200-201 Practice Test 35 — 15 Questions

Question 1

A security analyst is reviewing a series of failed login attempts on a critical server. The logs show that the source IP addresses are from multiple geographic regions and the usernames tried are all valid employees. The attempts occur every 5 minutes for the past hour. According to the company's security policy, which type of attack is most likely occurring, and what is the best immediate response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password spraying; enforce multi-factor authentication immediately.. The attack pattern—valid usernames with low-frequency attempts from diverse IPs—is characteristic of password spraying, where an attacker tries a single common password against many accounts to avoid lockout thresholds. The best immediate response is to enforce multi-factor authentication (MFA), which renders the stolen or guessed password insufficient for access, mitigating the attack without relying on IP-based blocking that is ineffective against distributed sources.

Answer

Credential stuffing; implement rate limiting.

Answer

Brute-force attack; add the IPs to a blocklist.

Answer

Dictionary attack; reset all employee passwords.

Question 2

A network analyst is investigating a suspected DNS tunneling attack. Which THREE of the following are indicators of DNS tunneling?

Accepted Answer

Unusually high volume of DNS queries to a single domain. DNS tunneling often involves high volumes of DNS queries to a single domain, large payloads in TXT records, and encoded data in subdomains to exfiltrate data.

Answer

DNS queries for well-known domains like google.com

Answer

Low volume of DNS queries from internal hosts

Question 3

Refer to the exhibit. A network analyst sees repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23. Based on the log, what type of activity is most likely occurring?

Accepted Answer

Brute force attempt on Telnet service. The log shows repeated denied attempts from host 10.0.0.2 to 10.0.0.1 on port 23, which is the default port for Telnet. Multiple failed connection attempts to a Telnet service indicate a brute force attack, where an attacker tries to guess credentials by repeatedly attempting to log in.

Answer

DNS amplification attack

Answer

ARP spoofing

Answer

ICMP flood attack

Question 4

A company has implemented a role-based access control (RBAC) policy for its network devices. A network engineer needs temporary access to configure a router in a different region. According to the RBAC policy, what is the appropriate procedure?

Accepted Answer

Submit a request to the security team for temporary role elevation with a specified time limit. RBAC policies require that any deviation from assigned roles, such as temporary access to a router in a different region, must be handled through a formal privilege elevation process. This typically involves submitting a request to the security team, who can grant temporary role elevation with a specified time limit, ensuring that access is auditable, time-bound, and revoked automatically. This aligns with the principle of least privilege and maintains the integrity of the RBAC model by avoiding permanent or shared credentials.

Answer

Have the root password shared via encrypted email to the engineer

Answer

Use the shared admin account for the duration of the task

Answer

Ask another engineer with access to perform the configuration changes

Question 5

An incident response plan includes steps to contain a ransomware outbreak. Which TWO actions are typically performed during the containment phase? (Select two.)

Accepted Answer

Disconnect infected systems from the network. Option D is correct because disconnecting infected systems from the network is a classic containment action that stops lateral movement and prevents the ransomware from spreading to additional hosts or shared resources. Option E is correct because quarantining malware samples isolates the malicious binaries in a controlled location so they cannot execute further while preserving them for forensic analysis and eradication planning. Option A is not a containment action; notifying law enforcement is typically an external communication or reporting step that occurs alongside or after containment. Option B is incorrect because identifying the initial infection vector is part of the investigation or root-cause analysis phase, not containment. Option C is incorrect because restoring data from backups is a recovery-phase activity performed after the threat has been contained and eradicated.

Answer

Notify law enforcement

Answer

Identify the initial infection vector

Answer

Restore data from backups

Question 6

A security analyst analyzes an IDS alert that triggered on the string '/etc/passwd'. What type of signature is this?

Accepted Answer

Atomic signature. The string '/etc/passwd' is a single, fixed pattern that the IDS matches against a single packet payload. This is the definition of an atomic signature: it looks for a specific content string without requiring any state or context from previous packets. Option C is correct because the alert is triggered solely by the presence of that literal string in a packet, not by any sequence of events or statistical deviation.

Answer

Stateful signature

Answer

Composite signature

Answer

Anomaly signature

Question 7

A security analyst is investigating a potential data breach. They need to preserve evidence for legal proceedings. Which action should the analyst take to ensure the integrity of the data?

Accepted Answer

Use a write blocker when creating a forensic image. A write blocker is a hardware or software tool that prevents any write operations to the storage device while a forensic image is being created, preserving the original evidence and ensuring the image is a bit-for-bit copy. This maintains the integrity and admissibility of evidence in legal proceedings.

