200-201 Practice Test 35 — 15 Questions

Question 1

A small retail company uses a cloud-based point-of-sale (POS) system. The IT manager receives an alert from the cloud provider that the POS application is generating an unusually high number of outbound connections to an IP address in a foreign country. The POS application is only supposed to communicate with the cloud provider's servers in the United States. The IT manager checks the POS terminal logs and finds that a new user account was created locally on the terminal with administrative privileges two days ago. The terminal does not have antivirus installed. What should the IT manager do first to contain the incident and prevent data loss?

Accepted Answer

Disconnect the POS terminal from the network immediately.. Disconnecting the POS terminal from the network immediately halts the suspected data exfiltration and prevents further loss.

Answer

Reset the password for the new user account and disable it.

Answer

Install antivirus software on the terminal and run a full scan.

Answer

Contact the cloud provider to block the outbound IP address.

Question 2

A small retail company has a security policy that requires all point-of-sale (POS) systems to be isolated on a separate network segment with strict firewall rules. During a network audit, you discover that the POS system is connected to the same network as the office workstations, violating policy. The store manager says it was done for convenience because the network cable was too short. What is the best course of action?

Accepted Answer

Move the POS system to the correct network segment immediately and report the violation.. Option D is correct because immediate remediation and reporting is required. Option A is fine but lacks reporting; Option B is not a substitute; Option C is unacceptable.

Answer

Accept the risk because it's a small store.

Answer

Implement a software firewall on the POS system to compensate.

Answer

Purchase a longer cable and reconnect the POS to the correct segment.

Question 3

A security policy requires that all mobile devices connecting to corporate email must have a screen lock and be able to be remotely wiped. An employee's personal phone is lost. The employee reports the loss immediately. The phone is enrolled in MDM with remote wipe capability. However, the employee has not set a screen lock, violating policy. The phone contains synced email and contacts. What should the security team do?

Accepted Answer

Remotely wipe the phone immediately.. Option A is correct because remote wipe is the most critical action to protect corporate data. Option B is wrong because wiping should be done; Option C delays protection; Option D is impossible as the phone is lost.

Answer

Ask the employee to set a screen lock remotely.

Answer

Accept the risk since the phone is lost and wipe is possible.

Answer

Report the violation and suspend the employee's email access until compliance.

Question 4

A multinational company has a security policy that all data at rest in cloud storage must be encrypted using company-managed keys. The cloud administrator, due to performance concerns, configured server-side encryption with AWS managed keys instead. The security team discovers this during an audit. The policy does not differentiate between encryption types. The data stored includes financial records. What should the security team do?

Accepted Answer

Perform a risk assessment and present options to management, including the risk of not using company-managed keys.. Option C is correct because a risk assessment and management decision balances security and business needs. Option A is premature; Option B might be too disruptive; Option D is extreme.

Answer

Require the administrator to migrate the data to use company-managed keys immediately.

Answer

Accept the current configuration and update the policy to allow AWS managed keys for performance.

Answer

Disable the cloud storage until compliance is achieved.

Question 5

A security analyst at a financial firm is investigating a potential data breach. The company uses Cisco Firepower NGFW and Stealthwatch for network visibility. Over the past week, an internal server with IP 10.10.10.50 has been sending large amounts of data to an external IP 203.0.113.55 on TCP port 443. The Stealthwatch flow records show that the server typically communicates with only internal hosts and a few known external update servers. The analyst checks the Firepower events and sees no alerts for this traffic. The server is running a custom web application that handles financial transactions. The analyst suspects data exfiltration. What should the analyst do next?

Accepted Answer

Capture a packet trace of the suspicious traffic and analyze the SSL/TLS handshake to determine if the traffic is legitimate.. Option A is correct because the traffic is encrypted over TCP port 443 (HTTPS), so the analyst cannot determine the content or legitimacy of the data transfer without decrypting or inspecting the SSL/TLS handshake. Capturing a packet trace allows the analyst to examine the TLS handshake details, such as the server certificate, cipher suites, and SNI, which can reveal whether the external IP is a legitimate service or an unauthorized endpoint. This step is non-disruptive and provides forensic evidence before taking any blocking or quarantine actions.

Answer

Immediately block the destination IP on the firewall and quarantine the server.

Answer

Review the server's web server logs for any unusual requests or responses.

Answer

Check the server's running processes and network connections with a command line tool like netstat.

Question 6

GreenTech Inc. is a mid-sized company with 500 employees. The company uses Microsoft Exchange Online for email and has implemented a security policy that requires all employees to report suspicious emails to the security team. The security team uses a phishing simulation tool to train employees. In the past month, several employees have reported receiving emails that appear to be from the CEO requesting urgent wire transfers. The security team has blocked the sender domains and updated the email filters. However, one employee fell for the latest scam and transferred $50,000 to an account before reporting it. The security incident response plan states that any monetary loss must be reported to the board within 24 hours. The security analyst receives the report on Monday morning. What should the analyst do first based on the policy and best practices?

