200-201 Practice Test 35 — 15 Questions

Question 1

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains a sense of urgency. Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

Answer

Pretexting

Answer

Vishing

Answer

Spear phishing

Question 2

A security analyst is reviewing logs and notices that an attacker has intercepted and modified communications between two devices without their knowledge. Which type of attack is this?

Accepted Answer

Man-in-the-middle (MitM). This scenario describes an attacker intercepting and modifying communications between two devices without their knowledge, which is the defining characteristic of a Man-in-the-Middle (MitM) attack. In a MitM attack, the attacker positions themselves between the two communicating parties, allowing them to eavesdrop, capture, and alter data in transit while both endpoints believe they are communicating directly with each other.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Denial of Service (DoS)

Question 3

Match each Linux command to its function.

Accepted Answer

ls: List directory contents. These commands are essential for Linux system administration and security analysis.

Answer

chmod: Display current running processes

Answer

ps: Change file permissions

Question 4

Refer to the exhibit. An analyst examines the port security status on a switch interface. What action should the analyst take to restore connectivity to the device connected to this port?

Accepted Answer

Shut down and re-enable the interface. When a port security violation occurs (e.g., a MAC address limit is exceeded or a sticky MAC changes), the switch can be configured to err-disable the interface. The standard remediation is to administratively shut down the interface (shutdown) and then re-enable it (no shutdown), which clears the error condition and restores connectivity. This is the only action that directly addresses the err-disable state caused by the security violation.

Answer

Remove the port from the VLAN

Answer

Clear the MAC address table on the switch

Answer

Increase the maximum number of MAC addresses allowed

Question 5

A security analyst needs to filter packets in Wireshark to capture only traffic on port 443. Which filter should be used?

Accepted Answer

tcp port 443. When capturing packets in Wireshark, a capture filter must be used. Capture filters use Berkeley Packet Filter (BPF) syntax. The filter 'tcp port 443' is the correct BPF syntax to capture only TCP traffic on port 443 (HTTPS). Option A uses Wireshark's display filter syntax, which is not used for capturing. Options B and C are also capture filters but B captures only destination port 443, and C captures both TCP and UDP on port 443, which is less specific.

Answer

tcp.port == 443

Answer

dst port 443

Answer

port 443

Question 6

Refer to the exhibit. An analyst runs the command 'tasklist /svc /fi "PID eq 1234"' on a Windows host and receives the output shown. Which conclusion can the analyst draw from this output?

Accepted Answer

The process is a legitimate Windows service host. The 'tasklist /svc /fi "PID eq 1234"' command filters for a specific PID and displays the associated services. The output shows 'svchost.exe' with the service 'DcomLaunch', which is a core Windows component responsible for launching COM and DCOM services. This confirms the process is a legitimate Windows service host, not a third-party application or malware.

Answer

The process is a third-party application

Answer

The process is using excessive CPU resources

Answer

The process is likely malware masquerading as svchost.exe

Question 7

During a forensic investigation, an analyst acquires a hard drive image using dd. What must be done to ensure the evidence is admissible in court?

Accepted Answer

Use a write blocker. Using a write blocker ensures that the hard drive is not modified during acquisition, preserving the original data's integrity. This is critical for maintaining the chain of custody and demonstrating that the evidence has not been tampered with, which is a fundamental requirement for admissibility in court. The dd command itself does not prevent writes; a hardware or software write blocker must be used to guarantee read-only access.

Answer

Encrypt the image

Answer

Compress the image

Answer

Store the image in a shared folder

Question 8

A SOC analyst receives an alert from the SIEM indicating a high number of failed login attempts on a domain controller from a single IP address over the last 10 minutes. The source IP is a known internal workstation. What should be the analyst's FIRST action?

Accepted Answer

Contact the user to verify if they are experiencing login issues. The analyst's first priority is to verify the legitimacy of the failed login attempts before taking any disruptive action. Since the source IP is a known internal workstation, the most likely cause is a user error, such as a forgotten password or a locked account. Contacting the user allows the analyst to quickly confirm whether the activity is benign, avoiding unnecessary escalation or network disruption.