Answer

Run antivirus scans on the affected system

Answer

Delete suspicious files to contain the threat

Answer

Copy files to a network share without write protection

Question 8

During an incident response, an analyst extracts a file from network traffic using Zeek's file analysis feature. The file has a SHA-256 hash that matches a known malware indicator. Which type of IoC is this?

Accepted Answer

File-based IoC. A file-based IoC is an indicator derived from a file artifact — such as a hash (MD5, SHA-1, SHA-256), filename, or file path — that identifies malicious content. Since the analyst extracted a file and matched its SHA-256 hash against a known malware indicator, this is a file-based IoC, regardless of the fact that the file was captured from network traffic.

Answer

Behavioral IoC

Answer

Network-based IoC

Answer

Host-based IoC

Question 9

An analyst suspects data exfiltration via DNS. Which log type would provide the most relevant information to confirm this?

Accepted Answer

DNS logs. DNS logs capture all DNS queries and responses, including the domain names being resolved. Data exfiltration via DNS often involves encoding stolen data into DNS queries (e.g., subdomains of a controlled domain). By examining DNS logs for unusual query patterns, high query volumes, or long, random-looking subdomains, an analyst can directly confirm exfiltration activity.

Answer

Web server logs

Answer

Firewall logs

Answer

IDS/IPS alerts

Question 10

An organization uses both network-based intrusion detection (NIDS) and host-based intrusion detection (HIDS). A HIDS alert reports that a critical server's registry key was modified. The NIDS shows no corresponding network activity. The change occurred during a scheduled maintenance window. What is the best course of action for the analyst?

Accepted Answer

Check the change management system to see if the modification was authorized. The registry modification occurred during a scheduled maintenance window, which is a legitimate time for authorized changes. The analyst should first verify the change management system to confirm whether the modification was planned and approved, as this aligns with standard change control processes. The absence of NIDS alerts further suggests the change was likely local and non-malicious, but confirmation via change management is essential before taking any action.

Answer

Ignore the alert because it occurred during maintenance

Answer

Escalate the alert as a potential security incident

Answer

Immediately revert the registry change

Question 11

Which THREE of the following are common evasion techniques used by attackers?

Accepted Answer

Slow scans. Slow scans (A) are a common evasion technique because spreading probes over long intervals (e.g., nmap -T0/-T1 or --scan-delay) keeps the traffic below IDS/IPS thresholds and rate-based detection, making the reconnaissance blend into normal traffic. Fragmentation (B) evades detection by splitting packets into tiny fragments (e.g., fragroute or nmap -f) so that IDS/IPS devices cannot reassemble and match signatures against the full payload, while the target host reassembles them. Encryption (E) is a common evasion technique because attackers tunnel or encrypt command-and-control and exfiltration traffic (e.g., TLS, SSH, or custom crypto) so deep packet inspection cannot read payloads or match signatures. Using high ports (C) is not inherently an evasion technique since high ports are normal for legitimate services and are easily logged and detected. Patching vulnerabilities (D) is a defensive remediation action, the opposite of an attacker evasion technique.

Answer

Using high ports

Answer

Patching vulnerabilities

Question 12

An organization is reviewing its risk management process and identifies a risk with a high probability and high impact. Management decides to stop the activity causing the risk. Which risk treatment option is being applied?

Accepted Answer

Risk avoidance. Risk avoidance is the treatment option where the organization eliminates the risk entirely by discontinuing the activity that creates it. Since management decided to stop the activity causing the high-probability, high-impact risk, this is avoidance. It is the only option that removes the risk rather than reducing, accepting, or transferring it.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk transfer

Question 13

Based on the exhibit, what is the most likely type of attack being observed?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets with spoofed source IP addresses, causing the target to allocate resources for half-open connections until it exhausts its backlog queue and denies legitimate traffic. The exhibit likely shows a massive spike in SYN packets without corresponding SYN-ACK or ACK completions, which is the hallmark of this attack.

Answer

ARP spoofing

Answer

DNS amplification attack

Answer

Port scan

Question 14

A SIEM correlation rule triggers when more than 10 failed login attempts from a single source IP occur within 1 minute. This rule is designed to detect:

Accepted Answer

Brute force attack. A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.

Answer

Privilege escalation

Answer

Malware infection

Answer

DDoS attack

Question 15

During a PCAP analysis, a security analyst notices an HTTP request with the URI parameter 'id=1 UNION SELECT username,password FROM users--'. What is the most likely attack being attempted?

Accepted Answer

SQL injection. The payload 'id=1 UNION SELECT username,password FROM users--' is a classic SQL injection attempt. It uses a UNION operator to combine the original query with a malicious one that extracts sensitive data from the users table, and the double dash comments out the rest of the original query.

Answer

Command injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal