200-201 Practice Test 34 — 15 Questions

Question 1

Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)

Accepted Answer

Regularly tune correlation rules based on feedback.. SIEM correlation rules must be regularly tuned based on feedback from incident investigations and alert reviews. This iterative process adjusts thresholds, filters, and logic to match the actual threat landscape, reducing noise from benign events that match rule patterns but are not malicious.

Answer

Disable all alerts that generate more than 100 events per day.

Answer

Use a separate SIEM for each department.

Answer

Increase the number of log sources.

Question 2

An analyst notices repeated failed SSH attempts from an external IP to a server. The analyst wants to quickly see all SSH-related events from that IP in the last hour. Which approach is most efficient?

Accepted Answer

Search the SIEM for events with destination port 22 and source IP.. A SIEM indexes and correlates log data from multiple sources, allowing an analyst to quickly filter events by destination port 22 (SSH) and source IP without manually sifting through raw logs. This approach leverages the SIEM's search capabilities to retrieve only relevant events from the past hour, making it the most efficient method for targeted threat hunting.

Answer

Review all firewall logs for the past hour.

Answer

Run a packet capture on the server's network interface.

Answer

Check the server's auth.log file manually.

Question 3

A manufacturing company's ICS network was infected with ransomware that encrypted files on the file server. The company has offline backups and restores the files. However, during the investigation, the security analyst finds that the ransomware entered through an RDP connection from an infected workstation on the corporate network. The corporate network and ICS network are separated by a firewall that allows RDP from specific corporate IPs to the ICS file server. The analyst wants to prevent a recurrence. Which of the following is the most effective long-term control?

Accepted Answer

Require multi-factor authentication for all RDP connections.. Requiring multi-factor authentication for all RDP connections adds a critical layer of security, making it much harder for attackers to gain access even if credentials are compromised.

Answer

Disable RDP on the ICS file server and use a jump box.

Answer

Implement network segmentation with a DMZ for file transfers.

Answer

Install antivirus on all corporate workstations.

Question 4

Which TWO are common sources of security event data in a Security Information and Event Management (SIEM) system?

Accepted Answer

NetFlow records. NetFlow records (B) are a common source of security event data in a SIEM because they provide detailed metadata about network flows, including source/destination IPs, ports, protocols, and byte counts. SIEMs ingest NetFlow to detect anomalies, such as data exfiltration or beaconing, by analyzing flow patterns rather than full packet payloads. This makes NetFlow a standard telemetry source for network visibility and threat hunting.

Answer

SMTP logs

Answer

SNMP traps

Answer

DNS queries

Question 5

A SIEM correlation rule triggers when a user account is created and then added to a privileged group within 10 minutes. Which activity does this rule detect?

Accepted Answer

Privileged account creation and elevation.. The SIEM rule specifically correlates the creation of a user account followed by its addition to a privileged group within a short time window. This sequence directly maps to the definition of privileged account creation and elevation, where a new account is granted administrative rights. The rule does not require any other malicious activity like data theft or lateral movement to trigger.

Answer

Malicious insider data theft.

Answer

Privilege escalation via token manipulation.

Answer

Lateral movement using pass-the-hash.

Question 6

Which TWO of the following are common network security protocols? (Choose two.)

Accepted Answer

IPsec. IPsec is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet in a data stream. It operates at the network layer (Layer 3) and is commonly used in VPNs to provide confidentiality, integrity, and authentication. This makes it a fundamental network security protocol.

Answer

FTP

Answer

HTTP

Answer

SNMP

Question 7

A company wants to protect its internal network from external threats. Which security principle involves deploying multiple layers of security controls?

Accepted Answer

Defense in depth. Defense in depth (option B) is the correct answer because it describes the strategy of layering independent security controls—such as firewalls, intrusion prevention systems (IPS), endpoint protection, and access controls—so that if one layer fails, another can still block or mitigate an attack. This principle ensures that no single point of failure can compromise the entire network, which is essential for protecting internal assets from external threats.

Answer

Least privilege

Answer

Risk management

Answer

Separation of duties

Question 8

Which THREE are examples of social engineering attacks? (Select three.)