Answer

Block the source IP at the firewall

Answer

Escalate to the incident response team

Answer

Ignore the alert because it is from an internal IP

Question 9

A security policy mandates that all employees complete annual security awareness training. Which of the following metrics best demonstrates the effectiveness of this training?

Accepted Answer

Decrease in security incidents attributed to user error. A decrease in security incidents attributed to user error directly measures the behavioral outcome of the training. Effective security awareness training should reduce the frequency of incidents caused by human mistakes, such as clicking malicious links or mishandling data. This metric reflects the ultimate goal of the training, not just participation or short-term knowledge retention.

Answer

Results of a post-training quiz

Answer

Percentage of employees who completed the training

Answer

Number of help desk tickets related to phishing

Question 10

Refer to the exhibit. A security analyst sees this syslog message from the ASA. Which statement best describes what is occurring?

Accepted Answer

An external host is connecting to an internal host. The syslog message shows a built connection from an external IP address (10.10.10.10) to an internal host (192.168.1.100) on port 80. The ASA logs 'built inbound TCP connection' when a new TCP session is established from a lower-security interface (outside) to a higher-security interface (inside), which requires an ACL or NAT rule to permit. This indicates an external host is connecting to an internal host, not an inside host initiating outbound traffic.

Answer

An inside host is initiating a connection to a web server

Answer

Traffic is being denied by the access list

Answer

The connection is being torn down

Question 11

Which THREE of the following are common evasion techniques used by attackers?

Accepted Answer

Slow scans. Slow scans are a common evasion technique used by attackers to avoid detection by intrusion detection systems (IDS) and intrusion prevention systems (IPS). By sending packets at a very low rate, often over hours or days, the scan falls below the threshold of time-based detection algorithms that trigger alerts on rapid port sweeps. This technique exploits the fact that many security devices rely on timing heuristics to identify reconnaissance activity.

Answer

Using high ports

Answer

Patching vulnerabilities

Question 12

A SOC analyst receives an alert for 'Malware Detected' from an endpoint sensor. The analyst checks the endpoint and sees a file named 'invoice.exe' in the Downloads folder. What should the analyst do first?

Accepted Answer

Isolate the host from the network.. The correct first step is to isolate the host from the network (C) because the alert indicates active malware ('invoice.exe' in Downloads). Containment is the immediate priority in incident response to prevent lateral movement and data exfiltration. Isolating the host stops any ongoing C2 communication or propagation over the network, aligning with the NIST SP 800-61 containment strategy.

Answer

Escalate to a senior analyst.

Answer

Run a full antivirus scan.

Answer

Delete the file immediately.

Question 13

An analyst is reviewing a suspicious email reported by a user. The email contains an attachment 'invoice.pdf' and urges the user to open it. Which indicator is most likely to confirm it is a phishing attempt?

Accepted Answer

The email was sent from a domain that looks like 'arnazon.com'.. The most definitive indicator of a phishing attempt is a spoofed sender domain that mimics a legitimate company (e.g., 'arnazon.com' instead of 'amazon.com'). This is a classic typosquatting technique used to deceive users into trusting the email's origin. While other elements like logos or PDF attachments can be part of a phishing campaign, they are not inherently malicious and are commonly used in legitimate business communications.

Answer

The email has a company logo.

Answer

The attachment is a PDF file.

Answer

The email was sent during business hours.

Question 14

Which THREE of the following are common types of malware?

Accepted Answer

Virus. A virus is a type of malware that replicates by attaching itself to legitimate executable files or scripts, requiring user action (e.g., opening an infected attachment) to spread. It is one of the classic and most common forms of malicious software, making option B correct.

Answer

Patch

Answer

Firewall

Question 15

A SIEM correlation rule triggers when more than 10 failed login attempts from a single source IP occur within 1 minute. This rule is designed to detect:

Accepted Answer

Brute force attack. A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.

Answer

Privilege escalation

Answer

Malware infection

Answer

DDoS attack