Accepted Answer

Immediately contact the bank to attempt to reverse the wire transfer. Option A is correct because time is critical; attempting to reverse the transfer may recover the funds. Option B is delayed and may miss the reversal window. Option C is secondary. Option D is overly disruptive.

Answer

Disable email access for all employees to prevent further attacks

Answer

Launch a full forensic investigation to identify the source

Answer

Notify the board within the 24-hour window as per policy

Question 7

A healthcare organization has a security policy that mandates immediate reporting of any potential data breach to the privacy officer. An analyst notices that an employee accidentally emailed a patient list to the wrong recipient. The recipient is known to be a trusted partner, but the email contained PHI. The analyst contacts the recipient who acknowledges receipt and agrees to delete the email. What should the analyst do next?

Accepted Answer

Report the incident as a data breach to the privacy officer as per policy.. Option B is correct because policy requires immediate reporting regardless of outcome. Option A ignores the policy; Option C circumvents the reporting requirement; Option D is not an immediate required action.

Answer

Update the access control list to prevent similar mistakes.

Answer

Do nothing further since the data was deleted.

Answer

Send a warning email to the employee without reporting.

Question 8

You are a security analyst at a financial institution. The network consists of a traditional perimeter firewall, an internal IDS (Snort), and a separate network monitoring tool that captures full packet data. Recently, the bank experienced a breach where an attacker exfiltrated customer data via DNS tunneling. The attack went undetected for weeks. The CISO wants to improve detection of data exfiltration and has tasked you with proposing a new monitoring strategy. The current IDS has signatures for common malware C2 channels but no specific DNS tunneling rules. You have access to the full packet capture archive. Which approach would be most effective in detecting DNS tunneling while minimizing false positives?

Accepted Answer

Write custom Snort rules that monitor DNS query size, frequency, and domain name entropy, and use full packet capture to baseline typical DNS behavior.. Option A is correct because DNS tunneling exploits legitimate DNS protocol behavior by encoding data in query payloads, making it invisible to signature-based detection. By writing custom Snort rules that monitor query size (typically > 255 bytes for TXT records), frequency (abnormally high query rates per domain), and domain name entropy (random-looking subdomains), and using full packet capture to baseline normal DNS traffic, you can detect anomalies indicative of tunneling with high precision and low false positives.

Answer

Block all DNS queries to external domains not on a whitelist, and log all blocked queries for review.

Answer

Increase the Snort signature sensitivity for all DNS-related alerts to maximum.

Answer

Deploy NetFlow monitoring on the DNS server and look for traffic volume anomalies.

Question 9

A hospital's network security team has received reports from nurses that the patient record system has become unresponsive. Upon investigation, the IT administrator finds that the database server is experiencing extremely high disk I/O and the system logs show repeated failed login attempts from an internal IP address that belongs to a medical imaging device. The imaging device is known to run an outdated embedded OS that cannot be patched. The device is isolated on its own VLAN, but the VLAN is allowed to communicate with the database server on TCP port 1433 for legitimate purposes. The attack logs show that the database server is being targeted with a dictionary attack using the default 'sa' account. What should the security analyst do first to contain the incident without disrupting critical medical operations?

Accepted Answer

Change the database server's 'sa' account password and implement account lockout policies.. Option D is correct because the immediate priority is to stop the ongoing dictionary attack against the database server's 'sa' account without disrupting critical medical operations. Changing the 'sa' password and implementing account lockout policies directly mitigates the brute-force attack at the authentication layer, while leaving the imaging device and its VLAN operational so that legitimate medical imaging traffic can continue. This containment step buys time for a more permanent solution, such as replacing or further isolating the vulnerable device.

Answer

Block the imaging device's IP address at the core firewall.

Answer

Take the imaging device offline immediately and isolate it from the network.

Answer

Disable the VLAN allowing communication between the imaging device and the database server.

Question 10

You are a SOC analyst for a school district. The district uses a Cisco Firepower NGFW for traffic inspection and a SIEM for log aggregation. A teacher reports that her workstation is slow and unresponsive. You check the SIEM and see that the workstation (IP 10.1.2.10) has been generating thousands of DNS queries to a domain 'badstuff.example.com' over the past hour. The firewall logs show that the workstation also made many outbound connections to IP 203.0.113.50 on port 80. The DNS queries are for various random subdomains of 'badstuff.example.com'. The school's web filter has no policy for this domain. The user is not technical and cannot explain the behavior. What is the most likely cause and the appropriate first action?

Accepted Answer

Isolate the workstation from the network and add the domain to the block list. The workstation is generating thousands of DNS queries for random subdomains of 'badstuff.example.com' and making outbound connections to IP 203.0.113.50 on port 80. This behavior is classic DNS tunneling, where an infected host encodes data in DNS queries to bypass security controls. Isolating the workstation stops the immediate threat and data exfiltration, while adding the domain to the block list prevents further communication from other hosts. A full antivirus scan is insufficient because DNS tunneling malware often evades signature-based detection and requires network containment first.