Accepted Answer

Smishing. Smishing is a form of social engineering attack that uses SMS (Short Message Service) text messages to trick recipients into revealing sensitive information or clicking malicious links. Unlike technical attacks that exploit system vulnerabilities, smishing relies on psychological manipulation, making it a classic social engineering vector.

Answer

Man-in-the-middle

Answer

SQL injection

Question 9

An organization has implemented a security policy requiring all employees to change their passwords every 90 days. Which security goal does this policy primarily support?

Accepted Answer

Confidentiality. Requiring password changes every 90 days primarily supports confidentiality by reducing the window of opportunity for an attacker to use a compromised credential. If a password is stolen or guessed, the mandatory rotation ensures that the stolen credential becomes invalid after 90 days, limiting unauthorized access to sensitive data. This directly aligns with the confidentiality goal of preventing disclosure to unauthorized parties.

Answer

Accountability

Answer

Availability

Answer

Integrity

Question 10

Which THREE are principles of the CIA triad? (Select three.)

Accepted Answer

Confidentiality. The CIA triad is the foundational security model consisting of Confidentiality, Integrity, and Availability. Option B (Confidentiality) is correct because it ensures that data is accessible only to authorized users, typically enforced through encryption (e.g., AES-256) and access control lists (ACLs).

Answer

Non-repudiation

Answer

Accountability

Question 11

A SOC analyst is reviewing a firewall log and sees a large number of outbound connections from an internal server to a known command-and-control (C2) domain. The connections are on port 443, and the packets have irregular timing. What should the analyst do first?

Accepted Answer

Isolate the server from the network and escalate to incident response.. The irregular timing and outbound connections to a known C2 domain on port 443 strongly indicate a compromised host using HTTPS to blend in with normal traffic. Isolating the server first prevents further data exfiltration or lateral movement while preserving forensic evidence, which aligns with the NIST incident response framework. Escalating to incident response ensures proper handling and analysis.

Answer

Check the server's logs for signs of compromise.

Answer

Ignore the alert because port 443 is normal traffic.

Answer

Block the domain at the firewall immediately.

Question 12

Refer to the exhibit. What does this log entry indicate?

Accepted Answer

A permitted ICMP packet. The log entry shows an ICMP packet with a permit action, as indicated by the 'permit' keyword and the protocol number 1 (ICMP). The source and destination IP addresses, along with the ICMP type and code, confirm it is an ICMP echo request (type 8, code 0). Therefore, this is a permitted ICMP packet.

Answer

A denied TCP packet

Answer

A permitted UDP packet

Answer

A denied ICMP packet

Question 13

A small retail company uses a cloud-based point-of-sale (POS) system. The IT manager receives an alert from the cloud provider that the POS application is generating an unusually high number of outbound connections to an IP address in a foreign country. The POS application is only supposed to communicate with the cloud provider's servers in the United States. The IT manager checks the POS terminal logs and finds that a new user account was created locally on the terminal with administrative privileges two days ago. The terminal does not have antivirus installed. What should the IT manager do first to contain the incident and prevent data loss?

Accepted Answer

Disconnect the POS terminal from the network immediately.. Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.

Answer

Reset the password for the new user account and disable it.

Answer

Install antivirus software on the terminal and run a full scan.

Answer

Contact the cloud provider to block the outbound IP address.

Question 14

Which of the following is a primary goal of the CIA triad?

Accepted Answer

Availability. The CIA triad's primary goals are confidentiality, integrity, and availability. Availability ensures that authorized users have reliable and timely access to data and resources when needed, which is a core security objective. Option C is correct because availability is explicitly one of the three pillars of the CIA triad.

Answer

Redundancy

Answer

Scalability

Answer

Maintainability

Question 15

Match each security tool to its primary purpose.

Accepted Answer

SIEM: Provides centralized log management and correlation for threat detection.. These are common security tools used in operations. SIEM centralizes logs, IDS/IPS monitors traffic, firewall filters, and antivirus protects endpoints.

Answer

SIEM: Monitors network traffic for malicious activity and can block/prevent intrusions.

Answer

Firewall: Provides centralized log management and correlation for threat detection.