Disable accounts that violate the policy

Answer

Notify users to change their passwords voluntarily

Answer

Immediately reset all user passwords

Question 13

Refer to the exhibit. This syslog message is generated from a Cisco firewall. According to the security policy, all traffic from the 10.10.10.0/24 network to the internal 192.168.1.0/24 network must be denied except for HTTP traffic from specific IPs. Which of the following should be investigated?

Accepted Answer

The source IP 10.10.10.5 should be allowed to pass HTTP traffic.. The syslog message shows that a packet from 10.10.10.5 to 192.168.1.10 on port 80 (HTTP) was permitted. According to the security policy, HTTP traffic from specific IPs is allowed, so 10.10.10.5 should be one of those permitted sources. The correct answer is D because the log indicates the traffic was allowed, which aligns with the policy exception, and no compromise or misconfiguration is evident.

Answer

The packet was permitted but logged.

Answer

The packet was denied because it was HTTP traffic from 10.10.10.5.

Answer

The destination IP 192.168.1.10 is compromised.

Question 14

Which TWO components are essential in a well-written security policy?

Accepted Answer

Scope. A security policy must define its scope to specify which systems, users, and data are covered. Without a clear scope, the policy cannot be consistently applied, leading to gaps in enforcement. The scope ensures that all relevant assets are protected and that the policy's boundaries are understood by all stakeholders.

Answer

Cost estimates

Answer

Technology stack

Answer

Vendor names

Question 15

Refer to the exhibit. An ASA security policy is configured as shown. A user from the internet tries to access 192.168.1.5 via HTTP. What will happen?

Accepted Answer

Traffic will be denied. The ASA security policy shown uses an access control list (ACL) that implicitly denies all traffic unless explicitly permitted. Since the exhibit does not show any ACL entry permitting HTTP traffic from the internet to 192.168.1.5, the traffic is denied by default. The correct answer is B because the ASA's default behavior for inbound traffic on an interface is to deny it unless a matching permit ACE exists.

Answer

Traffic will be allowed, but logged

Answer

Traffic will be allowed only if it matches the subnet

Answer

Traffic will be permitted