Answer

Run a full antivirus scan on the workstation

Answer

Update the web filter to block the domain and continue monitoring

Answer

Ignore the alert because DNS tunneling is not a real threat

Question 11

You are an analyst in a SOC that monitors a retail company with multiple branch offices. The company uses VPN connections between branches. The SIEM reports that a branch office router (IP 10.99.0.1) has been sending large amounts of data to an external IP 185.220.101.10 on port 123 (NTP) during off-hours. The NTP traffic is abnormal because the branch uses a local time server. The amount of data sent is 2 GB over 8 hours. The router logs show normal administrative traffic. The branch manager reports no issues. You check threat intelligence and find that 185.220.101.10 is a known malicious IP associated with data exfiltration. What should be your immediate response?

Accepted Answer

Block the external IP 185.220.101.10 on the firewall and initiate incident response for the router. Option C is correct because the branch router is sending 2 GB of NTP traffic to a known malicious IP (185.220.101.10) during off-hours, which is a strong indicator of data exfiltration using NTP (often via tunneling or covert channels). The immediate response should be to block the external IP on the firewall to stop the data flow and initiate incident response to investigate the compromised router, as the traffic is abnormal (branch uses a local time server) and the IP is associated with exfiltration.

Answer

Disable NTP service on the branch router

Answer

Notify the CISO and wait for further instructions

Answer

Contact the branch manager to confirm if any scheduled backups are running

Question 12

A SOC analyst is monitoring network traffic using Cisco Stealthwatch. An alert is generated indicating a large volume of data being transferred from a critical server to an external IP address during off-hours. The analyst observes that the data transfer is using encrypted HTTPS traffic to a cloud storage provider. The server is known to host sensitive customer data. The analyst reviews the server's outbound firewall rules and finds that HTTPS traffic to any destination is allowed. The analyst checks the server's recent login logs and sees an authentication from a user account that is typically used by a contractor who only works during business hours. The contractor's account has not been disabled after the contract ended last week. What should the analyst do first?

Accepted Answer

Investigate the alert further by checking the server for any signs of malware or unauthorized access, and then escalate to the incident response team.. The correct first step is to investigate the alert further to confirm whether it is a genuine security incident. Option C is correct because it follows established incident response procedures: gather more evidence (e.g., check for malware, unauthorized access) before taking containment or eradication actions. Prematurely blocking the IP (A) could disrupt legitimate business operations if the transfer is authorized. Disabling the account (B) is a valid remediation step but should occur after confirming the incident and as part of a coordinated response. Ignoring the alert (D) is dangerous because encryption does not automatically indicate benign activity; exfiltration often uses HTTPS to evade detection.

Answer

Ignore the alert because the traffic is encrypted and cannot be inspected.

Answer

Immediately block the external IP address at the firewall to stop the data transfer.

Answer

Disable the contractor's user account and notify the IT manager.

Question 13

An organization's security policy mandates that all external media (USB drives, external hard drives) must be scanned for malware before use. An employee inserts a USB drive to transfer a presentation for a meeting. The employee runs the antivirus scan, but it fails to complete because the USB drive has a hardware write-protect switch. The employee is in a hurry. What should the employee do?

Accepted Answer

Remove the USB drive and use a different approved method of file transfer.. Option C is correct because if the scan cannot be performed, the USB should not be used; using an alternative method complies with policy. Option A may still not allow a proper scan; Option B violates policy; Option D is not a substitute for scanning.

Answer

Manually check each file for suspicious extensions.

Answer

Disable write protection and rescan.

Answer

Proceed with the file transfer since the scan failed due to hardware issue.

Question 14

You are a security analyst at a multinational corporation. The company has implemented a security policy that requires all employees to use company-issued laptops with full disk encryption. During a routine audit, you discover that a senior executive's laptop is not encrypted. The executive claims that IT support had disabled encryption because the laptop was running slowly. The current policy does not allow exceptions without management approval. The executive's laptop contains sensitive client data. What should you do?

Accepted Answer

Report the violation to the security manager and advise that the laptop remain in use but monitored closely until encryption can be applied during next maintenance window.. Option B is correct because reporting the violation and monitoring the laptop until encryption can be applied is a balanced approach. Option A violates policy by making changes without approval; Option C overreacts without evidence of breach; Option D ignores policy entirely.

Answer

Accept the executive's explanation and document it as an informal exception.

Answer

Escalate to the incident response team to treat this as a data breach because data may have been exposed.

Answer

Immediately re-enable encryption on the laptop and submit an exception request after the fact.

Question 15

A financial services company has a security policy that all remote access must be through VPN with two-factor authentication. An employee on a business trip uses a hotel Wi-Fi to connect to the corporate network but claims the VPN client was not working, so they used RDP directly over the internet to access their desktop. The employee's manager approved this as a temporary measure. The security team discovers this during a log review. The policy has no provision for temporary exceptions. What should be the security team's first action?

Accepted Answer

Investigate whether any data was compromised during the session.. Option D is correct because the first step is to investigate whether any data was compromised during the session. Option A might be too harsh without evidence; Option B is premature; Option C ignores the policy violation.

Answer

Report the violation to the security officer and recommend disciplinary action.

Answer

Disable RDP access from the internet for all users immediately.

Answer

Accept the manager's approval as sufficient authorization.